Method and system for modifying state of device using detected anomalous behavior

A system for modifying a state of a network device, implemented in a networked environment, using detected anomalous behaviour in a self-exciting point process, the system comprising a processor and a memory comprising computer program code, configured to:

• receive time series data, associated with the network device, for a time period comprising point values for respective time instants of the time period for the self-exciting point process, wherein the time series data is a series of the point values with respect to time, wherein the point values are data points in the time series data, and wherein the self-exciting point process is obtained as the series of the point values that indicates one or more anomalous events where the point values of the time series data fall outside a baseline range;
• select a first portion, corresponding to a first time period, from the received time-series data, characterizing a normal behaviour for at least the first time period of the self-exciting point process;
• define a baseline range for the self-exciting point process based, at least in part, on bounds of first point values in the selected first portion;
• process a second portion, corresponding to a second time period, from the received time-series data, based on the defined baseline range to detect one or more second point values in the second portion exceeding the defined baseline range, with the detected one or more second point values in the second portion exceeding the defined baseline range being characterized as the one or more anomalous events for at least the second time period of the self-exciting point process;
• characterized in that:
• determine an intensity of a given anomalous event of the one or more anomalous events based on at least one of a number and a proximity in time of preceding anomalous events of the one or more anomalous events to the given anomalous event;
• determine, for the second time period, presence of at least one anomalous event of the one or more anomalous events with the corresponding determined intensity exceeding a predefined intensity threshold;
• determine, for a third time period, presence of at least one anomalous event with a corresponding determined intensity exceeding the predefined intensity threshold, with the third time period succeeding the second time period;
• confirm the anomalous behaviour for the self-exciting point process based on the determined presence of at least one anomalous event with the corresponding determined intensity exceeding the predefined intensity threshold for each of the second time period and the third time period;
• and
• modify the state of the network device based on the confirmation of the anomalous behaviour, wherein the modified state is at least one of an active state or an inactive state.