Methods, devices and computer storage media for anomaly detection

An anomaly detection device, comprising:

• processing circuitry;
• memory containing instructions executable by the processing circuitry whereby the anomaly detection device is operative to:
• apply Fast Fourier transform (FFT), high frequency filtering, and Inverse Fast Fourier transform (IFFT) to an original time series to obtain a first time series, wherein points on the original time series indicate data detected within a detection period of a node;
• compare data indicated by each point on the original time series with data indicated by a corresponding point on the first time series;
• in response to a difference between data indicated by a point on the original time series and data indicated by a corresponding point on the first time series being greater than a first preset threshold:
• perform interpolation on the point on the original time series to obtain a second time series;
• apply the FFT, the high frequency filtering, and the IFFT to the second time series to obtain a third time series;
• determine the point on the original time series as an anomalous point of the original time series if a difference between the data indicated by the point on the original time series and data indicated by a corresponding point on the third time series is greater than the first preset threshold;
• and
• using, by the device, information identifying the anomalous point for at least one of:
• removing the anomalous point from the original time series prior to further analysis or processing of the time series, or
• providing anomaly information for use by a network management system that monitors traffic of the node.

A non-transitory computer readable recording medium storing a computer program product for controlling anomaly detection, the computer program product comprising program instructions which, when run on processing circuitry of an anomaly detection device, causes the anomaly detection device to:

• apply Fast Fourier transform (FFT), high frequency filtering, and Inverse Fast Fourier transform (IFFT) to an original time series to obtain a first time series, wherein points on the original time series indicate data detected within a detection period of a node;
• compare data indicated by each point on the original time series with data indicated by a corresponding point on the first time series;
• in response to a difference between data indicated by a point on the original time series and data indicated by a corresponding point on the first time series being greater than a first preset threshold:
• perform interpolation on the point on the original time series to obtain a second time series;
• apply the FFT, the high frequency filtering, and the IFFT to the second time series to obtain a third time series;
• determine the point on the original time series as an anomalous point of the original time series if a difference between the data indicated by the point on the original time series and data indicated by a corresponding point on the third time series is greater than the first preset threshold;
• and
• using, by the device, information identifying the anomalous point for at least one of:
• removing the anomalous point from the original time series prior to further analysis or processing of the time series, or
• providing anomaly information for use by a network management system that monitors traffic of the node.