Computing systems and methods for creating and executing user-defined anomaly detection rules and generating notifications for detected anomalies

A non-transitory computer-readable medium, wherein the non-transitory computer-readable medium is provisioned with program instructions that, when executed by at least one processor, cause a computing platform to:

• cause a client device associated with a user to present an interface for creating an anomaly detection rule, wherein the interface includes a set of user-selectable options that is determined based on permissions information associated with the user;
• receive, from the client device, data defining a given anomaly detection rule that has been created by the user via the interface, wherein the given anomaly detection rule comprises at least one anomaly condition that is to be applied to at least one streaming event queue;
• store a data representation of the given anomaly detection rule in a data store;
• retrieve the data representation of the given anomaly detection rule from the data store;
• convert the data representation of the given anomaly detection rule to a streaming query statement;
• iteratively apply the streaming query statement to the at least one streaming event queue;
• while iteratively applying the streaming query statement to the at least one streaming event queue, make at least one determination that the at least one anomaly condition is satisfied;
• and
• based on the at least one determination, cause at least one anomaly notification to be issued to the user.

A method carried out by a computing platform, the method comprising:

• causing a client device associated with a user to present an interface for creating an anomaly detection rule, wherein the interface includes a set of user-selectable options that is determined based on permissions information associated with the user;
• receiving, from the client device, data defining a given anomaly detection rule that has been created by the user via the interface, wherein the given anomaly detection rule comprises at least one anomaly condition that is to be applied to at least one streaming event queue;
• storing a data representation of the given anomaly detection rule in a data store;
• retrieving the data representation of the given anomaly detection rule from the data store;
• converting the data representation of the given anomaly detection rule to a streaming query statement;
• iteratively applying the streaming query statement to the at least one streaming event queue;
• while iteratively applying the streaming query statement to the at least one streaming event queue, making at least one determination that the at least one anomaly condition is satisfied;
• and
• based on the at least one determination, causing at least one anomaly notification to be issued to the user.

A computing platform comprising:

• at least one processor;
• at least one non-transitory computer-readable medium;
• and
• program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:
• cause a client device associated with a user to present an interface for creating an anomaly detection rule;
• receive, from the client device, data defining a given anomaly detection rule that has been created by the user via the interface, wherein the given anomaly detection rule comprises at least one anomaly condition that is to be applied to at least one streaming event queue;
• store a data representation of the given anomaly detection rule in a data store;
• retrieve the data representation of the given anomaly detection rule from the data store;
• convert the data representation of the given anomaly detection rule to a streaming query statement;
• iteratively apply the streaming query statement to the at least one streaming event queue;
• while iteratively applying the streaming query statement to the at least one streaming event queue, make at least one determination that the at least one anomaly condition is satisfied;
• and
• based on the at least one determination:
• generate at least one anomaly event;
• write the generated at least one anomaly event to a given streaming event queue that is designated for anomaly events;
• based on the at least one anomaly event and the data representation of the given anomaly detection rule, generate at least one anomaly notification to be issued to the user;
• and
• cause the at least one anomaly notification to be issued to the user.

A non-transitory computer-readable medium, wherein the non-transitory computer-readable medium is provisioned with program instructions that, when executed by at least one processor, cause a computing platform to:

• cause a client device associated with a user to present an interface for creating an anomaly detection rule;
• receive, from the client device, data defining a given anomaly detection rule that has been created by the user via the interface, wherein the given anomaly detection rule comprises at least one anomaly condition that is to be applied to at least one streaming event queue;
• store a data representation of the given anomaly detection rule in a data store;
• retrieve the data representation of the given anomaly detection rule from the data store;
• convert the data representation of the given anomaly detection rule to a streaming query statement;
• iteratively apply the streaming query statement to the at least one streaming event queue;
• while iteratively applying the streaming query statement to the at least one streaming event queue, make at least one determination that the at least one anomaly condition is satisfied;
• and
• based on the at least one determination:
• generate at least one anomaly event;
• write the generated at least one anomaly event to a given streaming event queue that is designated for anomaly events;
• based on the at least one anomaly event and the data representation of the given anomaly detection rule, generate at least one anomaly notification to be issued to the user;
• and
• cause the at least one anomaly notification to be issued to the user.

