US 12,332,764 B2
Anomaly detection for time series data
Si Er Han, Xi'an (CN); Jing Xu, Xi'an (CN); Xue Ying Zhang, Xi'an (CN); Xiao Ming Ma, Xi'an (CN); Jun Wang, Xi'an (CN); and Ji Hui Yang, Beijing (CN)
Assigned to International Business Machines Corporation, Armonk, NY (US)
Filed by International Business Machines Corporation, Armonk, NY (US)
Filed on Oct. 19, 2023, as Appl. No. 18/489,894.
Prior Publication US 2025/0130919 A1, Apr. 24, 2025
Int. Cl. G06F 11/34 (2006.01)
CPC G06F 11/3495 (2013.01) 13 Claims
OG exemplary drawing
 
1. A computer-implemented method for anomaly detection for a time series data, the computer-implemented method comprising:
receiving the time series data including a plurality of sequential data points;
calculating an expected next value for the time series data based on the plurality of sequential data points;
receiving an actual next value corresponding to the time series data;
calculating an anomaly strength estimate based on the expected next value and the actual next value;
identifying one of a plurality of anomaly detection pipelines based on the anomaly strength estimate and a portrait associated with each of the plurality of anomaly detection pipelines, wherein each of the plurality of anomaly detection pipelines includes an anomaly detection model and wherein the portrait associated with each anomaly detection pipeline is a function that correlates a performance of the anomaly detection model with an anomaly strength,
wherein the one of a plurality of anomaly detection pipelines is identified by:
calculating a performance of the anomaly detection model associated with each of the plurality of anomaly detection pipelines for the anomaly strength estimate based on the portrait associated with each anomaly detection pipeline; and
identifying the one of the plurality of anomaly detection pipelines having the highest performance; and
obtaining an anomaly prediction by inputting the time series data and the actual next value into the one of the plurality of anomaly detection pipelines,
wherein the portrait associated with each anomaly detection pipeline is created by evaluating the performance of the anomaly detection model with a plurality of synthetic anomalies having a range of anomaly strengths and different anomaly types.