Amplitude-based anomaly detection
AssigneeGoogle Inc.
InventorsKevin Yu, Yu Xie, Xinyi Zhang
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed herein for identifying an anomaly in a signal, where samples in the signal correspond to an amount of data flow in a network within a time interval, and an anomaly corresponds to at least one sample in the discrete signal having a likelihood value below a likelihood threshold. A historical probability distribution of the discrete signal is generated based on previously received samples. For each sample in a plurality of samples in the discrete signal, a likelihood is computed based at least in part on the historical probability distribution. A likelihood threshold is selected, and a set of consecutive samples is identified as an anomaly when each sample in the set has a computed likelihood below the likelihood threshold.
Claims18
A method for identifying an anomaly in a discrete signal, wherein an anomaly corresponds to at least one sample in the discrete signal having a likelihood value below a likelihood threshold, comprising:
- generating, by a processor, a historical probability distribution of the discrete signal based on previously received samples, wherein samples in the discrete signal correspond to amounts of data flow in a network within a time interval;
- computing, by the processor, a likelihood for each sample in a plurality of samples in the discrete signal based at least in part on the historical probability distribution;
- selecting, by the processor, a likelihood threshold;
- and
- identifying, by the processor, a set of consecutive samples as an anomaly, wherein each sample in the set has a computed likelihood below the likelihood threshold.
An apparatus for identifying an anomaly in a discrete signal, wherein an anomaly corresponds to at least one sample in the discrete signal having a likelihood value below a likelihood threshold, comprising:
- a non-transitory memory;
- a generation processor for generating a historical probability distribution of the discrete signal based on previously received samples, wherein samples in the discrete signal correspond to amounts of data flow in a network within a time interval;
- a computation processor for computing a likelihood for each sample in a plurality of samples in the discrete signal based at least in part on the historical probability distribution;
- an anomaly detection processor for:
- selecting a likelihood threshold;
- and
- identifying a set of consecutive samples as an anomaly, wherein each sample in the set has a computed likelihood below the likelihood threshold.
Dependencies are inferred from the claim text.