Auto tuning data anomaly detection

Abstract

Automatic tuning anomaly detection is described. The context metric keys are established during a training phase based on the surrounding context of data received from devices over time. Anomaly and tuning windows are also established for metric ranges of the context metric keys. After the training phase, incoming data is correlated against the keys to identify sets of the data associated with certain context metric keys. For any given context metric key, metric data values in the associated set of data fall either within or outside the metric range of the context metric key. If they fall outside the range for longer than the anomaly window, an alarm is raised. If they fall outside the range for longer than the tuning window, boundaries for the metric range are updated. Additionally, the contextual parameters of the context metric keys are also updated over time, as new data contexts appear.