Systems and methods for anomaly detection

A tangible, non-transitory, machine-readable medium, comprising machine-readable instructions to:

• at periodic intervals, classify a stream of current time-series data into at least one of a plurality of classifications based at least in part upon historical time-series data;
• construct a statistical model representative of the stream of current time-series data based upon the at least one of the plurality of classifications;
• monitor the stream of the current time-series data;
• perform a statistical analysis on the stream of the current time-series data based at least in part upon the statistical model constructed by the time-series analyzer;
• identify statistical outliers of the stream of the current time-series data based at least on the statistical analysis;
• determine an anomalous score for the statistical outliers by tracking a history of the statistical outliers;
• wherein the anomalous score indicates a magnitude of deviation between the stream of current time-series data and the statistical model;
• and
• store the anomalous score, for subsequent reporting, client action, or both.

A management, instrumentation, and discovery (MID) server, comprising:

• one or more processors, configured to execute machine readable instructions;
• a tangible, non-transitory, machine-readable medium, comprising machine-readable instructions that, when executed by the one or more processors:
• classify a stream of current time-series data into at least one of a plurality of classifications based at least in part upon historical time-series data;
• construct a statistical model representative of the stream of current time-series data based upon the at least one of the plurality of classifications;
• monitor a stream of the current time-series data;
• perform a statistical analysis on the stream of the current time-series data based at least in part upon the statistical model constructed by the time-series analyzer;
• identify statistical outliers of the stream of the current time-series data based at least on the statistical analysis;
• determine an anomalous score for the statistical outliers by tracking a history of the statistical outliers;
• wherein the anomalous score indicates a magnitude of deviation between the current time-series data and the statistical model;
• determine any events triggered by the anomalous score reaching or exceeding a threshold;
• and
• present data relating to the statistical model, the anomalous score, and the events to a communicatively coupled Instance.