Anomaly detection model selection and validity for time series data

Abstract

Deploying a model for anomaly detection in time series data. A period of data is received. A model of the period of data is received. It is determined that the model fits a part of the period of data and that the fitted part of the period of data includes the most recent data. A reduced model for the part of the period of data that fit the received model is built. The reduced model is deployed.

What is claimed is: 
     
         1 . A method comprising:
 determining, by a computer, that a received model of a period of data fits a most recent part of a received period of data; and   deploying, by the computer, a reduced model built for the part of the period of data that fit the received model.   
     
     
         2 . A method according to  claim 1 , wherein the model is deployed if the fitted part is not less than a threshold ratio of all of the period. 
     
     
         3 . A method according to  claim 2 , wherein the threshold ratio of the determined part to whole period is 50%. 
     
     
         4 . A method according to  claim 1 , further comprising deploying, by the computer, the received model if the received model fits all of the period of data. 
     
     
         5 . A method according to  claim 1 , further comprising notifying, by the computer, a configuration shift if it is determined that the received model fits a portion of an oldest part of the period of data. 
     
     
         6 . A method according to  claim 1 , further comprising:
 determining, by the computer, that the model fits only a newest part of the period of data, wherein the determining comprises attempting to fit increasingly smaller newer portions of the data to the received model until a correct fit is found.   
     
     
         7 . A method according to  claim 1 , wherein deploying the model is based on determining that the received model fits either an oldest or a newest part of the period of data. 
     
     
         8 . A computer system for deploying an anomaly detection model for time series data, the computer system comprising:
 one or more computer processors, one or more computer-readable storage media, and program instructions stored on one or more of the computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising instructions to:
 determine that a received model of a period of data fits a most recent part of a received period of data; and 
 deploy a reduced model built for the part of the period of data that fit the received model. 
   
     
     
         9 . A system according to  claim 8 , wherein the reduced model is deployed if the fitted part is not less than a threshold ratio of all of the period. 
     
     
         10 . A system according to  claim 9 , wherein the threshold ratio of the determined part to the whole period is 50%. 
     
     
         11 . A system according to  claim 8 , further comprising program instructions to deploy the received model if the received model fits all of the period of data. 
     
     
         12 . A system according to  claim 8 , further comprising program instructions to notify a configuration shift if it is determined that the received model fits a portion of an oldest part of the period of data. 
     
     
         13 . A system according to  claim 8 , further comprising program instructions to determine that the model fits a newest part of the period of data, the program instructions further comprising instructions to attempt to fit increasingly smaller newer portions of the data to the received model until a correct fit is found. 
     
     
         14 . A system according to  claim 8  wherein deploying the model is based on determining that the received model fits neither an oldest or a newest part of the period of data. 
     
     
         15 . A computer program product for deploying a model for anomaly detection in time series data, the computer program product comprising:
 one or more computer-readable storage media and program instructions stored on the one or more computer-readable storage media, the program instructions comprising instructions to:   determining, by a computer, that a received model of a period of data fits a most recent part of a received period of data; and   deploying, by the computer, a reduced model built for the part of the period of data that fit the received model.   
     
     
         16 . A computer program product according to  claim 15 , wherein the reduced model is deployed if the fitted part is not less than a threshold ratio of all of the period. 
     
     
         17 . A computer program product according to  claim 16 , wherein the threshold ratio of the determined part to whole period is 50%. 
     
     
         18 . A computer program product according to  claim 15 , further comprising program instructions to deploy the received model if the received model fits all of the period of data. 
     
     
         19 . A computer program product according to  claim 15 , further comprising program instructions to notify a configuration shift if it is determined that the received model fits a portion of an oldest part of the period of data. 
     
     
         20 . A computer program product according to  claim 15 , wherein the program instructions further comprise instructions to determine that the model fits a newest part of the period of data comprise program instructions to attempt to fit increasingly smaller newer portions of the data to the received model until a correct fit is found.