Anomaly detection for time series data having arbitrary seasonality

Patent metadata

Field	Value
Publication number	US-11023577-B2
Application number	US-201615228570-A
Country	US
Kind code	B2
Filing date	Aug 4, 2016
Priority date	Aug 4, 2016
Publication date	Jun 1, 2021
Grant date	Jun 1, 2021

Abstract

In various implementations, a method includes receiving a set of time series data that corresponds to a metric. A seasonal pattern is extracted from the set of time series data and the extracted seasonal pattern is filtered from the set of time series data. A predictive model is generated from the filtered set of data. The extracted seasonal pattern is filtered from another set of time series data where the second set of time series data corresponds to the metric. The filtered second set of time series data is compared to the predictive model. An alert is generated to a user for a value within the filtered second set of time series data which falls outside of the predictive model.

First claim

What is claimed is:

1. A computer-implemented system comprising:
at least one processor; and
at least one computer-readable media having a plurality of executable instructions embodied thereon, which, when executed by the at least one processor causes the at least one processor to perform a method comprising:
receiving a first set of time series data representing a time series corresponding to a metric;
identifying frequencies of seasonal patterns from the first set of time series data, each frequency representing a seasonal pattern of periodic oscillations of values of the time series;
selecting, from the seasonal patterns, a group of seasonal patterns as prominent seasonal patterns, each seasonal pattern of the group being selected based at least on the frequency of the seasonal pattern exceeding a threshold frequency and a ranking of magnitudes of amplitudes of the frequencies, wherein each amplitude of the amplitudes comprises a measure of a contribution of a frequency to seasonality of the time series relative to others of the frequencies;
filtering the first set of time series data, the filtering removing the prominent seasonal patterns from the first set of time series data based at least on the selecting of the prominent seasonal patterns;
generating a predictive model from the filtered first set of time series data using a seasonal period that corresponds to the threshold frequency;
filtering a second set of time series data, the filtering removing the prominent seasonal patterns from the second set of time series data, the second set of time series data corresponding to the metric;
comparing the filtered second set of time series data to the predictive model; and
providing an alert to a user based on the comparing indicating the filtered second set of time series data deviates from the predictive model.

2. The computer-implemented system of claim 1 , wherein the filtering of the prominent seasonal patterns from the first set of time series data comprises applying a seasonality filter to the first set of time series data and the filtering the prominent seasonal patterns from the second set of time series data comprises applying the seasonality filter to the second set of time series data.

3. The computer-implemented system of claim 1 , further comprising generating a set of expected ranges of the metric from the predictive model, wherein the comparing is of the filtered second set of time series data to the set of expected ranges.

4. The computer-implemented system of claim 1 , wherein the selecting includes selecting a first seasonal pattern based on determining a first amplitude of a first frequency of the first seasonal pattern is larger than a second amplitude of a second frequency of the frequencies.

5. The computer-implemented system of claim 1 , further comprising:
identifying a first frequency and a second frequency from the frequencies;
determining the second frequency corresponds to a frequency leakage from the first frequency;
based on the determining combining an amplitude of the first frequency with an amplitude of the second frequency resulting in a combined amplitude of the amplitudes; and
assigning the combined amplitude to the first frequency.

6. The computer-implemented system of claim 1 , wherein a quantity of parameters of the predictive model are based at least on the seasonal period.

7. The computer-implemented system of claim 1 , wherein the alert comprises an electronic communication and the providing is of the electronic communication to a user device.

8. The computer-implemented system of claim 1 , wherein the metric measures activities of a computer network-site.

9. A computer-implemented method comprising:
receiving a first set of time series data representing a time series corresponding to a metric;
identifying frequencies of seasonal patterns from the first set of time series data, each frequency representing a seasonal pattern of periodic oscillations of values of the time series;
selecting, from the seasonal patterns, a group of seasonal patterns as prominent seasonal patterns, each seasonal pattern of the group being selected based at least on the frequency of the seasonal pattern exceeding a threshold frequency and a ranking of magnitudes of amplitudes of the frequencies, wherein each amplitude of the amplitudes comprises a measure of a contribution of a frequency to seasonality of the time series relative to others of the frequencies;
filtering the first set of time series data, the filtering removing the prominent seasonal patterns from the first set of time series data based at least on the selecting of the prominent seasonal patterns;
determining parameters of a predictive model based on the filtered first set of time series data, the parameters defining predicted future values of the metric as a function of time and a quantity of the parameters being based at least on a seasonal period that corresponds to the threshold frequency;
filtering a second set of time series data, the filtering removing the prominent seasonal patterns from the second set of time series data based at least on the selecting of the prominent seasonal patterns, the second set of time series data corresponding to the metric;
generating at least one of the predicted future values from the predictive model based on a future time that corresponds to the filtered second set of time series data;
identifying a deviation between the at least one of the predicted future values and the filtered second set of time series data; and
providing an alert to a user device based on the identified deviation.

10. The computer-implemented method of claim 9 , wherein the determining parameters of the predictive model comprises:
updating prior parameters of the existing predictive model based on the filtered first set of time series data.

11. The computer-implemented method of claim 9 , further comprising:
determining a portion of the filtered first set of time series data conforms to the predicted future values; and
based on the determining updating the parameters of the predictive model based on the portion of the filtered first set of time series data.

12. The computer-implemented method of claim 9 , wherein the parameters of the predictive model further define expected ranges for the predicted future values of the filtered first set of time series data as a function of time, and
wherein the identifying the deviation between the at least one of the predicted future values and the filtered second set of time series data comprises:
determining that at least one value of the filtered second set of time series data falls outside of the expected range, the at least one value corresponding to the future time.

13. The computer-implemented method of claim 9 , further comprising:
determining a portion of the filtered second set of time series data that corresponds to the identified deviations;
replacing at least one value of the portion of the second set of filtered time series data that corresponds to the deviation with at least one corrected value that is within an expected range of the predicted future values; and
updating the parameters of the predictive model based on the second set of filtered time series data that includes the at least one corrected value.

14. The computer-implemented method of claim 9 , wherein the filtering removes from the first time series data each of the prominent seasonal patterns that has a lower frequency than the threshold frequency.

15. The computer-implemented method of claim 9 , wherein the predicted future values of the metric are defined in the predic

Assignees

• Adobe Inc

Inventors

• Saini Shiv Kumar
• Modani Natwar
• Srinivasan Balaji Vasan

Classifications

• G06N20/00 Primary

  Machine learning · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F11/3447

  Performance evaluation by modeling · CPC title