Evaluation framework for anomaly detection using aggregated time-series signals

Abstract

Techniques are provided for evaluating one or more anomaly detection models using aggregated time-series signals. One method comprises obtaining discrete transactions; determining feature values for the discrete transactions; applying the feature values to at least one anomaly detection model that generates an anomaly score for each discrete transaction; generating a reduced set of the discrete transactions using the anomaly score for each of the plurality of discrete transactions; aggregating the discrete transactions of the reduced set to create an aggregated time-series signal; training a forecast algorithm using a first portion of the aggregated time-series signal; generating a prediction of a second portion of the aggregated time-series signal using the trained forecast algorithm; calculating a performance metric of the forecast algorithm based on a difference between: the second portion of the aggregated time-series signal and the prediction of the second portion; and initiating an automated action using the performance metric.