Abstract: Techniques are provided for ranking time-series including previously detected anomalous fact quantity changes over an associated time interval. Time-series are received, and for each time-series, a normalized fact quantity change is determined, and each time-series is ranked based in part on the normalized fact quantity change. A normalized fact quantity change may be determined by determining a normalization factor over the time interval, and then determining a product of the normalization factor and the absolute value of the fact quantity change of that time interval. Alternatively, a normalized fact quantity change may be the product of the normalization factor, a predetermined order factor, and the absolute value of the fact quantity change. The normalization factor is determined by analyzing the distribution of the fact quantity change over dimension values of the dimension(s) associated with the time-series to determine the number of values in which the fact quantity is concentrated.

Abstract: Techniques are provided for ranking time-series including previously detected anomalous fact quantity changes over an associated time interval. Time-series are received, and for each time-series, a normalized fact quantity change is determined, and each time-series is ranked based in part on the normalized fact quantity change. A normalized fact quantity change may be determined by determining a normalization factor over the time interval, and then determining a product of the normalization factor and the absolute value of the fact quantity change of that time interval. Alternatively, a normalized fact quantity change may be the product of the normalization factor, a predetermined order factor, and the absolute value of the fact quantity change. The normalization factor is determined by analyzing the distribution of the fact quantity change over dimension values of the dimension(s) associated with the time-series to determine the number of values in which the fact quantity is concentrated.

Abstract: Described herein is a system and method for classifying detected anomalies. Detected anomaly data comprising a plurality of anomaly data points is received. The detected anomaly data is labeled with a plurality of attributes using label logic for each of the plurality of attributes. The detected anomaly data is classified into one of a plurality of classifications based upon the attributes using a rule-based classification algorithm. The rule-based algorithm further determines a result for at least some of the anomaly data points. The classified detected anomaly data and the corresponding determined results are provided, for example, to a user.