Processing data streams received from instrumented software in real time using incremental-decremental implementation of the KPSS stationarity statistic

A non-transitory computer-readable storage medium comprising instructions executable by a processor, the instructions comprising:

• instructions for receiving a time series comprising a plurality of data values from an instance of instrumented software executing on an external computing system,
• each of the plurality of data values corresponding to a metric describing a characteristic of the computing system that changes over time;
• instructions for storing a statistic value representing a current stationarity of the time series based on data values of the plurality of data values for the time series in a window, the window having a leading value and a trailing value, wherein the statistic value is computed based on normalized partial sums of residual values;
• in response to receiving a most recent value of the plurality of data values in the time series, instructions for:
• assigning the most recent value as the leading value in the window;
• retrieving the trailing value of the window;
• and
• updating the statistic value to add an influence of the most recent value and remove an influence of the trailing value;
• in response to the statistic value being less than a threshold, instructions for determining that the time series is stationary;
• in response to determining that the time series is stationary, instructions for assigning an alert for a stationary data stream to the metric;
• and
• instructions for detecting an anomaly in the metric based on the assigned alert,
• wherein the statistic value represents a normalized series of partial sums of residual values in a series of residual values, the residual values is a difference of the mean and each data value of the time series, and each partial sum of the series of partial sums is a summation of a corresponding residual value and residual values that occur before the corresponding residual value in the series of residual values.

A computer system comprising:

• a computer processor;
• and
• a non-transitory computer-readable storage medium storage instructions that when executed by the computer processor perform actions comprising:
• receiving a time series comprising a plurality of data values from an instance of instrumented software executing on an external computing system, each of the plurality of data values corresponding to a metric describing a characteristic of the computing system that changes over time;
• storing a statistic value representing a current stationarity of the time series based on data values of the plurality of data values for the time series in a window, the window having a leading value and a trailing value, wherein the statistic value is computed based on normalized partial sums of residual values;
• in response to receiving a most recent value of the plurality of data values in the time series:
• assigning the most recent value as the leading value in the window;
• retrieving the trailing value of the window;
• and
• updating the statistic value to add an influence of the most recent value and remove an influence of the trailing value;
• in response to the statistic value being less than a threshold, determining that the time series is stationary;
• in response to determining that the time series is stationary, assigning an alert for a stationary data stream to the metric;
• and
• detecting an anomaly in the metric based on the assigned alert,
• wherein the statistic value represents a normalized series of partial sums of residual values in a series of residual values, the residual values is a difference of the mean and each data value of the time series, and each partial sum of the series of partial sums is a summation of a corresponding residual value and residual values that occur before the corresponding residual value in the series of residual values.