Detecting anomalies in time series data

摘要

Disclosed are various embodiments for detecting anomalies in time series data. At least one anomaly is detected in a time series that is derived from a corresponding metric observed from a computing system. The time series is non-stationary time series or heteroskedastic. The detected anomaly is correlated with at least one of a plurality of external events affecting the computing system. A magnitude is assigned to the detected anomaly. The detected one anomaly, the assigned magnitude, and the correlated at least one external event are reported to a client device.

主权项

1. A non-transitory computer-readable medium embodying a program executable in a computing device, the program comprising:
code that detects a plurality of anomalies in a plurality of time series, individual ones of the time series being derived from metrics observed from a computing system, at least two of the time series differing in time resolution, the individual ones of the time series being at least one of non-stationary or heteroskedastic, the plurality of anomalies being detected by:
decomposing the individual ones of the time series into a respective smoothed component and a respective noise component;identifying any outliers present in the respective noise component;identifying any step functions present in the respective smoothed component;identifying any changes in variance in a respective one of the time series; andidentifying any changes in density in the respective one of the time series; code that partitions the plurality of anomalies according to a time of occurrence; code that identifies co-occurring instances of anomalies in the partitioned anomalies; code that correlates at least a portion of the plurality of anomalies with at least one of a plurality of external events affecting the computing system; code that assigns a magnitude to the co-occurring instances of anomalies; and code that reports the co-occurring instances of anomalies, the assigned magnitude, and the correlated at least one external event.