Anomaly Detection in Network-Site Metrics Using Predictive Modeling

• US 20140108640A1
• Filed: 10/12/2012
• Published: 04/17/2014
• Est. Priority Date: 10/12/2012
• Status: Active Grant

• Current Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Mathis, Craig M.
• Granted Patent: US 9,197,511 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Methods and apparatus for anomaly detection in network-site metrics using predictive modeling are described. A method comprises obtaining time-series data for a given time range, wherein the time-series data comprises values for a network-site analytics metric for each of a plurality of sequential time steps across the given time range. The method includes generating a predictive model for the network-site analytics metric based on at least a segment of the time-series data. The method includes using the predictive model to predict an expected value range for the network-site analytics metric for a next time step after the segment and, based on the expected value range, determining whether an actual value for the network-site analytics metric for the next time step is an anomalous value.

Claims

1. A method, comprising:

performing, by one or more computing devices;

obtaining time-series data for a given time range, wherein the time-series data comprises values for a network-site analytics metric for each of a plurality of sequential time steps across the given time range;

generating a predictive model for the network-site analytics metric based on at least a segment of the time-series data;

using the predictive model to predict an expected value range for the network-site analytics metric for a next time step after the segment; and

based on the expected value range, determining whether an actual value for the network-site analytics metric for the next time step is an anomalous value.

2. The method of claim 1, further comprising, in response to determining that the actual value for the network-site analytics metric for the next time step is an anomalous value, sending an alert to a user.

3. The method of claim 1, further comprising, in response to determining that the actual value for the network-site analytics metric for the next time step is an anomalous value, indicating the actual value as an anomalous value in a report display for the network-site analytics metric.

4. The method of claim 1, wherein said determining whether the actual value for the network-site analytics metric for the next time step is an anomalous value comprises determining whether the actual value exceeds the expected value range by a threshold amount.

5. The method of claim 1, wherein said determining whether the actual value for the network-site analytics metric for the next time step is an anomalous value comprises determining whether the actual value is one of a plurality of actual values for the network-site analytics metric that exceed respective expected value ranges for consecutive time steps.

6. The method of claim 1, wherein the network-site analytics metric is a metric selected from the group of site visits, page views, revenue, file download views, successful sign in count, returning user count, product registration count, impressions, click throughs, and conversions.

7. The method of claim 1, wherein the expected value range is determined according to a configured confidence level for the predictive model.

8. The method of claim 1, wherein said generating the predictive model comprises:

using the segment of the time-series data as training data to generate a plurality of different predictive models according to a plurality of different time-series forecasting techniques; and

based on a data fitting measure, select one of the different predictive models as said predictive model.

9. The method of claim 1, further comprising updating the predictive model based on the actual value of the network-site analytics metric for the next time step.

10. The method of claim 9, wherein said updating the predictive model comprising using an upper or lower value of the expected value range instead of the actual value to update the predictive model when the actual value exceeds the expected value range.

11. A system, comprising:

at least one processor; and

a memory comprising program instructions that when executed by the at least one processor implement;

obtaining time-series data for a given time range, wherein the time-series data comprises values for a network-site analytics metric for each of a plurality of sequential time steps across the given time range;

generating a predictive model for the network-site analytics metric based on at least a segment of the time-series data;

using the predictive model to predict an expected value range for the network-site analytics metric for a next time step after the segment; and

based on the expected value range, determining whether an actual value for the network-site analytics metric for the next time step is an anomalous value.

12. The system of claim 11, wherein the program instructions when executed by the at least one processor further implement, in response to determining that the actual value for the network-site analytics metric for the next time step is an anomalous value, sending an alert to a user or indicating the actual value as an anomalous value in a report display for the metric.

13. The system of claim 11, wherein said determining whether the actual value for the network-site analytics metric for the next time step is an anomalous value comprises determining whether the actual value exceeds the expected value range by a threshold amount or determining whether the actual value is one of a plurality of actual values for the network-site analytics metric that exceed respective expected value ranges for consecutive time steps.

14. The system of claim 11, wherein the program instructions when executed by the at least one processor further implement said obtaining, said generating, said using, and said determining for a plurality of different network-site analytics metrics having respective values in each of the plurality of sequential time steps across the given time range.

15. The system of claim 11, wherein said generating the predictive model comprises:

using the segment of the time-series data as training data to generate a plurality of different predictive models according to a plurality of different time-series forecasting techniques; and

based on a data fitting measure, select one of the different predictive models as said predictive model.

16. A non-transitory computer-readable storage medium storing program instructions that when executed by a computing device perform:

obtaining time-series data for a given time range, wherein the time-series data comprises values for a network-site analytics metric for each of a plurality of sequential time steps across the given time range;

generating a predictive model for the network-site analytics metric based on at least a segment of the time-series data;

using the predictive model to predict an expected value range for the network-site analytics metric for a next time step after the segment; and

based on the expected value range, determining whether an actual value for the network-site analytics metric for the next time step is an anomalous value.

17. The non-transitory computer-readable storage medium of claim 16, wherein the program instructions when executed by a computing device further perform, in response to determining that the actual value for the network-site analytics metric for the next time step is an anomalous value, sending an alert to a user or indicating the actual value as an anomalous value in a report display for the metric.

18. The non-transitory computer-readable storage medium of claim 16, wherein said determining whether the actual value for the network-site analytics metric for the next time step is an anomalous value comprises determining whether the actual value exceeds the expected value range by a threshold amount or determining whether the actual value is one of a plurality of actual values for the network-site analytics metric that exceed respective expected value ranges for consecutive time steps.

19. The non-transitory computer-readable storage medium of claim 16, wherein said generating the predictive model comprises:

using the segment of the time-series data as training data to generate a plurality of different predictive models according to a plurality of different time-series forecasting techniques; and

based on a data fitting measure, select one of the different predictive models as said predictive model.

20. The non-transitory computer-readable storage medium of claim 16, wherein the program instructions when executed by a computing device further perform updating the predictive model based on the actual value of the network-site analytics metric for the next time step or using an upper or lower value of the expected value range instead of the actual value to update the predictive model when the actual value exceeds the expected value range.