Time-series anomaly prediction and alert
Provided is a system and method which can identify a causal relationship for anomalies in a time-series signal based on co-occurring and preceding anomalies in another time-series signal. In one example, the method may include identifying a recurring anomaly within a time-series signal of a first data value, determining a time-series signal of a second data value that is a cause of the recurring anomaly in the time-series signal of the first data value based on a preceding and co-occurring anomaly in the time-series signal of the second data value, and storing a correlation between the preceding and co-occurring anomaly in the time-series signal of the second data value and the recurring anomaly in the time-series signal of the first data value.
1. A computing system comprising:
a hardware processor configured to:
receive, by a machine learning model including a time-series forecasting model, first time-series signal captured of a first data value, a second time-series signal captured of a second data value, and a third time-series signal captured of a third data value,
detect, by an anomaly detector, a causal relationship between a recurring anomaly in the first time-series signal and co-occurring anomalies in the second and third time series signals based on a delay in time between the recurring anomaly in the first time-series signals and the co-occurring anomalies in the second and third time-series signals,
build, by a causal graph builder, a graph model comprising a first node representing the first time-series signal, a second node representing the second time-series signal, a third node representing the third time-series signal, an operator node between the first, second, and third nodes, and edges between the nodes identifying the causal relationship, and store the graph model in a graph data store,
receive, by the machine learning model including the time-series forecasting model, a new time-series signal of the second data value and a new time-series signal of the third data value,
predict, by the machine learning model including the time-series forecasting model, that a future anomaly will occur within a future time-series signal of the first data value based on a new occurrence of the co-occurring anomalies in the new time-series signals of the second and third data values and the first node, second node, third node, operator node, and edges in the graph model;
display a graph of the future time-series signal of the first data value along a time axis within a user interface and display an indicator of the future anomaly at a future point in time on the graph of the time-series signal of the first data value corresponding to when the future anomaly will occur and a textual explanation, generated by an anomaly alerter, of the basis of the future anomaly including information regarding the co-occurring anomalies in the new time-series signals of the second and third data values; and
transmit an alert of the predicted future anomaly, prior to an occurrence of the future anomaly, to a connected system to perform at least one of an action to prevent the anomaly and an action to make an adjustment prior to the occurrence of the predicted future anomaly.
2. The computing system of claim 1 , wherein the processor is further configured to build the machine learning model based on the detected causal relationship, and detect the future anomaly in the future signal of the first data value based on an execution of the machine learning model on the new time-series signal of the first data value.
3. The computing system of claim 2 , wherein the processor is further configured to output, by the anomaly alerter, an alert that warns of the detected future anomaly via the user interface.
4. The computing system of claim 1 , wherein the processor is further configured to, by the machine learning model, pair recurring anomalies in the time-series signal of the first data value with anomalies in the time-series signal of the second data value, and store mappings of the paired anomalies within a data structure of the memory.
5. The computing system of claim 4 , wherein the processor is configured to detect, by the anomaly detector, the causal relationship based on the paired anomalies within the data structure being greater than a predetermined threshold.
6. The computing system of claim 4 , wherein the processor is further configured to identify, by the causal graph builder for each pairing of anomalies, a delay between a respective anomaly in the time-series signals of the second data value and a paired anomaly in the time-series signals of the first data value to generate a plurality of identified delays, and store the plurality of identified delays in the data structure in association with corresponding mappings of the paired anomalies.
7. The computing system of claim 6 , wherein the processor is further configured to detect, by the anomaly detector, the causal relationship based on the identified delays.
8. The computing system of claim 1 , wherein the processor is further configured to extract, by an anomaly extractor, data from the causal graph about past anomalies, and display the data via the user interface.
