Systems and methods for machine learning model selection for time series data

A system, comprising:

• a processor of a network monitoring system, coupled to memory, to:
• obtain a plurality of sets of time series data from a plurality of communication sessions between client devices and service providers via a monitored communication network;
• generate a cluster of two or more of the plurality of sets of time series data based on a similarity between each of the two or more sets of time series data, wherein to generate the cluster the processor automatically applies a first clustering algorithm to the plurality of sets of time series data, calculates a similarity value for the cluster using a silhouette coefficient, and, responsive to the similarity value being below a threshold, increments a quantity of clusters and reapplies the clustering algorithm until the similarity value satisfies the threshold or a maximum quantity of clusters is reached, or alternatively resets the quantity of clusters and applies a second, different clustering algorithm;
• determine a first set of time series data as a center of the cluster by computing, for each set, a distance to each other set of the cluster and selecting the set having a lowest aggregate distance to the other sets;
• execute, using the first set of time series data as input, a first machine learning model to generate a first time series output comprising forecast values for a future period of the time series data;
• execute the first machine learning model using a second set of time series data as input to generate a second time series output and calculate anomaly detection thresholds comprising an upper bound and a lower bound for the second time series output based on determining the first time series output of the first machine learning model satisfies a variance threshold, wherein the bounds are used automatically by the processor to identify anomalies in subsequent observed time series data originating from the monitored communication network;
• wherein the processor trains and evaluates a plurality of machine learning models sequentially in an order based on model training efficiency, trains each machine learning model of the plurality of machine learning models immediately prior to evaluating the machine learning model, and skips training and evaluating remaining less efficient machine learning models of the plurality of machine learning models responsive to determining the first time series output of the first machine learning model satisfies the variance threshold, thereby reducing processing requirements and training time;
• wherein the anomalies comprise network performance anomalies including at least one of dropped calls, bandwidth degradation, signal quality degradation, or handover failures in the communication sessions;
• and
• responsive to determining an average variance score across time series data associated with a network performance metric falls below the variance threshold for a consecutive quantity of times, reevaluate and reselect a different machine learning model for the network performance metric, thereby adapting machine learning model selection to data pattern changes in the time series data over time.

A non-transitory computer readable storage medium comprising instructions stored thereon that, when executed by a processor of a network monitoring system, cause the processor to:

• obtain a plurality of sets of time series data from a plurality of communication sessions between client devices and service providers via a monitored communication network;
• generate a cluster of two or more of the plurality of sets of time series data based on a similarity between each of the two or more sets of time series data, wherein the instructions to generate the cluster cause the processor to automatically apply a first clustering algorithm to the plurality of sets of time series data, calculate a similarity value for the cluster using a silhouette coefficient, and, responsive to the similarity value being below a threshold, increment a quantity of clusters and reapply the clustering algorithm until the similarity value satisfies the threshold or a maximum quantity of clusters is reached, or alternatively reset the quantity of clusters and apply a second, different clustering algorithm;
• determine a first set of time series data as a center of the cluster by computing, for each set, a distance to each other set of the cluster and selecting the set having a lowest aggregate distance to the other sets;
• execute, using the first set of time series data as input, a first machine learning model to generate a first time series output comprising forecast values for a future period of the time series data;
• execute the first machine learning model using a second set of time series data as input to generate a second time series output and calculate anomaly detection thresholds comprising an upper bound and a lower bound for the second time series output based on determining the first time series output of the first machine learning model satisfies a variance threshold, wherein the bounds are used automatically by the processor to identify anomalies in subsequent observed time series data originating from the monitored communication network;
• wherein the instructions further cause the processor to train and evaluate a plurality of machine learning models sequentially in an order based on model training efficiency, train each machine learning model of the plurality of machine learning models immediately prior to evaluating the machine learning model, and skip training and evaluating remaining less efficient machine learning models of the plurality of machine learning models responsive to determining the first time series output of the first machine learning model satisfies the variance threshold, thereby reducing processing requirements and training time;
• wherein the anomalies comprise network performance anomalies including at least one of dropped calls, bandwidth degradation, signal quality degradation, or handover failures in the communication sessions;
• and
• responsive to determining an average variance score across time series data associated with a network performance metric falls below the variance threshold for a consecutive quantity of times, cause the processor to reevaluate and reselect a different machine learning model for the network performance metric, thereby adapting machine learning model selection to data pattern changes in the time series data over time.