US 12,001,546 B2
Systems and methods for causality-based multivariate time series anomaly detection
Wenzhuo Yang, Singapore (SG); Chu Hong Hoi, Singapore (SG); and Kun Zhang, Singapore (SG)
Assigned to Salesforce, Inc., San Francisco, CA (US)
Filed by Salesforce, Inc., San Francisco, CA (US)
Filed on Oct. 29, 2021, as Appl. No. 17/514,487.
Claims priority of provisional application 63/194,035, filed on May 27, 2021.
Prior Publication US 2022/0382856 A1, Dec. 1, 2022
Int. Cl. G06F 21/55 (2013.01); G06N 20/00 (2019.01)
CPC G06F 21/55 (2013.01) [G06N 20/00 (2019.01); G06F 2221/032 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for detecting anomalies in a computer system, the method comprising:
receiving, via a communication interface, training data including multivariate time series variables indicating system anomalies that occurred in the computer system over a period of time;
transforming the multivariate time series variables into a causal graph comprising a plurality of causal variables having a causal relationship;
deriving a subset of causal variables having no causal parents in the causal graph from the plurality of causal variables;
training, for each causal variable outside the derived subset, a respective local estimation neural network model implemented on one or more hardware processors, using the transformed causal graph, wherein the training comprises predicting a first conditional distribution of the respective causal variable conditioned on causal parents of the respective causal variable;
training, for causal variables that belong to the derived subset, a joint estimation neural network model implemented on the one or more hardware processors, using the transformed causal graph, wherein the training comprises predicting a joint distribution of the causal variables that belong to the derived subset; and
storing, at a memory, updated parameters of the trained local estimation neural network models and the trained joint estimation neural network model for multivariate time series anomaly detection; and
generating, using the trained local estimation neural network models and the trained joint estimation neural network model, a predicted system anomaly in response to a multivariate input depicting operation characteristics of the computer system.