Google Cloud
AI Infrastructure team
Software Engineering PhD Intern · May-Aug 2026 · Kirkland, WA
Unsupervised ML Anomaly Detection & User Behavioral Fingerprint Modeling for Google Cloud Infrastructure Traffic
- Architected a data aggregation pipeline for the GCE metadata storage infra over Spanner, achieving a 50,000× size reduction to fuel a SQL backend unsupervised Machine Learning (ML) Anomaly Detection Model.
- Engineered AI infrastructure for Time-series Anomaly Detection by fine-tuning a Bayesian Time-Series algorithm, establishing robust models and metrics to monitor and describe clients’ behavioral metrics.
- Developed a full-stack architecture featuring a Python API layer and TypeScript frontend to support various resolution queries and deliver a comprehensive interactive dashboard view.
- Pioneered a system that is AI Agent native supportive by developing a custom SKILL.md.
- Productionized and deployed all project components, now running reliably in production.
- Drove major business impact by reducing debugging time for on-call engineers solving outages and bug tickets, attracting engineers to learn and apply the pipeline to broader business logic.
The aggregation preserves the information needed for behavioral analysis and anomaly investigation, rather than every original raw-log record.
Technical implementation: aggregation, unsupervised ML, and full-stack architecture
- 01 / RAW LOGSTransaction metricsConsolidate actions and attempts
- 02 / PRE-AGGREGATIONBehavioral fingerprintsClient, caller, region & time window
- 03 / SQL ANALYSISBayesian time seriesTable-valued function on aggregates
- 04 / INVESTIGATIONInteractive drill-downPython JSON API + TypeScript / Canvas
Pre-aggregate logs and control cardinality
Consolidated action and attempt records into transaction metrics, then grouped them by client, caller, region, and fixed time windows. Stored these derived fingerprints in queryable aggregate tables, limiting high-cardinality grouping dimensions while retaining representative transactions for investigation. Split historical backfills into bounded time-range batches, ran batches in parallel, and used off-peak execution to manage shuffle-memory and I/O pressure.
Engineer interpretable behavioral signals
Worked with on-call engineers to define features such as waiting-time fraction: total idle time divided by total transaction duration within each window. Integrated and tuned an unsupervised Bayesian structural time-series model with seasonal baselines and pre- and post-event context. Evaluated abrupt spikes and gradual drift relative to each client’s history, validating sensitivity and false positives against human-reviewed examples.
Run model inference inside SQL
Integrated the model as a SQL table-valued function (TVF), keeping analysis alongside the aggregate data instead of exporting full datasets to Python. Precomputed aggregates support repeated investigations without rescanning all raw logs. Balanced aggregation granularity, query cost, and reliable batch completion against interactive latency and data freshness.
Separate the API from the dashboard
Built a Python JSON API that maps time-window, resolution, and filter selections to parameterized SQL query templates, then returns compact results to a modular TypeScript dashboard. Custom Canvas charts support grouping and drill-down from behavioral shifts to representative transaction context. The browser communicates through the API rather than querying the database directly.
Data freshness and engineering trade-offs
The deployed system used scheduled batch aggregation for retrospective diagnosis. The follow-on design targets a maximum data lag of approximately seven hours, making data from about seven hours ago and earlier available for investigation. This is a planned refresh capability, not real-time alerting. The tool supports human investigation rather than automatic incident remediation.
To limit model-evaluation cost, I designed a candidate-screening stage with Z-scores for abrupt spikes and Mann–Kendall tests for gradual trends, followed by Bayesian analysis. This is a proposed extension to the deployed SQL-native detector.

