Anomaly Detection System and Method for Implementing a Data Regularity Check and Adaptive Thresholding

A computing device, comprising:

• a processor;
• and
• a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
• generating a graphical user interface (GUI) configured to receive a search query that includes (i) a search or query command, and (ii) a data source from which to retrieve the time-series data set;
• obtaining the time-series data set as a result of execution of the search query;
• selecting a seasonality pattern that corresponds to the time-series data set, wherein the selected seasonality pattern corresponds to a date-time pattern for partitioning the time-series data set into subsequences;
• determining a silhouette score for the selected seasonality pattern, wherein determining the silhouette score for the selected seasonality pattern includes (i) partitioning the time-series data set into the subsequences, (ii) clustering data points of each of the subsequences into two or more clusters, (iii) determining a silhouette score of each of the subsequences being a mean of silhouette scores of clusters of each of the subsequences, wherein the silhouette scores of the clusters are determined by a mean of silhouette scores of data points comprising each cluster, and (iv) the silhouette score for the selected seasonality pattern is represented by a mean of the silhouette scores of the subsequences forming the seasonality pattern;
• determining whether the silhouette score for the selected seasonality pattern satisfies a threshold comparison;
• when the silhouette scores for the selected seasonality pattern satisfies the threshold comparison, performing a first set of anomaly detection operations on the time-series data set including generating an anomaly band based on the selected seasonality pattern and detecting data points outside of the anomaly band;
• and
• when the silhouette score for the selected seasonality pattern does not satisfy the threshold comparison, performing a second set of anomaly detection operations on the time-series data set including applying a set of heuristics to the time-series data set.

A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations including:

• generating a graphical user interface (GUI) configured to receive a search query that includes (i) a search or query command, and (ii) a data source from which to retrieve the time-series data set;
• obtaining the time-series data set as a result of execution of the search query;
• selecting a seasonality pattern that corresponds to the time-series data set, wherein the selected seasonality pattern corresponds to a date-time pattern for partitioning the time-series data set into subsequences;
• determining a silhouette score for the selected seasonality pattern, wherein determining the silhouette score for the selected seasonality pattern includes (i) partitioning the time-series data set into the subsequences, (ii) clustering data points of each of the subsequences into two or more clusters, (iii) determining a silhouette score of each of the subsequences being a mean of silhouette scores of clusters of each of the subsequences, wherein the silhouette scores of the clusters are determined by a mean of silhouette scores of data points comprising each cluster, and (iv) the silhouette score for the selected seasonality pattern is represented by a mean of the silhouette scores of the subsequences forming the seasonality pattern;
• determining whether the silhouette score for the selected seasonality pattern satisfies a threshold comparison;
• when the silhouette scores for the selected seasonality pattern satisfies the threshold comparison, performing a first set of anomaly detection operations on the time-series data set including generating an anomaly band based on the selected seasonality pattern and detecting data points outside of the anomaly band;
• and
• when the silhouette score for the selected seasonality pattern does not satisfy the threshold comparison, performing a second set of anomaly detection operations on the time-series data set including applying a set of heuristics to the time-series data set.