# US 2024/0202093 A1 · Methods and systems for generation and optimization of metric threshold for anomaly detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0202093 A1 - Document ID: US20240202093A1 - Status: Published application - Kind: A1 - Application number: 18/539,575 - Filed: 2023-12-14 - Published: 2024-06-20 - Earliest claimed: 2022-12-16 - Assignees: Tata Consultancy Services Limited - Applicants: Tata Consultancy Services Limited - Inventors: Satya Narayana SAMUDRALA; Kunal Jethuri; Priyadarshi Rai; Maitreya Natu - Web page: https://patentgrep.com/patent/US20240202093A1 ## CPC - G06F 11/3409: {for performance assessment} - G06F 11/0754: {by exceeding limits} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 2201/81: Threshold - G06F 2201/86: Event-based monitoring - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract The present disclosure is related to the field of threshold generation where complex temporal and spatial behavior of metrics are modelled to define normal operating baseline of every component in a system environment. Embodiments of the present disclosure provide methods and systems for generation and optimization of metric threshold for anomaly detection. In the present disclosure, temporal properties such as variation, behavioral patterns of a plurality of metrics are derived. The derived temporal properties are used to generate data-driven and domain-aware static or dynamic thresholds. Additionally, the present disclosure factors spatial and temporal properties collectively to mine a role of influencing metrics and define composite thresholds. In order to cater to dynamic behavior of the system environment and changes in business and technological aspects, the system and method of the present disclosure self-learns, self-tunes, and adapts itself based on user feedback which helps in capturing tacit knowledge of domain experts. ## Claims ### Claim 1 A processor implemented method, comprising: receiving, via one or more Input/Output (I/O) interfaces, a plurality of data corresponding to one or more entities in a system environment and a plurality of metrics related to the one or more entities; deriving, via the one or more hardware processors, at least one of (i) one or more temporal properties, and (ii) one or more spatio-temporal properties of each of the plurality of metrics; generating, via the one or more hardware processors, at least one of (a) a static threshold, (b) a dynamic threshold, and (c) a composite threshold based on the derived at least one of (i) the one or more temporal properties, and (ii) the one or more spatio-temporal properties of each of the plurality of metrics using one or more models; detecting, via the one or more hardware processors, one or more anomalies in the received plurality of data when a value of the generated at least one of (a) the static threshold, (b) the dynamic threshold, and (c) the composite threshold is exceeded to a predefined value; and adaptively updating, via the one or more hardware processors, the one or more models to the at least one of (i) the one or more temporal properties, and (ii) the one or more spatio-temporal properties of each of the plurality of metrics related to the one or more entities in the system environment based on at least one of (a) a self-learning mechanism, and (b) a self-tuning mechanism. ### Claim 2 (depends on 1) The processor implemented method of claim 1, further comprising: continuously monitoring, a mismatch between the generated at least one of (a) the static threshold, (b) the dynamic threshold, and (c) the composite threshold with a pre-determined threshold; and recommending, a corrected threshold when a mismatch between the generated at least one of (a) the static threshold, (b) the dynamic threshold, and (c) the composite threshold and the pre-determined threshold is detected. ### Claim 3 (depends on 1) The processor implemented method of claim 1, wherein the static threshold is generated based on a mean, a standard variation, and an aggressiveness factor of each of the plurality of metrics related to the one or more entities in the system environment. ### Claim 4 (depends on 1) The processor implemented method of claim 1, wherein step of generating the dynamic threshold comprises: resampling and categorizing the plurality of data into a plurality of buckets for a plurality of dimensions of the one or more temporal properties of each of the plurality of metrics related to the one or more entities in the system environment; computing a representative value for each bucket from the plurality of buckets, wherein the representative value is computed based on a mean, and a standard deviation for each bucket from the plurality of buckets for each dimension from the plurality of dimensions; computing an intra-bucket variation (ITA) for the plurality of data and inter-bucket variation (ITR) for the representative value for each bucket from the plurality of buckets, wherein the intra-bucket variation (ITA) captures average spread of a plurality of data points within each bucket from the plurality of