Extracting seasonal, level, and spike components from a time series of metrics data
Certain embodiments involve extracting seasonal, level, and spike components from a time series of metrics data, which describe interactions with an online service over a time period. For example, an analytical system decomposes the time series into latent components that include a seasonal component series, a level component series, a spike component series, and an error component series. The decomposition involves configuring an optimization algorithm with a constraint indicating that the time series is a sum of these latent components. The decomposition also involves executing the optimization algorithm to minimize an objective function subject to the constraint and identifying, from the executed optimization algorithm, the seasonal component series, the level component series, the spike component series, and the error component series that minimize the objective function. The analytical system outputs at least some latent components for anomaly-detection or data-forecasting.
1. A method, comprising:
accessing, by a processing device, a time series having metrics data describing interactions with an online service over a time period;
decomposing, by the processing device, the time series into latent components comprising a seasonal component series, a level component series, a spike component series, and an error component series, wherein decomposing the time series comprises:
configuring an optimization algorithm with a constraint indicating that the time series is a sum of the seasonal component series, the level component series, the spike component series, and the error component series,
executing the optimization algorithm to minimize an objective function subject to the constraint, and
identifying, from the executed optimization algorithm, the seasonal component series, the level component series, the spike component series, and the error component series that minimize the objective function; and
performing, by the processing device, an anomaly-detection operation using at least two of the latent components to generate an anomaly output, wherein the anomaly-detection operation includes using a first component of the at least two of the latent components to analyze a second component of the at least two of the latent components; and
causing, by the processing device, a display device to render a graphical user interface that includes the anomaly output.
2. The method of claim 1 , wherein the objective function is a sum of a seasonal term computed from the seasonal component series, a level term computed from the level component series, and a spike term computed from the spike component series.
3. The method of claim 2 , wherein:
the seasonal term is computed by calculating an L1-norm of a frequency transformation of the seasonal component series,
the level term is computed by calculating an L1-norm of a vector populated with differences between adjacent pairs of level values in the level component series, and
the spike term is computed by calculating an L1-norm of the spike component series.
4. The method of claim 2 , wherein decomposing the time series further comprises configuring the optimization algorithm with a level weight indicating a contribution of the level component series to the time series and a spike weight indicating a contribution of the spike component series to the time series, wherein the level weight is applied to the level term and the spike weight is applied to the spike term.
5. The method of claim 1 , wherein the anomaly-detection operation comprises:
computing error-bound pairs from the error component series, each error-bound pair corresponding to a respective index from the error component series;
identifying a subset of spike values, wherein each spike value in the subset of spike values is identified based on the spike value being outside a range of spike values bounded by a respective error-bound pair having a common index with respect to the spike value; and
outputting the identified subset of spike values as an anomaly set.
6. The method of claim 5 , wherein computing the error-bound pairs comprises:
fitting the error component series to an auto-regressive moving average model;
computing a set of variances from the auto-regressive moving average model; and
calculating the error-bound pairs from the set of variances.
7. The method of claim 1 , further comprising performing a data-forecasting operation comprising computing a predicted metrics time series over a subsequent time period, the data-forecasting operation comprising:
computing a predicted seasonal component series based on one or more frequency components of the seasonal component series;
setting values of a predicted level component series to a level value selected from the level component series; and
combining the predicted seasonal component series and the predicted level component series into the predicted metrics time series.
8. The method of claim 7 , wherein the data-forecasting operation further comprises computing a predicted error component series based on an auto-regressive moving average model to which the error component series is fitted and combining the predicted error component series with the predicted seasonal component series and the predicted level component series into the predicted metrics time series.
9. The method of claim 1 , further comprising outputting, by the processing device, a graphical interface having visualisation graphics depicting one or more of the seasonal component series, the level component series, and the spike component series.
10. The method of claim 1 , further comprising configuring the optimization algorithm with an error constraint providing an upper bound on an energy of the error component series.
11. A system comprising:
a memory component;
a processing device coupled to the memory component, the processor configured to execute computer-readable instructions stored in the memory component to cause the system to perform operations comprising:
accessing a time series having metrics data describing interactions with an online service over a time period;
decomposing the time series into latent components comprising a seasonal component series, a level component series, a spike component series, and an error component series, wherein decomposing the time series comprises:
configuring an optimization algorithm with a constraint indicating that the time series is a sum of the seasonal component series, the level component series, the spike component series, and the error component series,
executing the optimization algorithm to minimize an objective function subject to the constraint, and
identifying, from the executed optimization algorithm, the seasonal component series, the level component series, the spike component series, and the error component series that minimize the objective function;
performing an anomaly-detection operation using at least two of the latent components to generate an anomaly output, wherein the anomaly-detection operation includes using a first component of the at least two of the latent components to analyze a second component of the at least two of the latent components; and
causing, by the processing device, a display device to render a graphical user interface that includes the anomaly output.
