This thesis aims to develop an automated system to detect group anomalies, false positives, and security threats in time series data from applications and devices. The system will analyze logs from security SDK to help developers improve their SDK or application.

The theoretical focus will cover:

• Time Series Anomaly Detection: Unsupervised techniques for identifying anomalies in sequential data.
• Group Anomaly Detection: Methods for analyzing patterns across multiple incidents, identifying correlated anomalies within time series.
• Applications in Security: Research on detecting security incidents such as coordinated attacks or false positives through anomaly detection in time series data.

Practical Objectives:

• App Analysis: Detect deviations and trends in incident rates of an app over time.
• Device Analysis: Identify devices and models showing unusual behavior.
• SDK-Check Analysis: Evaluate the effect of new SDK checks and generate reports.

The system will be built for extensibility, compatibility with various storage systems, and offer on-demand analysis.

The thesis is solved in cooperation with the Lynx SFT s.r.o.