# US 2014/0153396 A1 · Detecting outliers in network traffic time series

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0153396 A1
- Document ID: US20140153396A1
- Status: Published application
- Kind: A1
- Application number: 14/176,446
- Filed: 2014-02-10
- Published: 2014-06-05
- Earliest claimed: 2008-07-31
- Assignees: Riverbed Technology, Inc.
- Applicants: Riverbed Technology, Inc.
- Inventors: Prem K. Gopalan; Bryan Thomas Elverson
- Web page: https://patentgrep.com/patent/US20140153396A1

## CPC

- H04L 41/142: using statistical or mathematical methods
- H04L 43/022: by sampling
- H04L 47/127: by using congestion prediction
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 43/067: using time frame reporting
- H04L 43/0876: Network utilisation, e.g. volume of load or congestion level
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

According to an aspect of the invention, a system and method is configured to detect time series outliers in network traffic.

## Claims

### Claim 1

A computer-implemented method, comprising:
identifying, by computer, an outlier for a network traffic metric if observed network traffic is outside of a prediction interval during a time period; and
identifying an anomaly for the network traffic metric only when a count of outliers for the network traffic metric identified during the time period is greater than or equal to two, and exceeds an anomaly threshold for the network traffic metric.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, further comprising merging identified anomalies for each of a plurality of network traffic metrics to identify a single event.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, further comprising providing information about the network traffic to a user upon identification of the single event.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein prior to identifying the outlier, the method further comprising:
generating a forecast of network traffic using a model, the forecast being based on previously observed network traffic;
generating a prediction interval that extends above and below the forecast of the network traffic, the prediction interval being based on previously observed deviations from predicted network traffic; and
comparing observed network traffic to the prediction interval.

### Claim 5 (depends on 4)

The computer-implemented method of claim 4, wherein the model includes at least a first and a second seasonality, and wherein the forecast is generated based on previously observed network traffic at first and second time periods associated with the first and the second seasonality.

### Claim 6 (depends on 4)

The computer-implemented method of claim 4, wherein the model is a Holt-Winters model having daily and weekly seasonality.

### Claim 7 (depends on 4)

The computer-implemented method of claim 4, wherein said generating the forecast of network traffic using the model includes:
generating the forecast based on at least two weeks of network traffic data; and
generating the prediction interval based on at least one week of network traffic data.

### Claim 8

A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method comprising:
Identifying an outlier for a network traffic metric if observed network traffic is outside of a prediction interval during a time period; and
identifying an anomaly for the network traffic metric only when a count of outliers for the network traffic metric identified during the time period is greater than or equal to two, and exceeds an anomaly threshold for the network traffic metric.

### Claim 9 (depends on 8)

The non-transitory computer-readable storage medium of claim 8, further comprising merging identified anomalies for each of a plurality of network traffic metrics to identify a single event.

### Claim 10 (depends on 9)

The non-transitory computer-readable storage medium of claim 9, further comprising providing information about the network traffic to a user upon identification of the single event.

### Claim 11 (depends on 8)

The non-transitory computer-readable storage medium of claim 8, wherein prior to identifying the outlier, the method further comprising:
generating a forecast of network traffic using a model, the forecast being based on previously observed network traffic;
generating a prediction interval that extends above and below the forecast of the network traffic, the prediction interval being based on previously observed deviations from predicted network traffic; and
comparing observed network traffic to the prediction interval.

### Claim 12 (depends on 11)

The non-transitory computer-readable storage medium of claim 11, wherein the model includes at least a first and a second seasonality, and wherein the forecast is generated based on previously observed network traffic at first and second time periods associated with the first and the second seasonality.

### Claim 13 (depends on 11)

The non-transitory computer-readable storage medium of claim 11, wherein the model is a Holt-Winters model having daily and weekly seasonality.

### Claim 14 (depends on 11)

The non-transitory computer-readable storage medium of claim 11, wherein said generating the forecast of network traffic using the model includes:
generating the forecast based on at least two weeks of network traffic data; and
generating the prediction interval based on at least one week of network traffic data.

### Claim 15

An apparatus, comprising:
a processor; and
a storage medium storing instructions that, when executed by the processor, cause the apparatus to perform a method comprising:
identifying an outlier for a network traffic metric if observed network traffic is outside of a prediction interval during a time period; and
identifying an anomaly for the network traffic metric only when a count of outliers for the network traffic metric identified during the time period is greater than or equal to two, and exceeds an anomaly threshold for the network traffic metric.

### Claim 16 (depends on 15)

The apparatus of claim 15, wherein the method further comprises merging identified anomalies for each of a plurality of network traffic metrics to identify a single event.

### Claim 17 (depends on 16)

The apparatus of claim 16, wherein the method further comprises providing information about the network traffic to a user upon identification of the single event.

### Claim 18 (depends on 15)

The apparatus of claim 15, wherein prior to identifying the outlier, the method further comprises:
generating a forecast of network traffic using a model, the forecast being based on previously observed network traffic;
generating a prediction interval that extends above and below the forecast of the network traffic, the prediction interval being based on previously observed deviations from predicted network traffic; and
comparing observed network traffic to the prediction interval.

### Claim 19 (depends on 18)

The apparatus of claim 18, wherein the model includes at least a first and a second seasonality, and wherein the forecast is generated based on previously observed network traffic at first and second time periods associated with the first and the second seasonality.

### Claim 20 (depends on 18)

The apparatus of claim 18, wherein said generating the forecast of network traffic using the model includes:
generating the forecast based on at least two weeks of network traffic data; and
generating the prediction interval based on at least one week of network traffic data.