ANOMALY DETECTION ON TIME SERIES DATA
In a computer-implemented method for anomaly detection on time series data, time series data is accessed. A forecasting algorithm is applied to at least a portion of the time series data to generate a forecast confidence band for a time window following the at least a portion of the time series data. The forecast confidence band for the time window is compared to the time series data of the time window. It is determined whether the time series data includes an anomaly based at least in part on the comparing.
1 . A computer-implemented method for anomaly detection on time series data, the method comprising:
accessing time series data;
applying a forecasting algorithm to at least a portion of the time series data to generate a forecast confidence band for a time window following the at least a portion of the time series data;
comparing the forecast confidence band for the time window to the time series data of the time window; and
determining whether the time series data comprises an anomaly based at least in part on the comparing.
2 . The computer-implemented method of claim 1 , wherein the comparing comprises:
determining a percentage of points of the time series data falling outside the forecast confidence band for the time window.
3 . The computer-implemented method of claim 2 , wherein the determining whether the time series data comprises an anomaly comprises:
determining whether the percentage of points of the time series data falling outside the forecast confidence band for the time window satisfies a threshold percentage; and
provided the percentage of points of the time series data falling outside the forecast confidence band for the time window exceeds the threshold percentage, identifying an anomaly of the time series data for the time window.
4 . The computer-implemented method of claim 1 , wherein the applying the forecasting algorithm to the at least a portion of the time series data is performed for a plurality of portions of the time series data.
5 . The computer-implemented method of claim 4 , wherein the time window following each of the plurality of portions of the time series data has a constant length.
6 . The computer-implemented method of claim 4 , wherein the plurality of portions of the time series data overlap temporally.
7 . The computer-implemented method of claim 1 , further comprising:
receiving a confidence interval for the forecasting algorithm, wherein the forecasting algorithm is applied according to the confidence interval.
8 . The computer-implemented method of claim 7 , further comprising:
receiving a backtesting range of the time series data for forecasting algorithm, wherein the forecasting algorithm is applied according to the confidence interval and the backtesting range.
9 . The computer-implemented method of claim 1 , wherein time series data comprises the times series data of the time window, such that the time series data of the time window is ignored during the applying the forecasting algorithm to the at least a portion of the time series data.
10 . The computer-implemented method of claim 1 , further comprising:
responsive to determining that the times series data comprises an anomaly, generating an alert.
11 . A non-transitory computer readable storage medium having computer readable program code stored thereon for causing a computer system to perform a method for anomaly detection on time series data, the method comprising:
accessing time series data;
applying a forecasting algorithm to a plurality of portions of the time series data to generate a plurality of forecast confidence bands for a time window following the plurality of portions of the time series data, wherein the time window following the plurality of portions of the time series data has a constant length;
comparing the plurality of forecast confidence bands for the time window to the time series data of the time window for the plurality of portions of the time series data; and
determining whether the time series data comprises an anomaly based at least in part on the comparing.
12 . The non-transitory computer readable storage medium of claim 11 , wherein the comparing comprises:
determining a percentage of points of the time series data falling outside the plurality of forecast confidence bands for the time window.
13 . The non-transitory computer readable storage medium of claim 12 , wherein the determining whether the time series data comprises an anomaly comprises:
determining whether the percentage of points of the time series data falling outside the plurality of forecast confidence bands for the time window satisfies a threshold percentage; and
provided the percentage of points of the time series data falling outside the plurality of forecast confidence bands for the time window exceeds the threshold percentage, identifying an anomaly of the time series data.
14 . The non-transitory computer readable storage medium of claim 11 , wherein the plurality of portions of the time series data overlap temporally.
15 . The non-transitory computer readable storage medium of claim 11 , the method further comprising:
receiving a confidence interval for the forecasting algorithm, wherein the forecasting algorithm is applied according to the confidence interval.
16 . The non-transitory computer readable storage medium of claim 15 , further comprising:
receiving a backtesting range of the time series data for forecasting algorithm, wherein the forecasting algorithm is applied according to the confidence interval and the backtesting range.
17 . The non-transitory computer readable storage medium of claim 11 , wherein time series data comprises the times series data of the time window, such that the time series data of the time window is ignored during the applying the forecasting algorithm to the plurality of portions of the time series data.
18 . The non-transitory computer readable storage medium of claim 11 , the method further comprising:
responsive to determining that the times series data comprises an anomaly, generating an alert.
19 . A system for generating a query plan for time series data, the system comprising:
a data storage unit; and
a processor communicatively coupled with the data storage unit, the processor configured to:
access time series data;
receive a confidence interval and a backtesting range for a forecasting algorithm;
apply the forecasting algorithm to at least a portion of the time series data to generate a forecast confidence band for a time window following the at least a portion of the time series data, wherein the forecasting algorithm is applied according to the confidence interval and the backtesting range;
compare the forecast confidence band for the time window to the time series data of the time window by determining a percentage of points of the time series data falling outside the forecast confidence band for the time window; and
determine whether the time series data comprises an anomaly determining whether the percentage of points of the time series data falling outside the forecast confidence band for the time window satisfies a threshold percentage, and, provided the percentage of points of the time series data falling outside the forecast confidence band for the time window exceeds the threshold percentage, identifying an anomaly of the time series data for the time window.
20 . The system of claim 19 , wherein the processor is further configured to:
generate an alert responsive to determining that the times series data comprises an anomaly.