buckets and the inter-bucket variation (ITR) captures variation of the plurality of data points across the plurality of dimensions; generating a score for the one or more temporal properties of each of the plurality of metrics related to the one or more entities in the system environment based on the ITR and ITA; identifying an optimal temporal property from the one or more temporal properties of each of the plurality of metrics related to the one or more entities in the system environment based on the generated score; and generating the dynamic threshold based on the mean, the standard variation and an aggressiveness factor of each of the plurality of metrics related to the one or more entities in the system environment in accordance with the identified temporal property from the one or more temporal properties. ### Claim 5 (depends on 1) The processor implemented method of claim 1, wherein step of generating the composite threshold comprises: receiving, a first set of events corresponding to an entity identified from the one or more entities in the system environment with no metric; mining, using one or more data sources, an influencing relationship between a node of the identified entity and a plurality of influencing metrics corresponding to the node of the identified entity to define a set of spatial dependencies; applying a temporal threshold analysis to each influencing metric from the plurality of influencing metrics to generate at least one of a (i) a respective static threshold, (ii) a respective dynamic threshold, and (iii) a second set of events; correlating the second set of events with the first set of events occurring in the node of the identified entity to access a plurality of temporal correlations; and generating the composite threshold based on the plurality of temporal correlations, wherein the plurality of temporal correlations are indicative of behavior of the plurality of influencing metrics. ### Claim 6 (depends on 1) The processor implemented method of claim 1, wherein the self-learning mechanism comprises: generating, a plurality of clusters of the plurality of metrics related to the one or more entities based on a plurality of metric properties; identifying a set of representative metrics for each cluster from the plurality of clusters of the plurality of metrics based on a similarity in the plurality of metric properties; generating, at least one of (i) a plurality of optimal static thresholds, (ii) a plurality of optimal dynamic thresholds, and (iii) a plurality of optimal composite thresholds across varying degree of aggressiveness for each representative metric from the set of representative metrics for each cluster from the plurality of clusters of the plurality of metrics; selecting, an optimal threshold from the at least one of (i) the plurality of optimal static thresholds, (ii) the plurality of optimal dynamic thresholds, and (iii) the plurality of optimal composite thresholds by applying one or more inputs obtained as feedback from one or more users on each of the set of representative metrics for each cluster from the plurality of clusters of the plurality of metrics; determining, a change in one or more parameters associated with the plurality of metrics related to the one or more entities in the system environment based on the one or more inputs obtained as the feedback from the one or more users on each cluster from the plurality of clusters of the plurality of metrics; and self-learning, the one or more parameters associated with the plurality of metrics in accordance with the one or more inputs obtained as the feedback from the one or more users. ### Claim 7 (depends on 1) The processor implemented method of claim 1, wherein the self-tuning mechanism comprises: obtaining, a plurality of real time delta data corresponding to the one or more entities and a set of metrics related to the one or more entities in the system environment for the plurality of real time delta data; performing temporal analysis on the set of metrics related to the one or more entities in the system environment for the plurality of real-time delta data, wherein steps for temporal analysis comprising: (a) generating, a plurality of clusters of the set of metrics related to the one or more entities in a system environment for the plurality of real time delta data based on the plurality of metric properties; (b) identifying a representative metric for each cluster from the plurality of clusters of the set of metrics based on a similarity in the plurality of metric properties; and (c) generating, at least one of (i) a plurality of optimal static thresholds, (ii) a plurality of optimal dynamic thresholds, and (iii) a plurality of optimal composite thresholds across varying degree of aggressiveness for the representative metric for each cluster from the plurality of clusters of the set of metrics; determining, a change in the one or more parameters associated with the set of metrics related to the one or more entities in the system environment for the plurality of real time delta data; and self-tuning, by