A method carried out by a computing platform, the method comprising:

• causing a client device associated with a user to present an interface for creating an anomaly detection rule;
• receiving, from the client device, data defining a given anomaly detection rule that has been created by the user via the interface, wherein the given anomaly detection rule comprises at least one anomaly condition that is to be applied to at least one streaming event queue;
• storing a data representation of the given anomaly detection rule in a data store;
• retrieving the data representation of the given anomaly detection rule from the data store;
• converting the data representation of the given anomaly detection rule to a streaming query statement;
• iteratively applying the streaming query statement to the at least one streaming event queue;
• while iteratively applying the streaming query statement to the at least one streaming event queue, making at least one determination that the at least one anomaly condition is satisfied;
• and
• based on the at least one determination:
• generating at least one anomaly event;
• writing the generated at least one anomaly event to a given streaming event queue that is designated for anomaly events;
• based on the at least one anomaly event and the data representation of the given anomaly detection rule, generating at least one anomaly notification to be issued to the user;
• and
• causing the at least one anomaly notification to be issued to the user.

A computing platform comprising:

• at least one processor;
• at least one non-transitory computer-readable medium;
• and
• program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:
• cause a client device associated with a user to present an interface for creating an anomaly detection rule;
• receive, from the client device, data defining a given anomaly detection rule that has been created by the user via the interface, wherein the given anomaly detection rule comprises at least one anomaly condition that is to be applied to at least one streaming event queue for which the computing platform maintains a schema;
• store a data representation of the given anomaly detection rule in a data store;
• detect a request to update the schema for the at least one streaming event queue;
• determine that the request to update the schema involves removal of a data field;
• based on determining that the request to update the schema involves removal of the data field, decline to update the schema for the at least one streaming event queue;
• retrieve the data representation of the given anomaly detection rule from the data store;
• convert the data representation of the given anomaly detection rule to a streaming query statement;
• iteratively apply the streaming query statement to the at least one streaming event queue;
• while iteratively applying the streaming query statement to the at least one streaming event queue, make at least one determination that the at least one anomaly condition is satisfied;
• and
• based on the at least one determination, cause at least one anomaly notification to be issued to the user.

A non-transitory computer-readable medium, wherein the non-transitory computer-readable medium is provisioned with program instructions that, when executed by at least one processor, cause a computing platform to:

• cause a client device associated with a user to present an interface for creating an anomaly detection rule;
• receive, from the client device, data defining a given anomaly detection rule that has been created by the user via the interface, wherein the given anomaly detection rule comprises at least one anomaly condition that is to be applied to at least one streaming event queue for which the computing platform maintains a schema;
• store a data representation of the given anomaly detection rule in a data store;
• detect a request to update the schema for the at least one streaming event queue;
• determine that the request to update the schema involves removal of a data field;
• based on determining that the request to update the schema involves removal of the data field, decline to update the schema for the at least one streaming event queue;
• retrieve the data representation of the given anomaly detection rule from the data store;
• convert the data representation of the given anomaly detection rule to a streaming query statement;
• iteratively apply the streaming query statement to the at least one streaming event queue;
• while iteratively applying the streaming query statement to the at least one streaming event queue, make at least one determination that the at least one anomaly condition is satisfied;
• and
• based on the at least one determination, cause at least one anomaly notification to be issued to the user.

A method carried out by a computing platform, the method comprising:

• causing a client device associated with a user to present an interface for creating an anomaly detection rule;
• receiving, from the client device, data defining a given anomaly detection rule that has been created by the user via the interface, wherein the given anomaly detection rule comprises at least one anomaly condition that is to be applied to at least one streaming event queue for which the computing platform maintains a schema;
• storing a data representation of the given anomaly detection rule in a data store;
• detecting a request to update the schema for the at least one streaming event queue;
• determining that the request to update the schema involves removal of a data field;
• based on determining that the request to update the schema involves removal of the data field, declining to update the schema for the at least one streaming event queue;
• retrieving the data representation of the given anomaly detection rule from the data store;
• converting the data representation of the given anomaly detection rule to a streaming query statement;
• iteratively applying the streaming query statement to the at least one streaming event queue;
• while iteratively applying the streaming query statement to the at least one streaming event queue, making at least one determination that the at least one anomaly condition is satisfied;
• and
• based on the at least one determination, causing at least one anomaly notification to be issued to the user.