Robust forecasting techniques with reduced sensitivity to anomalous data
First Claim
Patent Images
1. A system for monitoring a monitored computer system, the monitoring system comprising:
- a computer data repository that stores a first plurality of seasonality factors for a first time t from prior seasons for the monitored computer system and a second plurality of seasonality factors for a second time t+x from prior seasons for the monitored computer system, where x is a forecast time horizon; and
a processor programmed, via executable program code, to at least;
determine a first seasonal adjustment factor for the first time t based at least in part on the first plurality of seasonality factors;
deseasonalize an observation y(t) of a metric of the monitored computer system at the first time t based at least in part on the first seasonal adjustment factor;
determine a level component based at least in part on the deseasonalized observation of the monitored computer system;
determine a second seasonal adjustment factor for the second time t+x based at least in part on the second plurality of seasonality factors; and
compute a first forecast F1(t+x) based at least in part on the level component and the second seasonal adjustment factor for the second time t+x, wherein the first forecast F1(t+x) is considered in determining a computed forecast F(t+x) for the metric of the monitored computer system.
0 Assignments
0 Petitions
Accused Products
Abstract
Robust forecasting techniques are relatively immune from anomalies or outliers in observed data, such as a stream of data values reflective of the operation or use of a computer system. One robust technique provides a relatively accurate forecast of seasonal behavior even in the presence of an anomaly in corresponding historical data. Another robust forecasting technique provides a relatively accurate forecast even in the presence of an anomaly that spans multiple recent observations. In one embodiment, both techniques are used in combination to automatically detect anomalies in the operation and/or use of a multi-user computer system.
-
Citations
26 Claims
-
1. A system for monitoring a monitored computer system, the monitoring system comprising:
-
a computer data repository that stores a first plurality of seasonality factors for a first time t from prior seasons for the monitored computer system and a second plurality of seasonality factors for a second time t+x from prior seasons for the monitored computer system, where x is a forecast time horizon; and a processor programmed, via executable program code, to at least; determine a first seasonal adjustment factor for the first time t based at least in part on the first plurality of seasonality factors; deseasonalize an observation y(t) of a metric of the monitored computer system at the first time t based at least in part on the first seasonal adjustment factor; determine a level component based at least in part on the deseasonalized observation of the monitored computer system; determine a second seasonal adjustment factor for the second time t+x based at least in part on the second plurality of seasonality factors; and compute a first forecast F1(t+x) based at least in part on the level component and the second seasonal adjustment factor for the second time t+x, wherein the first forecast F1(t+x) is considered in determining a computed forecast F(t+x) for the metric of the monitored computer system. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20)
-
-
21. A system for monitoring a monitored computer system, the monitoring system comprising:
-
a data repository configured to store observation data for a metric of the monitored computer system; and computer hardware configured to execute an anomaly detection engine, the anomaly detection engine comprising; a forecasting component configured to determine a forecast for a time t+x from a time t of the metric of the monitored computer system, where x is a forecast time horizon, the forecasting component configured to; compute, based at least in part on the stored observation data, a seasonal adjustment factor for the time t+x and a seasonal adjustment factor for the time t, wherein at least one of the computed seasonal adjustment factors is computed from a plurality of seasonality factors such that the at least one computed seasonal adjustment factor is representative of a normal operating condition of the monitored computer system; and determine the forecast based at least in part on at least one of the computed seasonal adjustment factors. - View Dependent Claims (22, 23)
-
-
24. A system for monitoring a monitored computer system, the monitoring system comprising:
-
a data repository configured to store observation data for a metric of the monitored computer system; and computer hardware configured to execute an anomaly detection engine, the anomaly detection engine comprising; a forecasting component configured to determine a forecast for a time t+x from a time t of the metric of the monitored computer system, where x is a forecast time horizon, the forecasting component configured to; generate a plurality of individual forecasts of the metric of the monitored computer system for the time t+x, where each of the plurality of individual forecasts is based on observation data ending earlier in time than the time t; and compute the forecast for the time t+x based at least in part on the plurality of individual forecasts; and an anomaly detection component configured to; determine the presence of an anomaly in the metric of the monitored computer system based at least in part on one or more of;
(1) the observation data, (2) the forecast for the time t+x, and (3) an expected range of observations of the metric of the monitored computer system, the expected range at least partially based on the computed forecast for the time t+x; andgenerate an alert or initiate a corrective action at least partially in response to the determined presence of an anomaly in the monitored computer system. - View Dependent Claims (25, 26)
-
Specification