Google Inc.

Xinyi Zhang

Kevin Yu

Yu Xie

Matthew Lawlor

Described herein are systems, mediums, and methods for simultaneously determining multiple types of changes in time series data. A plurality of potential change points may be selected in a signal representing the time series data. For each potential change point the signal may be a split into two segments including data points before and data points after the potential change point, respectively. Estimate of cumulative distribution function for each segment may be determined. A normalized difference of the respective estimates of cumulative distribution functions may be determined. The normalized difference may be compared to a threshold value to determine whether the potential change point qualifies as valid change point. The techniques discussed herein may determine at least two valid change points representing at least two different types of changes in the signal.

Non-parametric change point detection

Systems and methods are described herein for detecting an anomaly in a discrete signal, where samples in the signal correspond to amounts of data flow in a network within a time interval. The discrete signal is received, and a sequence of likelihoods corresponding to the sample values in the signal is generated. The likelihoods are based at least in part on a historical probability distribution of previously received sample values, and a likelihood is a probability of occurrence of a corresponding sample value in the signal. Likelihood change points are identified in the likelihood sequence, and the discrete signal is segmented into a plurality of segments at samples corresponding to the identified change points. A segment is identified as an anomaly based on a comparison between a statistic of the segment and a statistic of the historical probability distribution.

Statistics-based anomaly detection

Described herein are systems, mediums, and methods for detecting blockage of network traffic at a network server. A signal representative of time series data associated with network traffic is received at a processor for analysis. A data segmentation algorithm and an anomaly detection algorithm are applied in series to the received data. The segmentation algorithm detects regime shifts in the data. Data between regime shifts is considered a segment of data. The anomaly detection algorithm analyzes each segment individually to determine whether anomalies exist in the segment. If a cyclic pattern is found in the segment, the cyclic pattern is extracted from the segment leaving a residual data for analysis. A probability distribution of the residual data is determined for analysis. When an anomaly is detected in the segment o based on the probability distribution of the residual data, it is determined that blockage has occurred on the network traffic.

Anomaly detection in time series data

Systems and methods are disclosed herein for detecting an anomaly in a discrete signal, where a long-term trend of the discrete signal is identified. Samples in the signal correspond to a number of data packets arriving at a location in a network within a time interval. The long-term trend is subtracted from the discrete signal to obtain a detrended signal. A cyclic pattern is identified in the detrended signal and is subtracted from the detrended signal to obtain a residual signal. Anomaly detection is performed on the residual signal.

Anomaly detection in a signal

Systems and methods are provided for estimating missing samples in a signal. A plurality of samples in the signal is received, and a respective sample corresponds to a respective sample location in a plurality of sample locations. A subset of sample locations representing missing samples in the signal is identified, and a first and a second threshold are determined. Each threshold is an integer number of samples, and the second threshold is greater than the first threshold. A first set of consecutive sample locations from the identified subset of sample locations is formed, and the missing samples in the first set of consecutive sample locations are replaced based on a comparison between a number of locations in the first set of consecutive locations, the first threshold, and the second thresholds.

Data replacement policy

Systems and methods are disclosed herein for identifying an anomaly in a signal, where samples in the signal correspond to an amount of data flow in a network within a time interval, and an anomaly corresponds to at least one sample in the discrete signal having a likelihood value below a likelihood threshold. A historical probability distribution of the discrete signal is generated based on previously received samples. For each sample in a plurality of samples in the discrete signal, a likelihood is computed based at least in part on the historical probability distribution. A likelihood threshold is selected, and a set of consecutive samples is identified as an anomaly when each sample in the set has a computed likelihood below the likelihood threshold.

Growing community of inventors

San Jose, CA, United States of America

Xinyi Zhang