Sliding Window Abnormal Behavior Detection

For stream of CDRs we take the sliding window W that contains all CDRs recorded during the period of n seconds which is sliding every m seconds.

In the example n=21, m=7, so we have CDRs recorded during 21 seconds in the window and slide it over time every 7 seconds.

Hence, every m (7) seconds we have the batch of CDRs for which we calculate following:

• CDRs_i - number of CDRs for each tower.
• FailedCDRs_i - number of failed CDRs for each tower.
• Fails rate for tower is , where i is tower id.

We store the fail rate into the history document in the MapRDB. After accumulation of 5+ values of fail rate, we calculate following for that values:

• The mean fails rate
• The standard deviation

Having that values, we can calculate the error rate for current window for each tower:

If the err_i > 1, the alert about abnormal behaviour of tower i is sent.