12. The system of claim 11 , wherein the objective function is a sum of a seasonal term computed from the seasonal component series, a level term computed from the level component series, and a spike term computed from the spike component series,
wherein the operations further comprise configuring the optimization algorithm with an error constraint providing an upper bound on an energy of the error component series.
13. The system of claim 12 , wherein:
the seasonal term is computed by calculating an L1-norm of a frequency transformation of the seasonal component series,
the level term is computed by calculating an L1-norm of a vector populated with differences between adjacent pairs of level values in the level component series, and
the spike term is computed by calculating an L1-norm of the spike component series.
14. The system of claim 12 , wherein decomposing the time series further comprises configuring the optimization algorithm with a level weight indicating a contribution of the level component series to the time series and a spike weight indicating a contribution of the spike component series to the time series, wherein the level weight is applied to the level term and the spike weight is applied to the spike term.
15. The system of claim 11 , wherein the anomaly-detection operation comprises:
computing error-bound pairs from the error component series, each error-bound pair corresponding to a respective index from the error component series, wherein computing the error-bound pairs comprises:
fitting the error component series to an auto-regressive moving average model;
computing a set of variances from the auto-regressive moving average model; and
calculating the error-bound pairs from the set of variances;
identifying a subset of spike values, wherein each spike value in the subset of spike values is identified based on the spike value being outside a range of spike values bounded by a respective error-bound pair having a common index with respect to the spike value; and
outputting the identified subset of spike values as an anomaly set.
16. The system of claim 11 , the operations further comprising performing a data-forecasting operation comprising computing a predicted metrics time series over a subsequent time period, the data-forecasting operation comprising:
computing a predicted seasonal component series based on one or more frequency components of the seasonal component series;
setting values of a predicted level component series to a level value selected from the level component series; and
combining the predicted seasonal component series and the predicted level component series into the predicted metrics time series.
17. A non-transitory computer-readable medium storing computer-readable instructions, that when executed by a processing device, cause the processing device to perform operations, the operations comprising:
accessing a time series having metrics data describing interactions with an online service over a time period;
decomposing the time series into latent components comprising a seasonal component series, a level component series, a spike component series, and an error component series, wherein decomposing the time series comprises:
configuring an optimization algorithm with a constraint indicating that the time series is a sum of the seasonal component series, the level component series, the spike component series, and the error component series,
a step for executing the optimization algorithm to minimize an objective function subject to the constraint, and
a step for identifying, from the executed optimization algorithm, the seasonal component series, the level component series, the spike component series, and the error component series that minimize the objective function;
a step for performing an anomaly-detection operation using at least two of the latent components to generate an anomaly output, wherein the anomaly-detection operation includes using a first component of the at least two of the latent components to analyze a second component of the at least two of the latent components; and
a step for causing a display device to render a graphical user interface that includes the anomaly output.
18. The non-transitory computer-readable medium of claim 17 , wherein:
the objective function is a sum of a seasonal term computed from the seasonal component series, a level term computed from the level component series, and a spike term computed from the spike component series,
the seasonal term is computed by calculating an L1-norm of a frequency transformation of the seasonal component series,
the level term is computed by calculating an L1-norm of a vector populated with differences between adjacent pairs of level values in the level component series, and
the spike term is computed by calculating an L1-norm of the spike component series.
19. The non-transitory computer-readable medium of claim 18 , wherein decomposing the time series further comprises configuring the optimization algorithm with a level weight indicating a contribution of the level component series to the time series and a spike weight indicating a contribution of the spike component series to the time series, wherein the level weight is applied to the level term and the spike weight is applied to the spike term.
20. The non-transitory computer-readable medium of claim 17 , wherein performing the anomaly-detection operation, comprises:
computing error-bound pairs from the error component series, each error-bound pair corresponding to a respective index from the error component series, wherein computing the error-bound pairs comprises:
fitting the error component series to an auto-regressive moving average model,
computing a set of variances from the auto-regressive moving average model, and
calculating the error-bound pairs from the set of variances;
identifying a subset of spike values, wherein each spike value in the subset of spike values is identified based on the spike value being outside a range of spike values bounded by a respective error-bound pair having a common index with respect to the spike value; and
outputting the identified subset of spike values as an anomaly set.