[BLOG] Enhancing OpenSearch Anomaly Detection: Reducing False Positives Through Algorithmic Improvements

[kaituo]

Describe the blog post

The enhancements to the RCF algorithm, now integrated into OpenSearch 2.17, significantly reduce false positives. By tracking a history of candidate anomalies, adapting to evolving data patterns, implementing alert-once suppression, and refining scores through expected value comparisons, the updated approach effectively addresses complex real-world challenges—such as data drift, level shifts, and periodic spikes—while maintaining high recall. Empirical tests on the NAB CloudWatch benchmarks further confirm its effectiveness, with 92.6% reduction in false positives and 50% reduction in false negatives.

Expected Title

Enhancing OpenSearch Anomaly Detection: Reducing False Positives Through Algorithmic Improvements

Authors Name

Kaituo Li

Authors Email

[email protected]

Target Draft Date

12/26/2024

Blog Post Category

technical

Target Publication Date

01/26/2025

Additional Info

No response