US 7,277,843 B1Granted

Method for real-time auto-detection of outliers

AssigneeNetwork Physics, Inc.

InventorsHan C. Wen, Tomas J. Pavel

Life of this patent

Estimating the term…

Loading patent…

Abstract

A moving window of data is used to determine a local baseline as a moving average of the data weighted by the number of measurements in each time interval. A next measurement associated with a next time interval is compared to a value associated with the baseline to determine an outlier. In some cases, for example where the time series of the data shows small variability around a local mean, the next measurement is compared to a multiple of the weighted moving average to determine an outlier. In other cases, for example where the time series of the data shows significant variability around the local mean, the next measurement is compared to the sum of the weighted moving average and a multiple of a moving root mean square deviation value weighted by the number of measurements in each time interval and in some cases, a damping factor.

Claims32

Dependent claims

A machine implemented method for assessing performance of a network, comprising:

collecting data through the network, wherein the data include measurements of a metric to assess the performance of the network;
determining, for a number of the measurements of the metric within a plurality of time intervals, a baseline that includes computing a moving average of the measurements of the metric weighted by the number of measurements in each time interval, wherein the moving average comprises a result of dividing a first sum, over all time intervals, of a first product of the number of measurements for each time interval multiplied by values of the measurements within each time interval multiplied by a damping factor, by a second sum, over all time intervals, of a second product of the number of measurements for each time interval multiplied by the damping factor;
comparing a next metric measurement associated with a next time interval to the baseline that includes the moving average, to determine whether or not the next metric measurement should be classified as an outlier with respect to the baseline;
after determining whether or not the next metric measurement should be classified as the outlier with respect to the baseline, moving to a next data point of the measurements of the metrics;
and
repeating the determining and the comparing for the next data point to automatically detect outliers in real time as the data is collected.

3 more elements

A machine readable medium containing executable instructions which when executed by a computer cause the computer to automatically in real time assess a performance of a network by performing operations comprising:

collecting data through a network, wherein the data include measurements of a metric;
determining, for a number of the measurements of the metric within a plurality of time intervals, a baseline that includes computing a moving average of the measurements of the metric weighted by the number of measurements in each time interval, wherein the moving average comprises a result of dividing a first sum, over all time intervals, of a first product of the number of measurements for each time interval multiplied by values of the measurements within each time interval multiplied by a damping factor, by a second sum, over all time intervals, of a second product of the number of measurements for each time interval multiplied by the damning factor;
comparing a next metric measurement associated with a next time interval to the baseline that includes the moving average, to determine whether or not the next metric measurement should be classified as an outlier with respect to the baseline;
after determining whether or not the next metric measurement should be classified as the outlier with respect to the baseline, moving to a next data point of the measurements of the metrics;
and
repeating the determining and the comparing for the next data point to automatically detect outliers in real time as the data is collected.

3 more elements

Dependencies are inferred from the claim text.