Real time detection of metric baseline behavior change

A system comprising:

• a processor;
• and
• memory comprising computer executable instructions that, when executed, perform operations comprising:
• generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, wherein generating the reference distance signature comprises:
• generating initial deseasonalized time series information based on the historic time series information;
• determining updated deseasonalized time series information by removing outlier datapoints from the initial deseasonalized time series information;
• determining formatted historic time series information by removing one or more outages;
• and
• generating the reference distance signature based on the formatted historic time series information;
• generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time;
• determining a signature difference by comparing the reference distance signature to the sample distance signature;
• determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold;
• and
• presenting an alert notification identifying the second period of time as the baseline change candidate.

A method comprising:

• a processor;
• and
• memory comprising computer executable instructions that, when executed, perform operations comprising:
• generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time;
• generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, wherein generating the sample distance signature comprises:
• generating initial deseasonalized time series information based on the sample time series information;
• determining updated deseasonalized time series information by removing outlier datapoints from the initial deseasonalized time series information;
• determining formatted sample time series information by scaling the updated deseasonalized time series information;
• and
• generating the sample distance signature based on the formatted sample time series information;
• determining a signature difference by comparing the reference distance signature to the sample distance signature;
• determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold;
• and
• presenting an alert notification identifying the second period of time as the baseline change candidate.

A device comprising:

• a processor;
• and
• memory comprising computer executable instructions that, when executed, perform operations comprising:
• generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, the reference distance signature being generated via a first support vector machine (SVM) model;
• generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, the sample distance signature being generated via a second SVM model;
• determining a signature difference by comparing the reference distance signature to the sample distance signature;
• determining that the second period of time is not a baseline change candidate based on the signature difference being less than a distance threshold;
• and
• providing an indication that the second period of time is not the baseline change candidate.