US 11,841,786 B2
Predictive anomaly detection framework
Raghuveer Chanda, Bengaluru (IN); Himanshu Ojha, Lucknow (IN); Abdul Hadi Shakir, Bangalore (IN); Subash Prabanantham, Bengaluru (IN); and Vipul Valamjee, Bengaluru (IN)
Assigned to Visa International Service Association, San Francisco, CA (US)
Filed by Visa International Service Association, San Francisco, CA (US)
Filed on Dec. 20, 2021, as Appl. No. 17/556,792.
Application 17/556,792 is a continuation of application No. 16/489,300, granted, now 11,237,939, previously published as PCT/US2017/020246, filed on Mar. 1, 2017.
Prior Publication US 2022/0114074 A1, Apr. 14, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 11/00 (2006.01); G06F 11/34 (2006.01); G06F 11/07 (2006.01); G06F 11/30 (2006.01)
CPC G06F 11/3447 (2013.01) [G06F 11/0751 (2013.01); G06F 11/3075 (2013.01); G06F 11/3452 (2013.01)] 16 Claims
OG exemplary drawing
 
1. A method comprising:
receiving, by a server computer, a data value of a data stream that is associated with one or more client computers, the data stream providing a series of data values over time, the series of data values comprising the data value and one or more historical data values that were received in the data stream prior to the data value, wherein the data value corresponds to a time interval and each of the one or more historical data values corresponds to a historical time interval;
selecting, by the server computer, a plurality of models based on the time interval associated with the data value, wherein each of the plurality of models has a different periodicity;
predicting, by the server computer, a plurality of prediction values for the plurality of models;
generating, by the server computer, a final score based on the plurality of prediction values;
generating, by the server computer, a score threshold based on the one or more historical data values, wherein generating the score threshold comprises:
calculating the score threshold based on a variance of at least a subset of the one or more historical data values;
detecting, by the server computer, one or more internal events; and
adjusting the score threshold based on the one or more internal events; and
responsive to determining that the final score exceeds the score threshold, transmitting, by the server computer, a notification that indicates that the data value is an anomaly to a computing device;
wherein the notification comprises a command that causes the computing device to perform one or more actions based on the anomaly;
wherein the one or more actions comprises: halting or starting one or more software processes; or halting or starting the computing device.