Detecting anomalies in time series data
AssigneeAmazon Technologies, Inc.
InventorsMichael L. Brundage, Brent Robert Mills
Life of this patent
Estimating the term…
Abstract
Disclosed are various embodiments for detecting anomalies in time series data. At least one anomaly is detected in a time series that is derived from a corresponding metric observed from a computing system. The time series is non-stationary time series or heteroskedastic. The detected anomaly is correlated with at least one of a plurality of external events affecting the computing system. A magnitude is assigned to the detected anomaly. The detected one anomaly, the assigned magnitude, and the correlated at least one external event are reported to a client device.
Claims28
A non-transitory computer-readable medium embodying a program executable in a computing device, the program comprising:
- code that detects a plurality of anomalies in a plurality of time series, individual ones of the time series being derived from metrics observed from a computing system, at least two of the time series differing in time resolution, the individual ones of the time series being at least one of non-stationary or heteroskedastic, the plurality of anomalies being detected by:
- decomposing the individual ones of the time series into a respective smoothed component and a respective noise component;
- identifying any outliers present in the respective noise component;
- identifying any step functions present in the respective smoothed component;
- identifying any changes in variance in a respective one of the time series;
- and
- identifying any changes in density in the respective one of the time series;
- code that partitions the plurality of anomalies according to a time of occurrence;
- code that identifies co-occurring instances of anomalies in the partitioned anomalies;
- code that correlates at least a portion of the plurality of anomalies with at least one of a plurality of external events affecting the computing system;
- code that assigns a magnitude to the co-occurring instances of anomalies;
- and
- code that reports the co-occurring instances of anomalies, the assigned magnitude, and the correlated at least one external event.
A method, comprising:
- detecting, by a computer, at least one anomaly in a time series, the time series derived from a corresponding metric observed in a computing system, the time series being at least one of a non-stationary time series or a heteroskedastic time series, by:
- decomposing the time series into a smoothed component and a noise component;
- identifying any outliers present in the noise component;
- identifying any step functions present in the smoothed component;
- identifying any changes in variance in the time series;
- and
- identifying any changes in density in the time series;
- correlating the detected at least one anomaly with at least one of a plurality of external events affecting the computing system;
- assigning, by the computer, a magnitude to the detected at least one anomaly;
- and
- reporting, by the computer, the detected at least one anomaly, the assigned magnitude, and the correlated at least one external event.
A system, comprising:
- at least one hardware computing device;
- and
- an application implemented in the at least one hardware computing device, the application comprising:
- logic that detects a plurality of anomalies in a plurality of time series, individual ones of the time series derived from a plurality of metrics observed from a computing system, comprising:
- logic that decomposes one of the time series into a smoothed component and a noise component;
- logic that identifies any outliers present in the noise component;
- logic that identifies any step functions present in the smoothed component;
- logic that identifies any changes in variance in the one of the time series;
- and
- logic that identifies any changes in density in the one of the time series;
- logic that correlates at least a portion of the plurality of anomalies with at least one of a plurality of external events affecting the computing system;
- logic that assigns a magnitude to the plurality of anomalies;
- and
- logic that reports the plurality of anomalies, the assigned magnitude, and the correlated at least one external event.
Dependencies are inferred from the claim text.