Machine learning time series anomaly detection

A computer-implemented method comprising:

• receiving, by data processing hardware, a time series anomaly detection query from a user, the time series anomaly detection query requesting the data processing hardware to determine one or more anomalies in a set of time series data values;
• training, by the data processing hardware, a chain of two or more models using each time series data value in the set of time series data values, wherein the two or more models includes a separate model for each component from a plurality of components to improve scalability by at least:
• training, by the data processing hardware, a first model of the chain to determine a holiday effect component for the set of time series data values;
• removing, by the data processing hardware, the holiday effect component from the time series data values to generate first intermediate data;
• training, by the data processing hardware, an outlier model of the chain using the first intermediate data to determine an outlier component
• removing, by the data processing hardware, the outlier component from the first intermediate data to generate second intermediate data;
• and
• training, by the data processing hardware, a second model of the chain using the second intermediate data to determine a seasonal component and a trend component;
• and
• for each respective time series data value in the set of time series data values:
• determining, by the data processing hardware and using the chain of two or more models, an expected data value for the respective time series data value by at least:
• decomposing, using the chain of two or more models, the respective time series data value into the plurality of components, wherein each model from the chain of two or more models generates one component of the plurality of components;
• and
• aggregating two or more components of the plurality of components into the expected data value by summing at least the trend component, the holiday effect component, and the seasonal component;
• determining, by the data processing hardware, a difference between the expected data value for the respective time series data value and the respective time series data value;
• determining, by the data processing hardware, whether the difference between the expected data value for the respective time series data value and the respective time series data value satisfies a threshold;
• in response to determining that the difference between the expected data value for the respective time series data value and the respective time series data value satisfies the threshold, determining, by the data processing hardware, that the respective time series data value is anomalous;
• and
• reporting, by the data processing hardware, the respective time series data value to the user.