9. A method comprising:
receiving, by a machine learning model including a time-series forecasting model, first time-series signal captured of a first data value, a second time-series signal captured of a second data value, and a third time-series signal captured of a third data value;
detecting, by an anomaly detector, a causal relationship between a recurring anomaly in the first time-series signal and co-occurring anomalies in the second and third time series signals based on a delay in time between the recurring anomaly in the first time-series signals and the co-occurring anomalies in the second and third time-series signals;
building, by a causal graph builder, a graph model comprising a first node representing the first time-series signal, a second node representing the second time-series signal, a third node representing the third time-series signal, an operator node between the first, second, and third nodes, and edges between the nodes identifying the causal relationship, and storing the graph model in a graph data store;
receiving receive, by the machine learning model including the time-series forecasting model, a new time-series signal of the first data value and a new time-series signal of the second data value;
predicting, by the machine learning model including the time-series forecasting model, that a future anomaly will occur within a future time-series signal of the first data value based on a new occurrence of the co-occurring anomalies in the new time-series signal of the second and third data values and the first node, second node, third node, operator node, and edges in the graph model;
displaying a graph of the future time-series signal of the first data value along a time axis within a user interface and display an indicator of the future anomaly at a future point in time on the graph of the time-series signal of the first data value corresponding to when the future anomaly will occur and a textual explanation, generated by an anomaly alerter, of the basis of the future anomaly including information regarding the co-occurring anomalies in the new time-series signals of the second and third data values; and
transmitting an alert of the predicted future anomaly, prior to an occurrence of the future anomaly to a connected system to perform at least one of an action to prevent the anomaly and an action to make an adjustment prior to the occurrence of the predicted future anomaly.
10. The method of claim 9 , further comprising:
building the machine learning model based on the detected causal relationship; and
detecting the future anomaly in the future signal of the second data value based on an execution of the machine learning model on the new time-series signal of the first data value.
11. The method of claim 10 , further comprising outputting, by the anomaly alerter, an alert that warns of the detected future anomaly via the user interface.
12. The method of claim 9 , further comprising:
pairing, by the machine learning model, recurring anomalies in the time-series signal of the first data value with anomalies in the time-series signal of the second data value, and storing mappings of the paired anomalies within a data structure.
13. The method of claim 12 , wherein the detecting comprises detecting, by the anomaly detector, the causal relationship based on the paired anomalies stored within the data structure being greater than a predetermined threshold.
14. The method of claim 12 , further comprising:
identifying, by the causal graph builder for each pairing of anomalies, a delay between a respective anomaly in the time-series signals of the second data value and a paired anomaly in the time-series signals of the first data value to generate a plurality of identified delays, and storing the plurality of identified delays in the data structure in association with corresponding mappings of the paired anomalies.
15. The method of claim 14 , wherein the detecting comprises detecting, by the anomaly detector, the causal relationship based on the identified delays.
16. The method of claim 9 , further comprising:
extracting, by an anomaly extractor, data from the causal graph about past anomalies, and display the data via the user interface.
17. A method comprising:
receiving, by a machine learning model including a time-series forecasting model, first time-series signal captured of a first data value, a second time-series signal captured of a second data value, and a third time-series signal captured of a third data value;
detecting, by an anomaly detector, a causal relationship between a recurring outlier in the first time-series signals and co-occurring outliers in the first and second time series signals based on a delay in time between the recurring outlier in the first time-series signal and the co-occurring outliers in the second and third time-series signals;
building, by a causal graph builder, a graph model comprising a first node representing the first time-series signal, a second node representing the second time-series signal, a third node representing the third time-series signal, an operator node between the first, second, and third nodes, and edges between the nodes identifying the causal relationship, and storing the graph model in a graph data store;
receiving, by the machine learning model including the time-series forecasting model, a new time-series signal of the first data value and a new time-series signal of the second data value;
predicting, by the machine learning model including the time-series forecasting model, that a future outlier will occur within a future time-series signal of the first data value based on a new occurrence of the co-occurring outliers in the new time-series signals of the first and second data values and the first node, second node, third node, operator node, and edges in the graph model;
displaying a graph of the future time-series signal of the first data value along a time axis within a user interface and display an indicator of the future outlier at a future point in time on the graph of the time-series signal of the first data value corresponding to when the future outlier will occur and a textual explanation, generated by an anomaly alerter, of the basis of the future anomaly including information regarding the co-occurring anomalies in the new time-series signals of the second and third data values; and
transmit an alert of the predicted future anomaly, prior to an occurrence of the future anomaly, to a connected system to perform at least one of an action to prevent the anomaly and an action to make an adjustment prior to the occurrence of the predicted future anomaly.
18. The method of claim 17 , further comprising:
building the machine learning model based on the detected causal relationship, and detecting the future outlier in the future time-series signal of the second data value based on an execution of the machine learning model on the new time-series signal of the first data value.
19. The method of claim 17 , further comprising:
pairing, by the machine learning model, recurring outliers in the time-series signal of the first data value with outliers in the time-series signal of the second data value, and storing mappings of the pairs within a data structure.
20. The method of claim 19 , wherein the detecting comprises detecting, by the anomaly detector, the causal relationship based on the pairings stored within the data structure being greater than a predetermined threshold.