I'm looking for an algorithm that can help identify abnormal trends in timeseries metrics. We offer several services which we monitor active usage against, for any given time of day (typically updated once a minute). Here's a example of one of our services: Service-A

We do have systems in place like Nagios to detect major issues. But what I'm more interested in is gradual degradation that doesn't get noticed until ... well, it gets noticed. For example, if we zoom in to 12/6 we see: enter image description here

So what I'm specifically interested in here is the trend downward @17:30~. Likewise another good example would be: enter image description here

Here we can see the abnormalities on 12/1 and 12/4 during peak. Are there any formal methods of detecting this sort of trend (or rather, abnormaility to a historical trend)? Specifically interested in the trend here, not the raw numbers. So for example, these services have a hisotrical decreasing usage as time goes on - eventually, these numbers will drop from say 60k peaks to 15k peaks.


One approach would be to fit a regression model and examine points where the observed values depart from predicted values.

A common regression model for time series data with strong periodicity is ARIMA. Given high degree of granularity in your time variable, I suspect an ARIMA model would work very well.

These models have been implemented in most statistical packages. Here's an example using R:

# load necessary package

# display example data

# fit arima model
fit <- arima(USAccDeaths, order = c(1,0,1), seasonal = list(order = c(1,0,1)))

# overlay fit
lines(USAccDeaths - fit$residuals, col='blue')

# isolate observations with extreme residuals
extreme_indices <- which(fit$residuals>quantile(fit$residuals, .9) | fit$residuals<quantile(fit$residuals, .1))
extremes <- USAccDeaths
extremes[-extreme_indices] <- NA

# overlay isolated observations
points(extremes, col='red')

This produces the following graph, with unexpected observations highlighted in red:

example graph


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.