Method and system for using web analytics data for detecting anomalies

• US 8,583,584 B2
• Filed: 10/19/2010
• Issued: 11/12/2013
• Est. Priority Date: 10/20/2009
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Ruhl, Jan Matthias, Moon, Hui Sok, Mui, Lik, Tulsi, Japjit, Van der Molen, Douglas
• Primary Examiner(s): Chen, Alan
• Assistant Examiner(s): Smith, Paulinho E
• Application Number:
  US12/907,928
• Publication Number:
  US 20110119226A1
• Time in Patent Office: 1,120 Days
• Field of Search: None
• US Class Current: 706/52
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06N 5/048 Fuzzy inferencing

Abstract

A server system stores web analytics data for a web page in a device. The web analytics data comprises a plurality of prior time-value pairs, each pair including a value of an attribute associated with the web page and a time associated with the value. For a particular attribute, the server system collects a new time-value pair including a new value associated with the web page and a new time indicating when the value was determined. The server system estimates a predicted value for the attribute and an associated error-variance at the new time by applying a forecasting model to the prior time-value pairs in respective subsets of the web analytics data. The collected new time-value pair is tagged if its value is outside the error variance of the predicted value for the particular attribute.

Claims

1. A computer-implemented method for identifying events of interest in web analytics data, comprising:

at a computer server having one or more processors and memory for storing programs to be executed by the one or more processors;

storing web analytics data for a web page in a device, wherein the web analytics data comprises a plurality of prior time-value pairs, each time-value pair including a value of one of a plurality of attributes associated with the web page and a time associated with the value;

collecting a new time-value pair for the particular attribute, the new time-value pair including a new value associated with the web page and a new time when the value was determined;

estimating a predicted value for the attribute and associated error-variance at the new time for the predicted value by applying a forecasting model to the plurality of prior time-value pairs in respective subsets of the web analytics data; and

tagging the collected new time-value pair if the value of the new time-value pair is outside the error variance of the predicted value of the forecasting model for the particular attribute;

adding to the collected web analytics data for the web page the new time-value pair including a tag indicating whether the new value is an anomaly and a significance factor if the new value is an anomaly, wherein the significance factor is associated with the error variance of the predicted value of the forecasting model;

for the new time-value pair and the particular attribute, determining the significance factor such that, when the error-variance is multiplied by the significance factor, the value of the time-value pair is inside the factored error-variance of the predicted value; and

in response to a request from a client application for analytics information, the request including a significance threshold for one or more of the attributes, reporting to the client application the new time-value pair if the significance factor for the time-value pair exceeds the significance threshold.

2. The computer-implemented method of claim 1, further comprising:

storing the web analytics data for a fixed time window into the past;

deleting one or more oldest time-value pairs from previously collected time series data after estimating the predicted value and the associated error-variances; and

appending the new time-value pair to the end of the collected web analytics data.

3. The computer-implemented method of claim 1, wherein the attributes comprise a plurality of metrics and dimensions associated with the web site.

4. The computer-implemented method of claim 1, wherein the forecasting model is selected from a plurality of forecasting models that include at least one of a linear regression model and a Holt-Winters exponential smoothing model.

5. The computer-implemented method of claim 1, wherein the web analytics data includes aggregated web analytics data, the computer-implemented method further comprising:

aggregating raw or sessionized web traffic data to generate the aggregated web analytics data for attributes of interest and storing the aggregated web analytics data in addition to the raw or sessionized web traffic data.

20. The method of claim 1, wherein:

estimating a predicted value for the attribute comprises estimating a set of predicted values for the attribute and associated error-variances at the new time for the predicted values by applying a plurality of forecasting models to the plurality of prior time-value pairs in respective subsets of the web analytics data; and

tagging the collected new time-value pair comprises tagging the collected new time value pair if the value of the new time-value pair is outside the error variance of each of a first subset of the predicted values of the forecasting models for the particular attribute.

6. A server system for identifying anomalies in web analytics data, wherein the server system is connected to one or more client devices through a network, comprising:

one or more processors for executing programs; and

memory to store data and to store one or more programs to be executed by the one or more processors, the one or more programs including instructions for;

storing web analytics data for a web page in a device, wherein the web analytics data comprises a plurality of prior time-value pairs, each time-value pair including a value of one of a plurality of attributes associated with the web page and a time associated with the value;

collecting a new time-value pair for the particular attribute, the new time-value pair including a new value associated with the web page and a new time when the value was determined;

estimating a predicted value for the attribute and associated error-variance at the new time for the predicted value by applying a forecasting model to the plurality of prior time-value pairs in respective subsets of the web analytics data;

tagging the collected new time-value pair if the value of the new time-value pair is outside the error variance of the predicted value of the forecasting model for the particular attribute;

adding to the collected web analytics data for the web page the new time-value pair including a tag indicating whether the new value is an anomaly and a significance factor if the new value is an anomaly, wherein the significance factor is associated with the error variance of the predicted value of the forecasting model;

for the new time-value pair and the particular attribute, determining the significance factor such that, when the error-variance is multiplied by the significance factor, the value of the time-value pair is inside the factored error-variance of the predicted value; and

in response to a request from a client application for analytics information, the request including a significance threshold for one or more of the attributes, reporting to the client application the new time-value pair if the significance factor for the time-value pair exceeds the significance threshold.

