ServiceNow, Inc.
HYBRID ANOMALY DETECTION FOR RESPONSE-TIME-BASED EVENTS IN A MANAGED NETWORK

Abstract:

A computing device is provided that is configured to obtain, from a managed network, a plurality of response times of a network-based service provided by the managed network; to train, based on the plurality of response times, a probability distribution to model the managed network; to receive an additional response time from the managed network; to use the probability distribution to determine, for the additional response time, a percentile based on the additional response time; based on the percentile, to determine that the additional response time is anomalously high with respect to the plurality of response times of the network-based service; and to transmit, to a client device associated with the managed network, an indication that the additional response time is anomalously high. The probability distribution includes a central portion based on a plurality of bins and a tail portion based on a parametric distribution.