Method and System for Detecting Anomalies in Web Analytics Data

• US 20110119226A1
• Filed: 10/19/2010
• Published: 05/19/2011
• Est. Priority Date: 10/20/2009
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Van Der Molen, Douglas, Ruhl, Jan Matthias, Mui, Lik, Moon, Hui Sok, Tulsi, Japjit
• Granted Patent: US 8,583,584 B2
• Time in Patent Office: Days
• US Class Current: 706/52
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06N 5/048 Fuzzy inferencing

Abstract

A server system stores web analytics data for a web page in a device. The web analytics data comprises a plurality of prior time-value pairs, each pair including a value of an attribute associated with the web page and a time associated with the value. For a particular attribute, the server system collects a new time-value pair including a new value associated with the web page and a new time indicating when the value was determined. The server system estimates a predicted value for the attribute and an associated error-variance at the new time by applying a forecasting model to the prior time-value pairs in respective subsets of the web analytics data. The collected new time-value pair is tagged if its value is outside the error variance of the predicted value for the particular attribute.

Claims

1. A computer-implemented method for identifying events of interest in web analytics data, comprising:

storing web analytics data for a web page in a device, wherein the web analytics data comprises a plurality of prior time-value pairs, each time-value pair including a value of one of a plurality of attributes associated with the web page and a time associated with the value;

collecting a new time-value pair for the particular attribute, the new time-value pair including a new value associated with the web page and a new time when the value was determined;

estimating a predicted value for the attribute and associated error-variance at the new time for the predicted value by applying a forecasting model to the plurality of prior time-value pairs in respective subsets of the web analytics data; and

tagging the collected new time-value pair if the value of the new time-value pair is outside the error variance of the predicted value of the forecasting model for the particular attribute.

2. The computer-implemented method of claim 1, further comprising:

adding to the collected web analytics data for the web page the new time-value pair including a tag indicating whether the new value is an anomaly and a significance factor if the new value is an anomaly.

3. The computer-implemented method of claim 1, further comprising:

storing the web analytics data for a fixed time window into the past;

deleting one or more oldest time-value pairs from previously collected time series data after estimating the predicted value and the associated error-variances; and

appending the new time-value pair to the end of the collected web analytics data.

4. The computer-implemented method of claim 1, wherein the attributes comprise a plurality of metrics and dimensions associated with the web site.

5. The computer-implemented method of claim 1, further comprising:

for the respective time-value pair and the particular attribute, determining a significance factor such that, when the error-variance is multiplied by the significance factor, the value of the time-value pair is inside the factored error-variance of the predicted value; and

in response to the request from the client application for analytics information, the request including a significance threshold for one or more of the attributes, reporting to the client application those tagged time-value pairs if the significance factor for each of the time-value pairs exceeds the significance threshold.

6. The computer-implemented method of claim 1, wherein the forecasting model is selected from a plurality of forecasting models that include at least one of a linear regression model and a Holt-Winters exponential smoothing model.

7. The computer-implemented method of claim 1, wherein the web analytics data includes aggregated web analytics data, the computer-implemented method further comprising:

aggregating raw or sessionized web traffic data to generate the aggregated web analytics data for attributes of interest and storing the aggregated web analytics data in addition to the raw or sessionized web traffic data.

25. The method of claim 1, wherein:

estimating a predicted value for the attribute comprises estimating a set of predicted values for the attribute and associated error-variances at the new time for the predicted values by applying a plurality of forecasting models to the plurality of prior time-value pairs in respective subsets of the web analytics data; and

tagging the collected new time-value pair comprises tagging the collected new time-value pair if the value of the new time-value pair is outside the error variance of each of a first subset of the predicted values of the forecasting models for the particular attribute.

8. A server system for identifying anomalies in web analytics data, wherein the server system is connected to one or more client devices through a network, comprising:

one or more processors for executing programs; and

memory to store data and to store one or more programs to be executed by the one or more processors, the one or more programs including instructions for;

storing web analytics data for a web page in a device, wherein the web analytics data comprises a plurality of prior time-value pairs, each time-value pair including a value of one of a plurality of attributes associated with the web page and a time associated with the value;

collecting a new time-value pair for the particular attribute, the new time-value pair including a new value associated with the web page and a new time when the value was determined;

estimating a predicted value for the attribute and associated error-variance at the new time for the predicted value by applying a forecasting model to the plurality of prior time-value pairs in respective subsets of the web analytics data; and

tagging the collected new time-value pair if the value of the new time-value pair is outside the error variance of the predicted value of the forecasting model for the particular attribute.

9. The server system of claim 8, further comprising instructions for:

adding to the collected web analytics data for the web page the new time-value pair including a tag indicating whether the new value is an anomaly and a significance factor if the new value is an anomaly.

