Intuit Inc.
REAL-TIME ANOMALY DETECTION

Abstract:

This disclosure provides systems, methods and apparatuses for detecting anomalous activity in an electronic system. In some implementations, a system generates a set of model parameters based on a number (n) of historical datapoints in a dataset, where each datapoint represents activity detected in the electronic system over a respective period of time. The system receives a first new data point for the data set and generates a first test parameter based on a value of the first new datapoint and an average and a measure of spread of the n historical datapoints. The system further compares the first test parameter to the set of model parameters and determines whether the first new datapoint represents an anomaly based at least in part on the comparison.