Methods and apparatus for real-time anomaly detection over sets of time-series data

Abstract

Methods and apparatus are provided for real-time anomaly detection over sets of time-series data. One method comprises: obtaining a state-space representation of a plurality of states and transitions between said states based on sets of historical time-series data; obtaining an anomaly detection model trained using a supervised learning technique, wherein the anomaly detection model associates sequences of states in the state-space representation with annotated anomalies in the sets of historical time-series data and assigns a probability to said sequences of states; and, for incoming real-time time-series data, determining a likelihood of a current state belonging to a plurality of possible states in the state-space representation; and determining a probability of incurring said annotated anomalies based on a plurality of likely current state sequences that satisfy a predefined likelihood criteria. Anomalous behavior is optionally distinguished from previously unknown behavior based on a predefined likelihood threshold.