auto-optimizing the one or more parameters associated with the set of metrics based on (a) the self-learning of the one or more parameters associated with the plurality of metrics and (b) the temporal analysis performed on the set of metrics related to the one or more entities in the system environment for the plurality of real-time delta data. ### Claim 8 A system comprising: a memory storing instructions; one or more Input/Output (I/O) interfaces; and one or more hardware processors coupled to the memory via the one or more I/O interfaces, wherein the one or more hardware processors are configured by the instructions to: receive a plurality of data corresponding to one or more entities in a system environment and a plurality of metrics related to the one or more entities; derive at least one of (i) one or more temporal properties, and (ii) one or more spatio-temporal properties of each of the plurality of metrics; generate at least one of (a) a static threshold, (b) a dynamic threshold, and (c) a composite threshold based on the derived at least one of (i) the one or more temporal properties, and (ii) the one or more spatio-temporal properties of each of the plurality of metrics using one or more models; detect one or more anomalies in the received plurality of data when a value of the generated at least one of (a) the static threshold, (b) the dynamic threshold, and (c) the composite threshold is exceeded to a predefined value; and adaptively update the one or more models to the at least one of (i) the one or more temporal properties, and (ii) the one or more spatio-temporal properties of each of the plurality of metrics related to the one or more entities in the system environment based on at least one of (a) a self-learning mechanism, and (b) a self-tuning mechanism. ### Claim 9 (depends on 8) The system of claim 8, further comprising: continuously monitoring, a mismatch between the generated at least one of (a) the static threshold, (b) the dynamic threshold, and (c) the composite threshold with a pre-determined threshold; and recommending, a corrected threshold when a mismatch between the generated at least one of (a) the static threshold, (b) the dynamic threshold, and (c) the composite threshold and the pre-determined threshold is detected. ### Claim 10 (depends on 8) The system of claim 8, wherein the static threshold is generated based on a mean, a standard variation, and an aggressiveness factor of each of the plurality of metrics related to the one or more entities in the system environment. ### Claim 11 (depends on 8) The system of claim 8, wherein step of generating the dynamic threshold comprises: resampling and categorizing the plurality of data into a plurality of buckets for a plurality of dimensions of the one or more temporal properties of each of the plurality of metrics related to the one or more entities in the system environment; computing a representative value for each bucket from the plurality of buckets, wherein the representative value is computed based on a mean, and a standard deviation for each bucket from the plurality of buckets for each dimension from the plurality of dimensions; computing an intra-bucket variation (ITA) for the plurality of data and inter-bucket variation (ITR) for the representative value for each bucket from the plurality of buckets, wherein the intra-bucket variation (ITA) captures average spread of a plurality of data points within each bucket from the plurality of buckets and the inter-bucket variation (ITR) captures variation of the plurality of data points across the plurality of dimensions; generating a score for the one or more temporal properties of each of the plurality of metrics related to the one or more entities in the system environment based on the ITR and ITA; identifying an optimal temporal property from the one or more temporal properties of each of the plurality of metrics related to the one or more entities in the system environment based on the generated score; and generating the dynamic threshold based on the mean, the standard variation and an aggressiveness factor of each of the plurality of metrics related to the one or more entities in the system environment in accordance with the identified temporal property from the one or more temporal properties. ### Claim 12 (depends on 8) The system of claim 8, wherein step of generating the composite threshold comprises: receiving, a first set of events corresponding to an entity identified from the one or more entities in the system environment with no metric; mining, using one or more data sources, an influencing relationship between a node of the identified entity and a plurality of influencing metrics corresponding to the node of the identified entity to define a set of spatial dependencies; applying a temporal threshold analysis to each influencing metric from the plurality of influencing metrics to generate at least one of a (i) a respective static threshold, (ii) a respective dynamic threshold, and (iii) a second set of events; correlating the second set of events with the first set of events