Combination of techniques to detect anomalies in multi-dimensional time series

1. A system, comprising:

one or more processors;

one or more memory devices that store computer program logic for execution by the one or more processors, the computer program logic comprising:

a detection technique selector configured to receive time-series data and to select, based on characteristics of historical data, from a plurality of detection techniques a detection technique for detecting anomalies in a first-time-series data set for a combination of values of a first set of dimensions of the time-series data, each dimension in the first set of dimensions corresponding to an attribute of the time-series data; and

an anomaly detector configured to first apply the selected detection technique to the first time-series data set, to detect an anomaly in the first time-series data set, and to second apply the selected detection technique to a second time-series data set for a combination of values of a second set of dimensions of the time-series data in response to detecting the anomaly in the first time-series data set, wherein the first set of dimensions is a subset of the second set of dimensions and the second set of dimensions includes an additional dimension corresponding to an additional attribute of the time-series data, and the dimensions of the first and second sets of dimensions represent a same metric over an interval of time.

2. The system of claim 1 , the computer program logic further comprising a tuner configured to adjust sensitivity of the anomaly detector to detect anomalies based on the anomaly detected.

3. The system of claim 1 , wherein the anomaly detector is further configured to iteratively apply the selected detection technique to additional time-series data sets for other combinations of values of the second set of dimensions of the time-series data in response to detecting an anomaly in the first-time-series data set.

4. The system of claim 1 , wherein:

said second apply the selected detection technique comprises detecting an anomaly in the second time-series data set; and

the anomaly detector is further configured to apply the selected detection technique to a third time-series data set for a combination of values of a third set of dimensions of the time-series data in response to detecting an anomaly in the second time-series data set, wherein the second set of dimensions is a subset of the third set of dimensions and the third set of dimensions includes an additional dimension not included in the second set of dimensions.

5. The system of claim 1 , wherein the selected detection technique is a zero-threshold technique and wherein said first apply comprises detecting the anomaly in the first-time-series data set based on a threshold.

6. The system of claim 1 , wherein the selected detection technique is an average percent technique and wherein said first apply comprises detecting the anomaly in the first-time-series data set based on a change in an average percentage.

7. The system of claim 1 , wherein the detection technique selector is further configured to enable a user to select whether to remove seasonality and trend data from the first time-series data set.

8. The system of claim 1 , wherein the selected detection technique is a standard deviation technique and wherein said first apply comprises detecting the anomaly in the first-time-series data set based on a normal distribution of historical data.

9. A method, comprising:

selecting, based on characteristics of historical data, from a plurality of detection techniques a detection technique configured to detect anomalies in time-series data that includes a series of data points captured over time for multiple dimensions, each dimension of the multiple dimensions corresponding to an attribute of the time-series data;

applying the selected detection technique to the time-series data for a first set of dimensions to detect an anomaly;

selecting an additional dimension of the time-series data to include in the first set of dimensions to generate a second set of dimensions, the additional dimension corresponding to an additional attribute of the time-series data; and

applying the selected detection technique to the time-series data for the second set of dimensions to re-detect the anomaly.

10. The method of claim 9 , further comprising:

iteratively applying the selected detection technique to the time-series data for further sets of dimensions of the time-series data to iteratively re-detect the anomaly.

11. A method, comprising:

selecting, from a plurality of detection techniques a detection technique configured to detect anomalies in time-series data that includes a series of data points captured over time for multiple dimensions;

applying the selected detection technique to the time-series data for a first set of dimensions to detect an anomaly;

selecting an additional dimension to include in the first set of dimensions to generate a second set of dimensions; and

applying the selected detection technique to the time-series data for the second set of dimensions to re-detect the anomaly, the applying comprising:

detecting the anomaly at a first coordinate value set for the first set of dimensions; and wherein said applying the selected detection technique to the time-series data for the second set of dimensions to re-detect the anomaly comprises:

detecting the anomaly at a second coordinate value set for the second set of dimensions, the second coordinate value set including the first coordinate value set for the first set of dimensions and a coordinate value for the additional dimension.

12. The method of claim 9 , wherein the selected detection technique is a zero-threshold technique and wherein said applying the selected detection technique to the time-series data for a first set of dimensions to detect an anomaly comprises:

detecting the anomaly in the time-series data at a time value having an associated data value greater than a threshold value.

13. The method of claim 9 , wherein the selected detection technique is an average percent technique and wherein said applying the selected detection technique to the time-series data for a first set of dimensions to detect an anomaly comprises:

detecting the anomaly in the time-series data at a time value having an associated data value greater than an average percentage.

14. A method, comprising:

selecting from a plurality of detection techniques a detection technique configured to detect anomalies in time-series data that includes a series of data points captured over time for multiple dimensions;

applying the selected detection technique to the time-series data for a first set of dimensions to detect an anomaly;

selecting an additional dimension to include in the first set of dimensions to generate a second set of dimensions; and

applying the selected detection technique to the time-series data for the second set of dimensions to re-detect the anomaly, the applying comprising:

enabling a user to select whether to remove seasonality and trend data from the time-series data; and

applying the selected detection technique to the time-series data with seasonality and trend removed according to selection by the user.

15. The method of claim 14 , wherein the selected detection technique is a standard deviation technique and wherein said applying the selected detection technique to the time-series data for a first set of dimensions to detect an anomaly comprises:

detecting the anomaly in the time-series data at a time value having an associated data value that is beyond a predetermined value with reference to a normal distribution of historical data.

16. A computer-readable storage medium having program instructions recorded thereon that, when executed by at least one processing circuit of a computing device, perform a method, comprising:

receiving time-series data;

selecting, based on characteristics of historical data, from a plurality of detection techniques a detection technique for detecting anomalies in a first-time-series data set for a combination of values of a first set of dimensions of the time-series data, each dimension in the first set of dimensions corresponding to an attribute of the time-series data;

first applying the selected detection technique to the first time-series data set; and

in response to detecting an anomaly in the first time-series data set, second applying the selected detection technique to a second time-series data set for a combination of values of a second set of dimensions of the time-series data, wherein the first set of dimensions is a subset of the second set of dimensions and the second set of dimensions includes an additional dimension corresponding to an additional attribute of the time-series data, and the dimensions of the first and second sets of dimensions represent a same metric over an interval of time.

17. The computer-readable storage medium of claim 16 , wherein the method further comprises:

iteratively applying the selected detection technique to additional time-series data sets for other combinations of values of the second set of dimensions of the time-series data in response to detecting an anomaly in the first-time-series data set.

18. The computer-readable storage medium of claim 16 , wherein said second applying the selected detection technique comprises detecting an anomaly in the second time-series data set and the method further comprises:

applying the selected detection technique to a third time-series data set for a combination of values of a third set of dimensions of the time-series data in response to detecting an anomaly in the second time-series data set, wherein the second set of dimensions is a subset of the third set of dimensions and the third set of dimensions includes an additional dimension not included in the second set of dimensions.

19. The computer-readable storage medium of claim 16 , wherein the method further comprises:

removing seasonality and trend data from the first time-series data set.

20. The computer-readable storage medium of claim 16 , wherein the selected detection technique is a standard deviation technique and wherein said first applying comprises detecting the anomaly in the first-time-series data set based on a normal distribution of historical data.