Anomaly Detection for Monitoring

More documents

Recommendations

Info

Figure 3-6. A mysterious time series about which we’ll pretend we know nothing. Is your time series Gaussian distributed? You decide to check, so you start up your R environment and plot a histogram of your time series data. For comparison, you also overlay a normal distribution curve with the same mean and standard deviation as your sample data. The result is displayed in Figure 3-7. Figure 3-7. Histogram of the mystery time series, overlaid with the normal distribution’s “bell curve.” Uh-oh! It doesn’t look like a great fit. Should you give up hope? 28 | Chapter 3: Modeling and Predicting
No. You’ve stumbled into statistical quicksand: • It’s not important that the data is Gaussian. What matters is whether the residuals are Gaussian. • The histogram is of the sample of data, but the population, not the sample, is what’s important. Let’s explore each of these topics. The Data Doesn’t Need to Be Gaussian The residuals, not the data, need to be Gaussian (normal) to use three-sigma rules and the like. What are residuals? Residuals are the errors in prediction. They’re the difference between the predictions your model makes, and the values you actually observe. If you measure a system whose behavior is log-normal, and base your predictions on a model whose predictions are log-normal, and the errors in prediction are normally distributed, a standard SPC control chart of the results using three-sigma confidence intervals can actually work very well. Likewise, if you have multi-modal data (whose distribution looks like a camel’s humps, perhaps) and your model’s predictions result in normally distributed residuals, you’re doing fine. In fact, your data can look any kind of crazy. It doesn’t matter; what matters is whether the residuals are Gaussian. This is superimportant to understand. Every type of control chart we discussed previously actually works like this: • It models the metric’s behavior somehow. For example, the EWMA control chart’s implied model is “the next value is likely to be close to the current value of the EWMA.” • It subtracts the prediction from the observed value. • It effectively puts control lines on the residual. The idea is that the residual is now a stable value, centered around zero. Any control chart can be implemented either way: • Predict, take the residual, find control limits, evaluate whether the residual is out of bounds Common Myths About Statistical <strong>Anomaly</strong> <strong>Detection</strong> | 29
Page 3 and 4: Anomaly Detection for Monitoring A
Page 5 and 6: Table of Contents Foreword. . . . .
Page 7: Foreword Monitoring is currently un
Page 10 and 11: tion” to anomaly detection is imp
Page 12 and 13: Why do we assume these things? Are
Page 14 and 15: Conclusions If you are like most of
Page 17 and 18: CHAPTER 2 A Crash Course in Anomaly
Page 19 and 20: How can you achieve similar results
Page 21 and 22: cause most anomaly detection techni
Page 23 and 24: CHAPTER 3 Modeling and Predicting A
Page 25 and 26: (say, the size of the drill bit), a
Page 27 and 28: lies. To fix this problem, the cont
Page 29 and 30: ally decaying window. This is made
Page 31 and 32: ack again, meaning that they smooth
Page 33 and 34: emains consistent across all of the
Page 35: Evaluating Predictions One of the m
Page 39: As an aside, there’s a rumor goin
Page 42 and 43: Dealing with Trend Trends break mod
Page 44 and 45: pletely out of phase with the seaso
Page 46 and 47: mon situations. You can probably gu
Page 49 and 50: CHAPTER 5 Practical Anomaly Detecti
Page 51 and 52: If you can get close to that, you m
Page 53 and 54: We previously discussed how frequen
Page 55 and 56: First, observe how odd this metric
Page 57 and 58: After differencing, it looks like w
Page 59 and 60: Perhaps, instead of differencing, w
Page 61 and 62: CHAPTER 6 The Broader Landscape As
Page 63 and 64: We could apply a EWMA control chart
Page 65 and 66: figure out how unlikely it was for
Page 67 and 68: predict or find structure in data w
Page 69 and 70: Graphite and RRDTool Graphite and R
Page 71 and 72: APPENDIX A Appendix Code Control Ch
Page 73 and 74: var ma = new movingAverage(0.5); ma
Page 75: Acknowledgments We’d like to than

Anomaly Detection for Monitoring

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?