occurring in the node of the identified entity to access a plurality of temporal correlations; and generating the composite threshold based on the plurality of temporal correlations, wherein the plurality of temporal correlations are indicative of behavior of the plurality of influencing metrics. ### Claim 13 (depends on 8) The system of claim 8, wherein the self-learning mechanism comprises: generating, a plurality of clusters of the plurality of metrics related to the one or more entities based on a plurality of metric properties; identifying a set of representative metrics for each cluster from the plurality of clusters of the plurality of metrics based on a similarity in the plurality of metric properties; generating, at least one of (i) a plurality of optimal static thresholds, (ii) a plurality of optimal dynamic thresholds, and (iii) a plurality of optimal composite thresholds across varying degree of aggressiveness for each representative metric from the set of representative metrics for each cluster from the plurality of clusters of the plurality of metrics; selecting, an optimal threshold from the at least one of (i) the plurality of optimal static thresholds, (ii) the plurality of optimal dynamic thresholds, and (iii) the plurality of optimal composite thresholds by applying one or more inputs obtained as feedback from one or more users on each of the set of representative metrics for each cluster from the plurality of clusters of the plurality of metrics; determining, a change in one or more parameters associated with the plurality of metrics related to the one or more entities in the system environment based on the one or more inputs obtained as the feedback from the one or more users on each cluster from the plurality of clusters of the plurality of metrics; and self-learning, the one or more parameters associated with the plurality of metrics in accordance with the one or more inputs obtained as the feedback from the one or more users. ### Claim 14 (depends on 8) The system of claim 8, wherein the self-tuning mechanism comprises: obtaining, a plurality of real time delta data corresponding to the one or more entities and a set of metrics related to the one or more entities in the system environment for the plurality of real time delta data; performing temporal analysis on the set of metrics related to the one or more entities in the system environment for the plurality of real-time delta data, wherein steps for temporal analysis comprising: (a) generating, a plurality of clusters of the set of metrics related to the one or more entities in a system environment for the plurality of real time delta data based on the plurality of metric properties; (b) identifying a representative metric for each cluster from the plurality of clusters of the set of metrics based on a similarity in the plurality of metric properties; and (c) generating, at least one of (i) a plurality of optimal static thresholds, (ii) a plurality of optimal dynamic thresholds, and (iii) a plurality of optimal composite thresholds across varying degree of aggressiveness for the representative metric for each cluster from the plurality of clusters of the set of metrics; determining, a change in the one or more parameters associated with the set of metrics related to the one or more entities in the system environment for the plurality of real time delta data; and self-tuning, by auto-optimizing the one or more parameters associated with the set of metrics based on (a) the self-learning of the one or more parameters associated with the plurality of metrics and (b) the temporal analysis performed on the set of metrics related to the one or more entities in the system environment for the plurality of real-time delta data. ### Claim 15 One or more non-transitory computer readable mediums comprising one or more instructions which when executed by one or more hardware processors cause: receiving, a plurality of data corresponding to one or more entities in a system environment and a plurality of metrics related to the one or more entities; deriving, at least one of (i) one or more temporal properties, and (ii) one or more spatio-temporal properties of each of the plurality of metrics; generating, at least one of (a) a static threshold, (b) a dynamic threshold, and (c) a composite threshold based on the derived at least one of (i) the one or more temporal properties, and (ii) the one or more spatio-temporal properties of each of the plurality of metrics using one or more models; detecting, one or more anomalies in the received plurality of data when a value of the generated at least one of (a) the static threshold, (b) the dynamic threshold, and (c) the composite threshold is exceeded to a predefined value; and adaptively updating, the one or more models to the at least one of (i) the one or more temporal properties, and (ii) the one or more spatio-temporal properties of each of the plurality of metrics related to the one or more entities in the system environment based on at least one of (a) a self-learning mechanism, and (b) a self-tuning mechanism.