US 12,008,046 B1
System and method for automated determination of search query parameters for anomaly detection
Kristal Curtis, San Francisco, CA (US); William Deaderick, Austin, TX (US); and Abraham Starosta, Boston, MA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by Splunk, Inc., San Francisco, CA (US)
Filed on Jun. 10, 2022, as Appl. No. 17/837,931.
Int. Cl. G06F 16/903 (2019.01); H04L 41/069 (2022.01)
CPC G06F 16/90335 (2019.01) [H04L 41/069 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computerized method comprising:
obtaining a data set representing a plurality of values of a variable;
selecting candidate parameter pairs to be analyzed, wherein the candidate parameter pairs include a window length and a sensitivity multiplier, and wherein the window length is a number of data points;
performing an anomaly detection process for each candidate parameter pair including:
importing each candidate parameter pair into a predetermined search query thereby generating a set of populated predetermined search queries, wherein the predetermined search query is configured to perform the anomaly detection process,
executing each search query of the set of populated predetermined search queries on the data set to obtain a set of anomaly detection results, and
scoring each anomaly detection result by applying a set of heuristics to the set of the anomaly detection results; and
generating an auto-tuned search query by selecting a first candidate parameter pair based on a score of each of the set of anomaly detection results and importing the first candidate parameter pair into the predetermined search query,
wherein the applying of the set of heuristics for each anomaly detection result of the set of anomaly detection results includes at least (i) adjusting the score by a first value for anomalies detected as represented by the anomaly detection result when the data set experiences a sudden rise or fall in value or (ii) adjusting the score by a second value for anomalies detected as represented by the anomaly detection result when the data set approaches or exceeds a historical maximum or a historical minimum.