Anomaly Detection for Monitoring

Chapter 4. Dealing with Trends and Seasonality

Trends and seasonality are two characteristics of time series metrics that break many models. In fact, they’re one of two major reasons why static thresholds break (the other is because systems are all different from each other). Trends are continuous increases or decreases in a metric’s value. Seasonality, on the other hand, reflects periodic (cyclical) patterns that occur in a system, usually rising above a baseline and then decreasing again. Common seasonal periods are hourly, daily, and weekly, but your systems may have a seasonal period that’s much longer or even some combination of different periods.

Another way to think about the effects of seasonality and trend is that they make it important to consider whether an anomaly is local or global. A local anomaly, for example, could be a spike during an idle period. It would not register as anomalously high overall, because it is still much lower than unusually high values during busy times. A global anomaly, in contrast, would be anomalously high (or low) no matter when it occurs. The goal is to be able to detect both kinds of anomalies. Clearly, static thresholds can only detect global anomalies when there’s seasonality or trend. Detecting local anomalies requires coping with these effects.

Many time series models, like the ARIMA family of models, have properties that handle trend. These models can also accomodate seasonality, with slight extensions.

Dealing with Trend

Trends ...