AIOps-Driven Anomaly Detection Framework for Enterprise Infrastructure Reliability Using Time-Series Forecasting and Intelligent Alert Correlation

Abstract

Static-threshold monitoring decays predictably as financial infrastructure scales -- a fundamental structural failure that no amount of tuning resolves [9]. This paper addresses this gap through a novel combination: seasonality-aware time-series forecasting integrated directly with topology-aware alert correlation in a single production-calibrated pipeline. Unlike prior AIOps systems that treat forecasting and correlation as independent modules or rely on proprietary vendor platforms without generalizable design specifications [1][3], the contribution here is their joint calibration to the distinctive periodicity of payment workloads and the deployment of both within a vendor-neutral, reproducible architecture. The novelty lies in three integrated design decisions absent from existing systems: (1) Prophet-based seasonal decomposition [6] pre-conditioned on payment calendar events (end-of-month settlement, intraday volume peaks) as explicit changepoint priors rather than post-hoc corrections; (2) Isolation Forest multivariate scoring [8] calibrated on a topology-derived metric neighborhood rather than independent feature sets; and (3) APM-trace-derived service graphs used as the spatial metric for DBSCAN situation clustering [17], directly coupling the anomaly detection and correlation layers. The system was validated on an enterprise financial platform processing over 40,000 transactions per second, using an OpenTelemetry-compatible collection layer, a Kafka-based ingestion pipeline, and a commercial event correlation platform (Moogsoft-compatible architecture) across more than 12,000 monitored hosts. Over a 90-day production evaluation against 180 ground-truth incidents, the system achieved precision of 0.91 and recall of 0.94 (F1=0.92, 95% CI: [0.90, 0.94]), reduced total daily alert volume by 75%, increased actionable alert volume by 77%, and cut the false positive rate from 87.2% to 9.4% [1][8]. MTTD improved by 82% and MTTR by 74% across incident categories. We document implementation decisions, failure modes, and the organizational dynamics that shaped these outcomes.