Robust anomaly and change detection utilizing sparse decomposition

1. A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause a computing device to:

retrieve a metrics time series comprising metric data values representing user actions within a digital network corresponding to a time period;

determine at least a spike-component series and a level-component series as latent components of the metrics time series by:

applying an optimization algorithm to the metrics time series subject to a latent-component constraint for real values indicating the metrics time series comprises at least the spike-component series and the level-component series; and

based on the optimization algorithm, identifying the spike-component series and the level-component series as latent components of the metrics time series;

determine whether a subseries of the spike-component series satisfies a spike-significance threshold and a level change corresponding to the level-component series satisfies a level-change-significance threshold; and

generate, from the metrics time series, an anomalous data value to display on a client computing device based on one or more of the subseries of the spike-component series satisfying the spike-significance threshold or the level change corresponding to the level-component series satisfying the level-change-significance threshold.

2. The non-transitory computer-readable medium as recited in claim 1 , further storing instructions that, when executed by the at least one processor, cause the computing device to determine whether the subseries of the spike-component series satisfies the spike-significance threshold by:

generating a stationary time series that equals a combination of the spike-component series and a residual error value; and

determining the stationary time series deviates from a dataset following a normalized distribution.

3. The non-transitory computer-readable medium as recited in claim 1 , further storing instructions that, when executed by the at least one processor, cause the computing device to determine that the level change corresponding to the level-component series satisfies the level-change-significance threshold by:

generating a significant-level-change value; and

determining that an absolute value of the level change corresponding to the level-component series exceeds or equals the significant-level-change value.

4. The non-transitory computer-readable medium as recited in claim 1 , further storing instructions that, when executed by the at least one processor, cause the computing device to apply the optimization algorithm to non-real values by:

excluding non-real values from the latent-component constraint; and

determining a seasonal-component series for the non-real values based on a frequency domain.

5. The non-transitory computer-readable medium as recited in claim 1 , further storing instructions that, when executed by the at least one processor, cause the computing device to apply an objective function of the optimization algorithm to an infinity value from the metrics time series by replacing the spike-component series with the metrics time series.

6. The non-transitory computer-readable medium as recited in claim 1 , further storing instructions that, when executed by the at least one processor, cause the computing device to apply the latent-component constraint for real values to the optimization algorithm by constraining the metrics time series to comprise a sum of the spike-component series, the level-component series, a seasonal-component series, and an error-component series.

7. The non-transitory computer-readable medium as recited in claim 1 , further storing instructions that, when executed by the at least one processor, cause the computing device to:

identify a data value of the spike-component series corresponding to the time period and a previous data value of a previous spike-component series corresponding to an analogous time period; and

determine the data value of the spike-component series does not represent an anomaly to adjust for a periodic effect.

8. The non-transitory computer-readable medium as recited in claim 1 , further storing instructions that, when executed by the at least one processor, cause the computing device to determine at least the spike-component series and the level-component series as latent components of the metrics time series by applying the optimization algorithm to the metrics time series without separating the metrics time series into data values for a training period and data values for a testing period.

9. A system comprising:

at least one memory device comprising a metrics time series including metric data values representing user actions within a digital network corresponding to a time period; and

at least one computing device configured to cause the system to:

determine at least a level-component series and a spike-component series as latent components of the metrics time series subject to a latent-component constraint and excluding non-real values of the metrics time series from the latent-component constraint;

concurrently determine whether a subseries of the spike-component series and a level change corresponding to the level-component series represent significant anomalies by:

determining whether a stationary time series equaling a combination of the spike-component series and a residual error value deviates from a dataset following a distribution; and

determining whether the level change corresponding to the level-component series deviates from a significant-level-change value according to a level-change-significance threshold; and

generate, from the metrics time series, an anomalous data value to display on a client computing device based on one or more of the subseries of the spike-component series or the level change representing a significant anomaly.

10. The system as recited in claim 9 , wherein the at least one computing device is further configured to cause the system to generate a graphical user interface visually indicating the anomalous data value within the metrics time series.

11. The system as recited in claim 9 , wherein the at least one computing device is further configured to cause the system to determine whether the stationary time series equaling the combination of the spike-component series and the residual error value deviates from the dataset following the distribution by:

determining the residual error value by applying an autoregressive model to an error-component series within the metrics time series; and

applying a Generalized Extreme Studentized Distribution test to the stationary time series equaling the combination of the spike-component series and the residual error value.

12. The system as recited in claim 9 , wherein the at least one computing device is further configured to cause the system to determine whether the level change corresponding to the level-component series deviates from the significant-level-change value according to the level-change-significance threshold by:

generating a normalized distribution according to a significance level;

determining the significance-level-change value from the normalized distribution; and

determining that an absolute value of the level change corresponding to the level-component series exceeds or equals a product of the significance-level-change value and the residual error value.

13. The system as recited in claim 9 , wherein the at least one computing device is further configured to cause the system to determine at least the level-component series and the spike-component series as latent components of the metrics time series by:

applying an optimization algorithm to the metrics time series subject to a latent-component constraint for real values indicating the metrics time series comprises the spike-component series, the level-component series, a seasonal-component series, and an error-component series; and

based on the optimization algorithm, identifying the spike-component series, the level-component series, the seasonal-component series, and the error-component series as latent components of the metrics time series.

14. The system as recited in claim 13 , wherein the at least one computing device is further configured to:

apply the optimization algorithm to the metrics time series subject to an error constraint limiting the error-component series to a confidence interval;

determine that the metric data values within the metrics time series equal or fall below a threshold number of data values and that each metric data value is non-negative; and

based on determining that the metric data values equal or fall below the threshold number of data values, decreasing the confidence interval for the error constraint.

15. The system as recited in claim 13 , wherein the at least one computing device is further configured to:

exclude non-available values or non-number values from the latent-component constraint; and

determine a seasonal-component series for non-real values based on a frequency domain.

16. The system as recited in claim 9 , wherein the at least one computing device is further configured to cause the system to remove at least one of leading zero values or trailing zero values from the metrics time series.

17. The system as recited in claim 9 , wherein the at least one computing device is further configured to cause the system to determine at least the spike-component series and the level-component series as latent components of the metrics time series by applying an optimization algorithm to the metrics time series without separating the metrics time series into data values for a training period and data values for a testing period.

18. In a digital medium environment for analyzing traffic data, a method for determining anomalies from metrics time series comprising:

accessing a metrics time series comprising metric data points representing user actions within a digital network corresponding to a time period;

determining at least a spike-component series and a level-component series as latent components of the metrics time series by:

applying an optimization algorithm to the metrics time series subject to a latent-component constraint for real values indicating the metrics time series comprises at least the spike-component series and the level-component series; and

based on the optimization algorithm, identifying the spike-component series and the level-component series as latent components of the metrics time series;

identifying significant anomalous data values from the level-component series or the spike-component series within the metrics time series; and

generating, from the metrics time series, a visual representation of an anomalous data value to display on a client computing device based on identifying the anomalous data value from the level-component series or the spike-component series.

19. The method of claim 18 , wherein generating the visual representation of an anomalous data value to display on the client computing device comprises generating a graphical user interface visually indicating the anomalous data value within one or more of the metrics time series, the spike-component series, or the level-component series.

20. The method of claim 18 , further comprising applying the optimization algorithm to non-real values by:

excluding non-real values from the latent-component constraint; and

determining a seasonal-component series for the non-real values based on a frequency domain.