Anomaly Detection for Monitoring

attempt to be as descriptive as possible about a collection of
data. With summary statistics, your prediction formula then
becomes something like “the next value will be the same as the
current average of recent values.” Now you’re predicting that
values will most likely be close to what they’ve typically been
like recently. You can replace “average” with median, EWMA, or
other descriptive summary statistics.
3. One step beyond this is predicting a likely range of values centered
around a summary statistic. This usually boils down to a
simple mean for the central value and standard deviation for the
spread, or an EWMA with EWMA control limits (analogous to
mean and standard deviation, but exponentially smoothed).
4. All of these methods use parameters (e.g., the mean and standard
deviation). Non-parametric methods, such as histograms
of historical values, can also be used. We’ll discuss these in more
detail later in this book.
We can take prediction to an even higher level of sophistication
using more complicated models, such as those from the ARIMA
family. Furthermore, you can also attempt to build your own models
based on a combination of metrics, and use the corresponding output
to feed into a control chart. We’ll also discuss that later in this
book.
Prediction is a difficult problem in general, but it’s especially difficult
when dealing with machine data. Machine data comes in many
shapes and sizes, and it’s unreasonable to expect a single method or
approach to work for all cases.
In our experience, most anomaly detection success stories work
because the specific data they’re using doesn’t hit a pathology. Lots
of machine data has simple pathologies that break many models
quickly. That makes accurate, robust 6 predictions harder than you
might think.
6 In statistics, robust generally means that outlying values don’t throw things for a loop;
for example, the median is more robust than the mean.
26 | Chapter 3: Modeling and Predicting