CPC G06F 11/079 (2013.01) [G06F 11/0793 (2013.01); G06F 11/2263 (2013.01); G06F 16/2379 (2019.01); G06F 40/20 (2020.01)] | 20 Claims |
1. A computer-implemented method comprising:
receiving, at an anomaly detection service in a multi-tenant provider network, a request to monitor for anomalies from one or more data sources;
analyzing, by an anomaly detection component of the anomaly detection service, time-series data from the one or more data sources by:
ingesting the time-series data from the one or more data sources, wherein the time-series data is time-stamped and has at least one value, and
determining there is an anomaly in the time-series data using at least one distributional time series model by:
dividing a domain space into a plurality of bins using an approximation,
predicting a probability of a value being in one of the plurality of bins using a recurrent neural network, and
performing anomaly detection using the probability and the bins;
generating, by a findings detection service of the anomaly detection service, a recommendation for handling the anomaly, the recommendation generated by performing one or more of a root cause analysis, a heuristic analysis, and an incident similarity analysis; and
reporting, by a findings service in the multi-tenant provider network, the anomaly and the recommendation to a user.
|