US 12,032,543 B2
Framework for the automated determination of classes and anomaly detection methods for time series
Ian Roy Beaver, Spokane Valley, WA (US); Cynthia Freeman, Spokane Valley, WA (US); and Jonathan Merriman, Spokane Valley, WA (US)
Assigned to Verint Americas Inc., Alpharetta, GA (US)
Filed by Verint Americas Inc., Alpharetta, GA (US)
Filed on Jan. 30, 2023, as Appl. No. 18/103,023.
Application 18/103,023 is a continuation of application No. 16/569,984, filed on Sep. 13, 2019, granted, now 11,567,914.
Claims priority of provisional application 62/731,258, filed on Sep. 14, 2018.
Prior Publication US 2023/0177030 A1, Jun. 8, 2023
Int. Cl. G06F 16/215 (2019.01); G06F 16/2458 (2019.01)
CPC G06F 16/215 (2019.01) [G06F 16/2474 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A method, for automatically determining an anomaly detection method for use on a class of time series, comprising:
receiving, by a processor, a plurality of datasets for a given time series, wherein each of the plurality of datasets is associated with a different one of a plurality of predefined time series characteristics, wherein each of the plurality of datasets has been classified into one of a plurality of known classes based on expected properties of the dataset before receipt by the processor;
identifying, by the processor, a subset of anomaly detection methods for evaluating the plurality of datasets based on the known class associated with each of the plurality of datasets, wherein the subset of anomaly detection methods is filtered from a larger set of anomaly detection methods;
calculating, by the processor, an anomaly detection score for each of the subset of anomaly detection methods, the anomaly detection score based on false positives and false negatives detected by applying a sliding window across all datasets of the plurality of datasets;
calculating, by the processor, an anomaly score threshold value based on a minimum number of the false positives and false negatives in the sliding window across all datasets and a probationary period for each of the plurality of datasets;
identifying, by the processor, one of the subset of anomaly detection methods as a recommended anomaly detection method for use on time series data of a same class as the known class of the given time series, wherein the recommended anomaly detection method is identified by comparing the anomaly detection scores for each of the subset of anomaly detection methods to the anomaly score threshold value; and
applying, by the processor, the recommended anomaly detection method to identify anomalies for additional time series of the same class.