Anomaly Detection for Monitoring

No. You’ve stumbled into statistical quicksand:
• It’s not important that the data is Gaussian. What matters is
whether the residuals are Gaussian.
• The histogram is of the sample of data, but the population, not
the sample, is what’s important.
Let’s explore each of these topics.
The Data Doesn’t Need to Be Gaussian
The residuals, not the data, need to be Gaussian (normal) to use
three-sigma rules and the like.
What are residuals? Residuals are the errors in prediction. They’re
the difference between the predictions your model makes, and the
values you actually observe.
If you measure a system whose behavior is log-normal, and base
your predictions on a model whose predictions are log-normal, and
the errors in prediction are normally distributed, a standard SPC
control chart of the results using three-sigma confidence intervals
can actually work very well.
Likewise, if you have multi-modal data (whose distribution looks
like a camel’s humps, perhaps) and your model’s predictions result
in normally distributed residuals, you’re doing fine.
In fact, your data can look any kind of crazy. It doesn’t matter; what
matters is whether the residuals are Gaussian. This is superimportant
to understand. Every type of control chart we discussed
previously actually works like this:
• It models the metric’s behavior somehow. For example, the
EWMA control chart’s implied model is “the next value is likely
to be close to the current value of the EWMA.”
• It subtracts the prediction from the observed value.
• It effectively puts control lines on the residual. The idea is that
the residual is now a stable value, centered around zero.
Any control chart can be implemented either way:
• Predict, take the residual, find control limits, evaluate whether
the residual is out of bounds
Common Myths About Statistical Anomaly Detection | 29