US Patent 10200901 Anomaly detection based on performance indicators

During operation, a computer may monitor values of at least one performance metric associated with packet communication by access points in a network. Then, the computer may compare current values of the performance metric for the access points with historical values of the performance metric for the access points within a temporal context in order to determine temporal anomaly scores for the access points. Moreover, the computer may compare the temporal anomaly scores of a group of access points in order to determine spatial temporal anomaly scores for the access points that indicate a significance of the temporal anomaly scores in a spatial context. Furthermore, when a spatial temporal anomaly score for an access point meets a detection criterion, the computer system may identify the current value of the performance metric for the access point as an anomaly. Next, the computer system may perform a remedial action based on the identified anomaly.