ANOMALY DETECTION IN TIME SERIES DATA USING POST-PROCESSING

摘要

Described herein are systems, mediums, and methods for detecting anomalies in a signal by applying two analysis algorithms in parallel to the signal. The results of the two algorithms are combined during a post-processing step. The first analysis algorithm detects a first set of anomalies using amplitude-based anomaly detection method. The first set of anomalies includes large dips/spikes with short duration and large week-by-week variations with long duration. The second analysis algorithm detects a second set of anomalies using statistics-based anomaly detection method. The second set of anomalies includes subtle changes with sharp edges and medium duration. The first set of anomalies and the second set of anomalies are merged in a post-processing step. All spikes and all changes that satisfy a pre-determined criteria are removed from the merged data. Adjacent anomalies are concatenated. The resulting set of anomalies is used to determine service outage at a network server.

主权项

1. A non-transitory electronic device readable storage medium storing instructions for detecting network service outages that, when executed, cause one or more processors to:
receive a network traffic signal in form of time series data from a network server; execute an amplitude-based anomaly detection algorithm on the received network traffic signal to detect a first set of anomalies from a first set of samples of the received network traffic signal; execute a statistics-based anomaly detection algorithm on the received network traffic signal to detect a second set of anomalies from a second set of samples of the received network traffic signal, wherein the amplitude-based anomaly detection algorithm and the statistics-based anomaly detection algorithm are executed in parallel; combine the first set of anomalies and the second set of anomalies into a merged set of anomalies; and determine that there is a service outage at the network server based on a number of anomalies in the merged set of anomalies being above a predefined threshold and within a predefined time window.