Anomaly Detection Overview

This service uses machine learning to classify and cluster different devices on your account and alert you to unusual behavior in the device data usage patterns. The unusual alert or event is based on parameters you can define that would classify an event as anomalous or not. 

• These anomaly detection thresholds can be set at an account level using these Intelligence API’s below.

• Top anomalous devices can be viewed in the analytics dashboard in the ThingSpace portal

• Users can create alerts associated with the events by configuring an alert rule using the usage trigger API

• Alerts can be viewed in the alerts panel or via a callback. For more information about callbacks, please visit About Callback Services.

• Anomaly detection service prerequisites

  • ThingSpace account access:

    • Your Verizon Enterprise billing account number

    • Your ThingSpace Develop account credentials

    • Your account’s UWS login credentials

  • Verizon real time reporting or RTR - eligible data plans

  • 1 week of training of RTR data from active lines on the Verizon network

  • ThingSpace Intelligence premium bundle

• Anomaly detection machine learning model

  • The Anomaly Detection service uses machine learning to cluster and classify devices on the account based on data connectivity. The model splits up the week into 168 buckets (hours) and uses device behavior data from those hours to train a model and infer anomalous behavior based on the cluster.

  • Using these groupings, ThingSpace will alert for unusual data usage behavior. Such alerts or events are filtered based on the sensitivity set in the anomaly detection API.

Anomaly detection workflow

Machine Learning training (steps 1-3): Assuming the prerequisites are met, the machine learning model is trained per steps 1-3 in the diagram above.

Anomaly settings (step 4): Each anomaly alert has a rarity score. This setting defines what is considered  “abnormal” and what is “very abnormal” in the context of this billing account. These definitions are used in the analytics dashboard, reports and rules. Users have the option of setting rules and alerts associated with anomaly events (step 4a)

Alerts (step 5): Alerts are generated and available in the ThingSpace portal.Alert notifications (steps 5a-6a): With a rule trigger assigned, users can be notified via email or to a callback server. The ThingSpace portal and callback include a summary of the events.