Systems and methods for unsupervised anomaly detection using non-parametric tolerance intervals over a sliding window of t-digests

Abstract

Systems and methods for unsupervised training and evaluation of anomaly detection models are described. In some embodiments, an unsupervised process comprises generating an approximation of a data distribution for a training dataset including varying values for a metric of a computing resource. The process further determines, based on the size of the training dataset, a first quantile probability and a second quantile probability that represent an interval for covering a prescribed proportion of values for the metric within a prescribed confidence level. The process further trains a lower limit of the anomaly detection model using a first quantile that represents the first quantile probability in the approximation of the data distribution and an upper limit using a second quantile that represents the second quantile probability in the approximation. The trained upper and lower limits may be used to monitor input data for anomalous behavior and, if detected, trigger responsive action(s).