Amplitude-based anomaly detection

摘要

Systems and methods are disclosed herein for identifying an anomaly in a signal, where samples in the signal correspond to an amount of data flow in a network within a time interval, and an anomaly corresponds to at least one sample in the discrete signal having a likelihood value below a likelihood threshold. A historical probability distribution of the discrete signal is generated based on previously received samples. For each sample in a plurality of samples in the discrete signal, a likelihood is computed based at least in part on the historical probability distribution. A likelihood threshold is selected, and a set of consecutive samples is identified as an anomaly when each sample in the set has a computed likelihood below the likelihood threshold.

主权项

1. A method for identifying an anomaly in a discrete signal, wherein an anomaly corresponds to at least one sample in the discrete signal having a likelihood value below a likelihood threshold, comprising:
generating, by a processor, a historical probability distribution of the discrete signal based on previously received samples, wherein samples in the discrete signal correspond to amounts of data flow in a network within a time interval; computing, by the processor, a likelihood for each sample in a plurality of samples in the discrete signal based at least in part on the historical probability distribution; selecting, by the processor, a likelihood threshold; and identifying, by the processor, a set of consecutive samples as an anomaly, wherein each sample in the set has a computed likelihood below the likelihood threshold.