a method receives online quality of service (QoS) metric values for online logs of using a service.
In some embodiments, a method receives online quality of service (QoS) metric values for online logs of using a service. Synthetic QoS metric values that describe anomalies are added to the training dataset. A model predicts predicted QoS metric values in the online logs. A distribution of a difference between QoS metric values from the training dataset and the predicted QoS metric values is determined. The method uses the difference to adjust a parameter in the model to train the model to predict the predicted QoS metric values. The distribution is used to determine a dynamic threshold that is used to determine whether an anomaly occurs. The method determines whether an anomaly is detected in new online logs based on applying the dynamic threshold to a difference between online QoS metric values and predicted QoS metric values generated by the trained model. The dynamic threshold changes over the time series.
BACKGROUND
A system may employ an anomaly detection process to detect anomalies in data. It may be important to detect anomalies in real time such that any possible remedial actions can be performed as soon as possible. In some examples, a content delivery system may receive quality of service (QoS) data from different entities that are delivering content, such as content delivery networks and/or Internet Service Providers. However, it may be difficult to analyze the data for anomalies. For example, training a model to analyze the data may not address data drift, seasonality challenges, or be fast enough. In some examples, data may drift over time, which may require a new complete set of data in bulk to re-train the model. Also, seasonality may occur where different patterns may be experienced, which requires the model to be retrained again with a new batch of training data. The above training may slow down the process of detecting anomalies and cause a lag in the detection based on the retraining process.
1. A method comprising: receiving online quality of service metric values for online logs of using a service, wherein the online quality of service metric values are included in a training dataset; determining synthetic quality of service metric values that describe anomalies, wherein the synthetic quality of service metric values are added to the training dataset; predicting, using a model, predicted quality of service metric values for the online logs; determining a distribution of a difference between quality of service metric values from the training dataset and the predicted quality of service metric values; using the difference to adjust a parameter in the model to train the model to predict the predicted quality of service metric values; using the distribution to determine a dynamic threshold that is used to determine whether an anomaly occurs; and determining whether an anomaly is detected in new online logs based on applying the dynamic threshold to a difference between a time series of online quality of service metric values and predicted quality of service metric values generated by the trained model, wherein the dynamic threshold changes over the time series. ||
18. A non-transitory computer-readable storage medium having stored thereon computer executable instructions, which when executed by a computing device, cause the computing device to be operable for: receiving online quality of service metric values for online logs of using a service, wherein the online quality of service metric values are included in a training dataset; determining synthetic quality of service metric values that describe anomalies, wherein the synthetic quality of service metric values are added to the training dataset; predicting, using a model, predicted quality of service metric values for the online logs; determining a distribution of a difference between quality of service metric values from the training dataset and the predicted quality of service metric values; using the difference to adjust a parameter in the model to train the model to predict the predicted quality of service metric values; using the distribution to determine a dynamic threshold that is used to determine whether an anomaly occurs; and determining whether an anomaly is detected in new online logs based on applying the dynamic threshold to a difference between a time series of online quality of service metric values and predicted quality of service metric values generated by the trained model, wherein the dynamic threshold changes over the time series. ||
20. An apparatus comprising: one or more computer processors; and a computer-readable storage medium comprising instructions for controlling the one or more computer processors to be operable for: receiving online quality of service metric values for online logs of using a service, wherein the online quality of service metric values are included in a training dataset; determining synthetic quality of service metric values that describe anomalies, wherein the synthetic quality of service metric values are added to the training dataset; predicting, using a model, predicted quality of service metric values for the online logs; determining a distribution of a difference between quality of service metric values from the training dataset and the predicted quality of service metric values; using the difference to adjust a parameter in the model to train the model to predict the predicted quality of service metric values; using the distribution to determine a dynamic threshold that is used to determine whether an anomaly occurs; and determining whether an anomaly is detected in new online logs based on applying the dynamic threshold to a difference between a time series of online quality of service metric values and predicted quality of service metric values generated by the trained model, wherein the dynamic threshold changes over the time series.