7. The server system of claim 6, further comprising instructions for:

storing the web analytics data for a fixed time window into the past;

deleting one or more oldest time-value pairs from previously collected time series data after estimating the predicted value and the associated error-variances; and

appending the new time-value pair to the end of the collected web analytics data.

8. The server system of claim 6, wherein the attributes comprise a plurality of metrics and dimensions associated with the web site.

9. The server system of claim 6, wherein the forecasting model is selected from a plurality of forecasting models that include at least one of a linear regression model and a Holt-Winters exponential smoothing model.

10. A non-transitory computer readable-storage medium storing one or more programs for execution by one or more processors, the one or more programs comprising instructions for:

storing web analytics data for a web page in a device, wherein the web analytics data comprises a plurality of prior time-value pairs, each time-value pair including a value of one of a plurality of attributes associated with the web page and a time associated with the value;

collecting a new time-value pair for the particular attribute, the new time-value pair including a new value associated with the web page and a new time when the value was determined;

estimating a predicted value for the attribute and associated error-variance at the new time for the predicted value by applying a forecasting model to the plurality of prior time value pairs in respective subsets of the web analytics data; and

tagging the collected new time-value pair if the value of the new time-value pair is outside the error variance of the predicted value of the forecasting model for the particular attribute;

adding to the collected web analytics data for the web page the new time-value pair including a tag indicating whether the new value is an anomaly and a significance factor if the new value is an anomaly, wherein the significance factor is associated with the error variance of the predicted value of the forecasting model

for the new time-value pair and the particular attribute, determining the significance factor such that, when the error-variance is multiplied by the significance factor, the value of the time-value pair is inside the factored error-variance of the predicted value; and

in response to a request from a client application for analytics information, the request including a significance threshold for one or more of the attributes, reporting to the client application the new time-value pair if the significance factor for the time-value pair exceeds the significance threshold.

11. The non-transitory computer readable-storage medium of claim 10, further comprising instructions for:

storing the web analytics data for a fixed time window into the past;

deleting one or more oldest time-value pairs from previously collected time series data after estimating the predicted value and the associated error-variances; and

appending the new time-value pair to the end of the collected web analytics data.

12. The non-transitory computer readable-storage medium of claim 10, further comprising instructions for:

for the new time-value pair and the particular attribute, determining the significance factor such that, when the error-variance is multiplied by the significance factor, the value of the time-value pair is inside the factored error-variance of the predicted value; and

in response to a request from a client application for analytics information, the request including a significance threshold for one or more of the attributes, reporting to the client application new time-value pair if the significance factor for the time-value pairs exceeds the significance threshold.

13. The non-transitory computer readable-storage medium of claim 10, wherein the forecasting model is selected from a plurality of forecasting models that include at least one of a linear regression model and a Holt-Winters exponential smoothing model.

14. A computer-implemented method for identifying events in web analytics data, comprising:

at a computer server having one or more processors and memory for storing programs to be executed by the one or more processors;

storing web analytics data for a web page in a device, wherein the web analytics data comprises a plurality of prior time-value pairs, each time-value pair including a value of one of a plurality of attributes associated with the web page and a time associated with the value;

collecting a new time-value pair for a particular attribute, the new time-value pair including a new value associated with the web page and a new time when the value was determined;

estimating a predicted value for the attribute at the new time by applying a forecasting model to the plurality of prior time-value pairs in a respective subset of the web analytics data;

tagging the collected new time-value pair as an event of potential interest when a difference between the value of the new time-value pair and the predicted value at the new time meets a predefined condition, wherein the predefined condition comprises the value of the new time-value pair being outside a range centered at the predicted value and the range is determined, at least in part, by a significance factor associated with the forecasting model; and

generating an alert for the event of potential interest when an alert condition based on the value of the new time-value pair is satisfied.

15. The method of claim 14, further comprising:

estimating an error variance using the forecasting model, such that the predefined condition comprises the value of the new time-value pair being outside the error variance associated with the predicted value multiplied by the significance factor.

16. The method of claim 15, further comprising:

receiving the alert condition from a web analytics client, wherein the alert condition is defined by a user of the web analytics client.

17. The method of claim 16, further comprising:

issuing the alert to the web analytics client.

18. The method of claim 15, wherein the alert condition is one of the value of the new time-value pair exceeding or falling below a first predefined value or a difference between the value of the new time-value pair and the value of a prior time-value pair exceeding or falling below a second predefined value.

19. The method of claim 14, further comprising:

receiving the web analytics data from a web server hosting the web page.

21. The method of claim 14, wherein:

estimating a predicted value for the attribute comprises estimating a set of predicted values for the attribute and associated error-variances at the new time for the predicted values by applying a plurality of forecasting models to the plurality of prior time-value pairs in respective subsets of the web analytics data; and

tagging the collected new time-value pair comprises tagging the collected new time value pair if the value of the new time-value pair is outside the error variance of each of a first subset of the predicted values of the forecasting models for the particular attribute.