Nonparametric method for determination of anomalous event states in complex systems exhibiting non-stationarity
According to a feature of the present disclosure, a method is provided for the determination of anomalous events in complex systems, such as problems, inefficiencies, and failures, and a tool is provided for the detection of these events. Many complex systems are non-stationary or experience periodic fluctuations or spikes in values that are outside of normal ranges, but constitute normal behavior nevertheless. The method accounts for both non-stationarity, as well as fluctuations and spikes. Additional novel features include both a threshold setting initialization method and a regression method for the determination of the start points and end points of events.
1. A device for determining dynamic thresholds comprising:
an initializer device configured to:
(a) collect a historical time-series data set for a metric in an information technology (IT) infrastructure for at least one monitoring period, each monitoring period having a plurality of timeslots and each timeslot observing metric data at least once;
(b) screen the historical time-series data set to remove abnormal metric data to form a non-abnormal historical data set;
(c) collect each data point from the non-abnormal historical data set into a timeslot historical data set that corresponds with the timeslot from which each data point was collected historically;
(d) simulate m monitoring periods by:
(i) generating a simulated time-series data stream comprising randomly selected data points selected from the timeslot historical data set corresponding to the same timeslot in the simulated time-series data stream;
(ii) calculating a cumulative sum value for each simulated randomly selected data point; and
(iii) determining a maximum cusum value (max{S n } m ) for the simulated monitoring period, where n is an indicator of sequential position of each data point in the data stream
to create a set {max{S n } 1 , max{S n } 2 , . . . , max {S n } m }, and
(e) selecting as a threshold max{max{s n } 1 , max{s n } 2 , . . . , max{s n } m };
a cumulative sum analyzer configured to compare incoming data for each metric against the threshold by performing a cumulative sum analysis on a set of incoming metric data in real time by calculating a cumulative sum value for each metric and comparing the cumulative sum value to the threshold to detect anomalous events; and
an alerting device configured to initiate an alert state when an anomalous event is detected that effects at least one response to address the conditions triggering the anomalous event in the affected component of the IT infrastructure;
wherein each cumulative sum value is calculated by adding to the previous cumulative sum value the difference between the value of a metric and a value for normal behavior for a current timeslot within the monitoring period; and
wherein if the calculation of the cumulative sum value is negative, it is set to zero.
2. The device of claim 1 , wherein the initializer is reinitialized after the completion of each monitoring period.
3. The device of claim 2 , further comprising:
a storage device configured to store the historical time-series data set for n prior monitoring periods;
wherein the historical time-series data set is periodically updated by removing any data from any monitoring period older than the n most recent monitoring periods and adding any data from the n most recent monitoring periods that is not yet present in the historical time-series data set.
4. The device of claim 1 , wherein an end point of each anomalous event is determined by the analyzer.
5. The device of claim 4 , wherein analyzer is configured to determine the end point of each anomalous event by calculating the largest cusum value in the set of v historical cusum values having negative or flat regression slope;
wherein regressions over v cusum values begins at the first cusum statistic to exceed the threshold and progresses for each cusum statistic thereafter until a negative or flat slope is calculated.
6. The device of claim 5 , wherein the analyzer is configured to determine the start point of each anomalous event by calculating the most recent cumulative sum value in the set of v cumulative sum values {s n , s n−1 , . . . , s n−v+1 } having the first negative or flat regression slope;
wherein s n , is initially the first cumulative sum value in an anomalous event to exceed the threshold and regressions over v points are calculated until a negative or flat slope results, each calculation taking the regression for the next n−1 set of cusum values.
7. The device of claim 4 , wherein data points corresponding to the anomalous event are removed from the set of historic time-series data up to the time period corresponding to the end point of an anomalous event.
8. The device of claim 1 , wherein a start point of each anomalous event is determined by the analyzer.
9. The device of claim 8 , wherein the analyzer is configured to determine the start point of each anomalous event by calculating the most recent cumulative sum value in the set of v cumulative sum values {s n , s n−1 , . . . , s n−v+1 } having the first negative or flat regression slope;
wherein s n , is initially the first cumulative sum value in an anomalous event to exceed the threshold and regressions over v points are calculated until a negative or flat slope results, each calculation taking the regression for the next n−1 set of cusum values.
10. The device of claim 9 , wherein data points corresponding to the anomalous event are removed from the set of historic time-series data from the time period corresponding to the start point of an anomalous event.
11. The device of claim 9 , wherein data points corresponding to the anomalous event are removed from the set of historic time-series data from the time period corresponding to the start point of an anomalous event up to the end point of the anomalous event.