Changepoint-Based Anomaly Detection

Prognostic diagnosis is desirable for commercial core router systems to ensure early failure prediction and fast error recovery. The effectiveness of prognostic diagnosis depends on whether anomalies can be accurately detected before a failure occurs. However, traditional anomaly detection techniques fail to detect ”outliers” when the statistical properties of the monitored data change significantly as time proceeds. In this chapter, we describe the design of a changepoint-based anomaly detector that first detects changepoints from collected time-series data, and then utilizes these changepoints to detect anomalies. Different changepoint detection approaches are implemented to detect various types of changepoints. A clustering method is then developed to identify normal/abnormal patterns from changepoint windows. Data collected from a set of commercial core router systems are used to validate the proposed anomaly detector. Experimental results show that our changepoint-based anomaly detector achieves better performance than traditional methods in terms of two metrics, namely success ratio and non-false-alarm ratio.