| CPC G06F 11/3447 (2013.01) | 14 Claims |

|
1. A method performed by a computing system for detecting an anomaly comprising:
obtaining a plurality of models trained to detect an anomaly for different monitoring items, wherein input data of the plurality of models include at least one identification field for identifying an anomaly detection target;
forming at least one model group by grouping models having a common identification field in the input data among the plurality of models; and
detecting an anomaly of a detection target identified by a common identification field of a model group based on a combination of detection results of the model group, in which in which a detection result of each model of the model group is multiplied by a corresponding weight,
wherein the detection target is associated with a target system that provides a plurality of services to a user, and
wherein a weight of each model is determined in a manner such that a greater value is determined, as the weight, based on an anomaly detection time falling within a main usage time interval, which is determined in advance as having a higher usage rate for a service associated with a corresponding model, and a lower value is determined, as the weight, based on the anomaly detection time falling outside the main usage time interval of the corresponding model.
|