Unsupervised method for baselining and anomaly detection in time-series data for enterprise systems

Abstract

Systems and methods for performing unsupervised baselining and anomaly detection using time-series data are described. In one or more embodiments, a baselining and anomaly detection system receives a set of time-series data. Based on the set of time-series, the system generates a first interval that represents a first distribution of sample values associated with the first seasonal pattern and a second interval that represents a second distribution of sample values associated with the second seasonal pattern. The system then monitors a time-series signals using the first interval during a first time period and the second interval during a second time period. In response to detecting an anomaly in the first seasonal pattern or the second seasonal pattern, the system performs a responsive action, such as generating an alert.

What is claimed is: 
     
         1 . A method comprising:
 performing, by at least one machine learning process, unsupervised training of a first model based on a first set of training data that spans a first window of time;   detecting a transition point in additional training data received by the at least one machine learning process; and   after detecting the transition point, performing, by the at least one machine learning process, unsupervised training of a second model based on the first set of training data and the additional training data.   
     
     
         2 . The method of  claim 1 , wherein the first model is a non-seasonal model and the second model is a seasonal model. 
     
     
         3 . The method of  claim 1 , wherein the first model is for a first season having a first seasonal period, wherein the second model is for a second season having a second seasonal period that is different than the first seasonal period. 
     
     
         4 . The method of  claim 1 , further comprising: pausing training responsive to detecting the transition point; and resuming training responsive to receiving a second set of additional training data, wherein the second model is trained after resuming training. 
     
     
         5 . The method of  claim 1 , wherein the first model is associated with a first set of one or more intervals for a first set of one or more patterns and the second model is associated with a second set of one or more intervals for a second set of one or more patterns, wherein the first set of one or more intervals are different than the second set of one or more intervals. 
     
     
         6 . The method of  claim 5 , wherein the second set of one or more intervals are uncertainty intervals that indicate a greater or lesser amount of uncertainty than the first set of one or more intervals. 
     
     
         7 . The method of  claim 1 , further comprising: monitoring at least one time-series signal using the second model. 
     
     
         8 . The method of  claim 7 , further comprising: detecting anomalous behavior in the at least one time-series signal based on said monitoring the at least one time-series signal using the second model; and generating an alert responsive to detecting the anomalous behavior in the at least one time-series signal. 
     
     
         9 . The method of  claim 7 , further comprising: monitoring the at least one time-series signal using the first model before detecting the transition point. 
     
     
         10 . One or more non-transitory computer-readable media storing instructions, which, when executed by one or more hardware processors, cause performance of operations comprising:
 performing, by at least one machine learning process, unsupervised training of a first model based on a first set of training data that spans a first window of time;   detecting a transition point in additional training data received by the at least one machine learning process; and   after detecting the transition point, performing, by the at least one machine learning process, unsupervised training of a second model based on the first set of training data and the additional training data.   
     
     
         11 . The one or more non-transitory computer-readable media of  claim 10 , wherein the first model is a non-seasonal model and the second model is a seasonal model. 
     
     
         12 . The one or more non-transitory computer-readable media of  claim 10 , wherein the first model is for a first season having a first seasonal period, wherein the second model is for a second season having a second seasonal period that is different than the first seasonal period. 
     
     
         13 . The one or more non-transitory computer-readable media of  claim 10 , wherein the instructions further cause: pausing training responsive to detecting the transition point; and resuming training responsive to receiving a second set of additional training data, wherein the second model is trained after resuming training. 
     
     
         14 . The one or more non-transitory computer-readable media of  claim 10 , wherein the first model is associated with a first set of one or more intervals for a first set of one or more patterns and the second model is associated with a second set of one or more intervals for a second set of one or more patterns, wherein the first set of one or more intervals are different than the second set of one or more intervals. 
     
     
         15 . The one or more non-transitory computer-readable media of  claim 14 , wherein the second set of one or more intervals are uncertainty intervals that indicate a greater or lesser amount of uncertainty than the first set of one or more intervals. 
     
     
         16 . The one or more non-transitory computer-readable media of  claim 10 , wherein the instructions further cause: monitoring at least one time-series signal using the second model. 
     
     
         17 . The one or more non-transitory computer-readable media of  claim 16 , wherein the instructions further cause: detecting anomalous behavior in the at least one time-series signal based on said monitoring the at least one time-series signal using the second model; and generating an alert responsive to detecting the anomalous behavior in the at least one time-series signal. 
     
     
         18 . The one or more non-transitory computer-readable media of  claim 16 , wherein the instructions further cause: monitoring the at least one time-series signal using the first model before detecting the transition point. 
     
     
         19 . A system comprising:
 one or more hardware processors;   one or more non-transitory computer-readable media storing instructions, which, when executed by the one or more hardware processors, cause performance of operations comprising:
 performing, by at least one machine learning process, unsupervised training of a first model based on a first set of training data that spans a first window of time; 
 detecting a transition point in additional training data received by the at least one machine learning process; and 
 after detecting the transition point, performing, by the at least one machine learning process, unsupervised training of a second model based on the first set of training data and the additional training data. 
   
     
     
         20 . The system of  claim 19 , wherein the first model is a non-seasonal model and the second model is a seasonal model.