Anomaly Detection for Monitoring

emains consistent across all of the models and provides a logical
way to reason about time series analysis.
Parametric and Non-Parametric Statistics and Methods
Perhaps you have heard of parametric methods. These are statistical
methods or tools that have coefficients that must be specified or
chosen via fitting. Most of the things we’ve mentioned thus far have
parameters. For example, EWMAs have a decay parameter you can
adjust to bias the value towards more recent or more historical
data. The value of a mean is also a parameter. ARIMA models are
full of parameters. Common statistical tools, such as the Gaussian
distribution, have parameters (mean and spread).
Non-parametric methods work independently of these parameters.
You might think of them as operating on dimensionless quantities.
This makes them more robust in some ways, but also can reduce
their descriptive power.
Predicting Time Series Data
Although we haven’t talked yet about prediction, all of the tools
we’ve discussed thus far are designed for predictions. Prediction is
one of the foundations of anomaly detection. Evaluating any metric’s
value has to be done by comparing it to “what it should be,” which is
a prediction.
For anomaly detection, we’re usually interested in predicting one
step ahead, then comparing this prediction to the next value we see.
Just as with SPC and control charts, there’s a spectrum of prediction
methods, increasing in complexity:
1. The simplest one-step-ahead prediction is to predict that it’ll be
the same as the last value. This is similar to a weather forecast.
The simplest weather forecast is tomorrow will be just like today.
Surprisingly enough, to make predictions that are subjectively a
lot better than that is a hard problem! Alas, this simple method,
“the next value will be the same as the current one,” doesn’t
work well if systems aren’t stable (stationary) over time.
2. The next level of sophistication is to predict that the next value
will be the same as the recent central tendency instead. The term
central tendency refers to summary statistics: single values that
Predicting Time Series Data | 25