Anomaly Detection for Monitoring

More documents

Recommendations

Info

Here’s what the histogram of residuals with a Gaussian distribution curve looks like. Figure 5-1. Histogram of residuals from the control chart on differenced data. Where would we signal anomalies? It’s not so easy to tell when the metric has short, significant drops. When throughput drops abnormally low and then returns to its original value, the differenced metric has zigzags, which are complicated to inspect. So although differencing takes care of the linear trend, it makes prediction a bit harder. 50 | Chapter 5: Practical Anomaly Detection for Monitoring
Perhaps, instead of differencing, we should try an alternative: multiple exponential smoothing on the original metric. This should cope well with the trend and avoid transforming the metric as differencing does. Figure 5-2. Histogram of residuals from the exponential smoothing control chart on the raw data. Now it’s easy to see throughput drops when the metric falls below the lower control line. It’s much easier to interpret, visually at least. Multiple exponential smoothing is a little more complicated, but produces much better results in this example. It has a trend compo‐ A Worked Example | 51
Page 3 and 4:
Anomaly Detection for Monitoring A
Page 5 and 6:
Table of Contents Foreword. . . . .
Page 7: Foreword Monitoring is currently un
Page 10 and 11: tion” to anomaly detection is imp
Page 12 and 13: Why do we assume these things? Are
Page 14 and 15: Conclusions If you are like most of
Page 17 and 18: CHAPTER 2 A Crash Course in Anomaly
Page 19 and 20: How can you achieve similar results
Page 21 and 22: cause most anomaly detection techni
Page 23 and 24: CHAPTER 3 Modeling and Predicting A
Page 25 and 26: (say, the size of the drill bit), a
Page 27 and 28: lies. To fix this problem, the cont
Page 29 and 30: ally decaying window. This is made
Page 31 and 32: ack again, meaning that they smooth
Page 33 and 34: emains consistent across all of the
Page 35 and 36: Evaluating Predictions One of the m
Page 37 and 38: No. You’ve stumbled into statisti
Page 39: As an aside, there’s a rumor goin
Page 42 and 43: Dealing with Trend Trends break mod
Page 44 and 45: pletely out of phase with the seaso
Page 46 and 47: mon situations. You can probably gu
Page 49 and 50: CHAPTER 5 Practical Anomaly Detecti
Page 51 and 52: If you can get close to that, you m
Page 53 and 54: We previously discussed how frequen
Page 55 and 56: First, observe how odd this metric
Page 57: After differencing, it looks like w
Page 61 and 62: CHAPTER 6 The Broader Landscape As
Page 63 and 64: We could apply a EWMA control chart
Page 65 and 66: figure out how unlikely it was for
Page 67 and 68: predict or find structure in data w
Page 69 and 70: Graphite and RRDTool Graphite and R
Page 71 and 72: APPENDIX A Appendix Code Control Ch
Page 73 and 74: var ma = new movingAverage(0.5); ma
Page 75: Acknowledgments We’d like to than
show all

Anomaly Detection for Monitoring

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?