Anomaly Detection for Monitoring

pletely out of phase with the seasonal pattern. This is easy to see in
Figure 4-3.
Figure 4-3. A sine wave and a EWMA of the sine wave, showing how a
EWMA’s lag causes it to predict the wrong thing most of the time.
Coping with seasonality is exactly the same as with trend: you need
to decompose and subtract. This time, however, it’s harder to do
because the model of the seasonal component is much more complicated.
Furthermore, there can be multiple seasonal components in a
metric! For example, you can have a seasonal trend with a daily
period as well as a weekly period.
Multiple Exponential Smoothing
Multiple exponential smoothing was introduced to resolve problems
with using a EWMA on metrics with trend and/or seasonality. It
offers an alternative approach: instead of modifying a metric to fit a
model by decomposing it, it updates the model to fit the metric’s
local behavior. Holt-Winters (also known as the Holt-Winters triple
exponential smoothing method) is the best known implementation
of this, and it’s what we’re going to focus on.
A multiple exponential smoothing model typically has up to three
components: an EWMA, a trend component, and a seasonal component.
The trend and seasonal components are EWMAs too. For
example, the trend component is simply an EWMA of the differences
between consecutive points. This is the same approach we
36 | Chapter 4: Dealing with Trends and Seasonality