Systems and methods for robust anomaly detection

A tangible, non-transitory, machine-readable medium, comprising machine-readable instructions to:

• receive a stream of the current time-series data;
• at periodic intervals, classify the stream of current time-series data into at least one of a plurality of classifications based at least in part upon historical time-series data;
• when the classification comprises a seasonal classification, identify a statistical model representative of the stream of current time-series data from a selection between a weekly statistical model and a daily statistical model;
• and
• perform a statistical analysis on the stream of the current time-series data based at least in part upon the statistical model constructed by the time-series analyzer;
• and
• provide a graphical indication of results of the statistical analysis at a communicatively coupled instance.

The machine-readable medium of claim 12, comprising instructions to:

• identify statistical outliers of the stream of the current time-series data based at least on the statistical analysis;
• determine an anomalous score for the statistical outliers by tracking a history of the statistical outliers;
• wherein the anomalous score indicates a magnitude of deviation between the stream of current time-series data and the statistical model;
• and
• store the anomalous score, for subsequent reporting, client action, or both.

A management, instrumentation, and discovery (MID) server, comprising:

• one or more processors, configured to execute machine readable instructions;
• a tangible, non-transitory, machine-readable medium, comprising machine-readable instructions that, when executed by the one or more processors:
• receive a subset of a stream of current time-series data that is associated with assigned configuration items (CIs) of the MID server;
• classify the subset of the stream of current time-series data as seasonal data;
• select a statistical model representative of the subset of the stream of current time-series data from a selection between a weekly statistical model and a daily statistical model;
• perform a statistical analysis on the stream of the current time-series data based at least in part upon the statistical model constructed by the time-series analyzer;
• identify statistical outliers of the stream of the current time-series data based at least on the statistical analysis;
• classify the statistical outliers as either transient or a level shift;
• and
• when the statistical outliers are classified as transient, identify an anomaly from the statistical outliers by tracking a history of the statistical outliers;
• wherein the anomaly is identified based upon a magnitude of deviation between the current time-series data and the statistical model.