US 11,695,643 B1
Statistical control rules for detecting anomalies in time series data
Seamus Cawley, Dublin (IE); and David Tracey, Monasterboice (IE)
Assigned to Rapid7, Inc., Boston, MA (US)
Filed by Rapid7, Inc., Boston, MA (US)
Filed on Oct. 28, 2021, as Appl. No. 17/513,620.
Int. Cl. G06F 15/173 (2006.01); H04L 41/147 (2022.01); H04L 43/067 (2022.01); H04L 43/16 (2022.01); H04L 43/045 (2022.01)
CPC H04L 41/147 (2013.01) [H04L 43/045 (2013.01); H04L 43/067 (2013.01); H04L 43/16 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
performing, by one or more computing systems that implements a network anomaly detection system:
collecting activity data about a computer network over time;
extracting, from the activity data, time series data of an activity metric;
generating forecast data for the time series data based on one or more seasonal characteristics of the time series data, the forecast data including (a) predicted values for the time series data and (b) confidence intervals of the predicted values;
storing a plurality of statistical control rules (SCRs), wherein the SCRs are defined via a graphical user interface (GUI) of the network anomaly detection system configured to edit the SCRs and display a performance score of the SCRs for detecting anomalies over a selected time range;
evaluating observed values of the time series data with respect to the forecast data according to SCRs,
wherein the evaluation comprises, in successive time periods:
applying the SCRs to a current value of the activity metric observed in a current time period, and
generating a next value of the activity metric for a next time period and the next confidence interval for the next value, and
wherein the SCRs comprise at least (a) a first rule that checks whether a distance metric between the current value of the activity metric and a corresponding predicted value exceeds a first specified threshold, the distance metric calculated based on the confidence interval of the predicted value, and (b) a second rule that checks whether the distance metric for a last number or specified proportion of observed values of the activity metric exceeded a second specified threshold;
detecting an anomaly in the time series data based on the evaluation;
generating, via the GUI, an alert indicating the anomaly and network activities in the computer network associated with the alert; and
responsive to user input received via the GUI, initiating one or more remediations on the computer network.