10. The server system of claim 8, further comprising instructions for:

storing the web analytics data for a fixed time window into the past;

deleting one or more oldest time-value pairs from previously collected time series data after estimating the predicted value and the associated error-variances; and

appending the new time-value pair to the end of the collected web analytics data.

11. The server system of claim 8, wherein the attributes comprise a plurality of metrics and dimensions associated with the web site.

12. The server system of claim 8, further comprising instructions for:

for the respective time-value pair and the particular attribute, determining a significance factor such that, when the error-variance is multiplied by the significance factor, the value of the time-value pair is inside the factored error-variance of the predicted value; and

in response to the request from the client application for analytics information, the request including a significance threshold for one or more of the attributes, reporting to the client application those tagged time-value pairs if the significance factor for each of the time-value pairs exceeds the significance threshold.

13. The server system of claim 8, wherein the forecasting model is selected from a plurality of forecasting models that include at least one of a linear regression model and a Holt-Winters exponential smoothing model.

14. A computer readable-storage medium storing one or more programs for execution by one or more processors, the one or more programs comprising instructions for:

storing web analytics data for a web page in a device, wherein the web analytics data comprises a plurality of prior time-value pairs, each time-value pair including a value of one of a plurality of attributes associated with the web page and a time associated with the value;

collecting a new time-value pair for the particular attribute, the new time-value pair including a new value associated with the web page and a new time when the value was determined;

estimating a predicted value for the attribute and associated error-variance at the new time for the predicted value by applying a forecasting model to the plurality of prior time-value pairs in respective subsets of the web analytics data; and

tagging the collected new time-value pair if the value of the new time-value pair is outside the error variance of the predicted value of the forecasting model for the particular attribute.

15. The computer readable-storage medium of claim 14, further comprising instructions for:

adding to the collected web analytics data for the web page the new time-value pair including a tag indicating whether the new value is an anomaly and a significance factor if the new value is an anomaly.

16. The computer readable-storage medium of claim 14, further comprising instructions for:

storing the web analytics data for a fixed time window into the past;

deleting one or more oldest time-value pairs from previously collected time series data after estimating the predicted value and the associated error-variances; and

appending the new time-value pair to the end of the collected web analytics data.

17. The computer readable-storage medium of claim 14, further comprising instructions for:

for the respective time-value pair and the particular attribute, determining a significance factor such that, when the error-variance is multiplied by the significance factor, the value of the time-value pair is inside the factored error-variance of the predicted value; and

in response to the request from the client application for analytics information, the request including a significance threshold for one or more of the attributes, reporting to the client application those tagged time-value pairs if the significance factor for each of the time-value pairs exceeds the significance threshold.

18. The computer readable-storage medium of claim 14, wherein the forecasting model is selected from a plurality of forecasting models that include at least one of a linear regression model and a Holt-Winters exponential smoothing model.

19. A computer-implemented method for identifying events in web analytics data, comprising:

storing web analytics data for a web page in a device, wherein the web analytics data comprises a plurality of prior time-value pairs, each time-value pair including a value of one of a plurality of attributes associated with the web page and a time associated with the value;

collecting a new time-value pair for a particular attribute, the new time-value pair including a new value associated with the web page and a new time when the value was determined;

estimating a predicted value for the attribute at the new time by applying a forecasting model to the plurality of prior time-value pairs in a respective subset of the web analytics data;

tagging the collected new time-value pair as an event of potential interest when a difference between the value of the new time-value pair and the predicted value at the new time meets a predefined condition; and

generating an alert for the event of potential interest when an alert condition based on the value of the new time-value pair is satisfied.

20. The method of claim 19, further comprising:

estimating an error variance associated with the predicted value using the forecasting model, such that the predefined condition comprises the value of the new time-value pair being outside the error variance associated with the predicted value.

21. The method of claim 20, further comprising:

receiving the alert condition from a web analytics client, wherein the alert condition is defined by a user of the web analytics client.

22. The method of claim 21, further comprising:

issuing the alert to the web analytics client.

23. The method of claim 20, wherein the alert condition is one of the value of the new time-value pair exceeding or falling below a first predefined value or a difference between the value of the new time-value pair and the value of a prior time-value pair exceeding or falling below a second predefined value.

24. The method of claim 19, further comprising:

receiving the web analytics data from a web server hosting the web page.

26. The method of claim 19, wherein:

estimating a predicted value for the attribute comprises estimating a set of predicted values for the attribute and associated error-variances at the new time for the predicted values by applying a plurality of forecasting models to the plurality of prior time-value pairs in respective subsets of the web analytics data; and

tagging the collected new time-value pair comprises tagging the collected new time-value pair if the value of the new time-value pair is outside the error variance of each of a first subset of the predicted values of the forecasting models for the particular attribute.