Forecasting recurring anomalies in time series data
Systems and methods for forecasting recurring anomalies in time series data include determining forecast data from historical data of time series data where the forecast data is for a desired future time span; combining the forecast data with the historical data to form a combined time series; determining a normal operating range using the combined time series; detecting anomalies in the forecast data based on the normal operating range; and providing an output including the detected anomalies in the forecast data.
1 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to implement steps of:
determining forecast data from historical data of time series data where the forecast data is for a desired future time span, wherein the time series data relates to a network and describes network traffic therein, wherein the forecast data includes recurring anomalies predicted for the desired future time span and the time series data comprises Performance Monitoring (PM) data collected from network elements in the network;
combining the forecast data with the historical data to form a combined time series;
determining a normal operating range using the combined time series such that the normal operating range is determined based on both the historical data and the forecast data, wherein the normal operating range is defined by a fixed, predefined sensitivity boundary interval width explicitly configured in advance and applied uniformly regardless of statistical variance, and wherein the normal operating range is determined without computing statistical confidence intervals or error variance estimates;
detecting anomalies in the forecast data based on the normal operating range, wherein the normal operating range includes sensitivity boundaries defined by a predefined interval width on the combined time series, and wherein the detecting anomalies includes determining forecast data points including forecasted recurring anomalies in seasonal or periodic patterns that lie outside the sensitivity boundaries;
providing an output including the detected anomalies in the forecast data; and
triggering a workflow based on the output, wherein the workflow includes scaling up or down network resources in the network through network-specific actions comprising bandwidth scaling, routing adjustments or Quality of Service (QoS) parameter modifications based on the detected anomalies and their corresponding times.
2 . The non-transitory computer-readable medium of claim 1 , wherein the steps further include
providing the output as an alert in a graphical user interface.
3 . The non-transitory computer-readable medium of claim 2 , wherein the graphical user interface includes a dashboard that displays one or more of the detected anomalies in the forecast data and their corresponding times, associated equipment related to the detected anomalies, aggregate data for a plurality of time series and any detected anomalies, a number of forecasts, and a percentage of forecasts that came true.
4 . The non-transitory computer-readable medium of claim 1 , wherein the time series data is for Performance Monitoring (PM) data for packet layer data, and wherein the PM data includes any of latency, jitter, error rate, RX bytes/packets, TX bytes/packets, or dropped packet bytes.
5 . The non-transitory computer-readable medium of claim 4 , wherein the PM data is used to derive values for network traffic including one of a Committed Information Rate (CIR) and an Excess Information Rate (EIR).
6 . The non-transitory computer-readable medium of claim 1 , wherein the normal operating range is determined using a forecast envelope that incorporate sonality analysis to account for recurring traffic patterns, and the detecting anomalies includes determining any of the forecast data outside a sensitivity boundary of the predefined interval width.
7 . The non-transitory computer-readable medium of claim 1 , wherein the time series data comprises multi-layer Performance Monitoring (PM) data selected from optical layer data, packet layer data, and service layer data, and wherein anomalies are detected by correlating deviations across at least two layers of PM data.
8 . The non-transitory computer-readable medium of claim 7 , wherein the steps further include
performing the determining the forecast data, the combining, the determining the normal operating range, the detecting, and the providing for one or more additional time series that are each different PM data in the network.
9 . A computer-implemented method comprising steps of:
determining forecast data from historical data of time series data where the forecast data is for a desired future time span, wherein the time series data relates to a network and describes network traffic therein, wherein the forecast data includes recurring anomalies predicted for the desired future time span and the time series data comprises network telemetry Performance Monitoring (PM) data including packet transmission, routing, or switching metrics;
combining the forecast data with the historical data to form a combined time series;
determining a normal operating range using the combined time series such that the normal operating range is determined based on both the historical data and the forecast data, wherein the normal operating range is defined by a fixed, predefined sensitivity boundary interval width explicitly configured in advance and independent of statistical confidence calculations, and wherein no statistical confidence bounds are computed for the time series;
detecting anomalies in the forecast data based on the normal operating range, wherein the normal operating range includes sensitivity boundaries defined by a predefined interval width on the combined time series, and wherein the detecting anomalies includes determining forecast data points including forecasted recurring anomalies in periodic or seasonal cycles that lie outside the sensitivity boundaries;
providing an output including the detected anomalies in the forecast data; and
triggering a workflow based on the output, wherein the workflow includes scaling up or down network resources in the network through automated actions comprising reallocating traffic across links, adjusting routing configurations, or scaling bandwidth based on the detected anomalies and their corresponding times based on the detected anomalies and their corresponding times.
10 . The computer-implemented method of claim 9 , wherein the steps further include
providing the output as an alert in a graphical user interface.
11 . The computer-implemented method of claim 10 , wherein the graphical user interface includes a dashboard that displays one or more of the detected anomalies in the forecast data and their corresponding times, associated equipment related to the detected anomalies, aggregate data for a plurality of time series and any detected anomalies, a number of forecasts, and a percentage of forecasts that came true.
12 . The computer-implemented method of claim 9 , wherein the time series data is for Performing Monitoring (PM) data for packet layer data, and wherein the PM data includes any of latency, jitter, error rate, RX bytes/packets, TX bytes/packets, or dropped packet bytes.
13 . The computer-implemented method of claim 12 , wherein the PM data is used to derive values for network traffic including one of a Committed Information Rate (CIR) and an Excess Information Rate (EIR).
14 . The computer-implemented method of claim 9 , wherein the normal operating range is determined using a forecast envelope that incorporates seasonality analysis to account for recurring traffic patterns, and the detecting anomalies includes determining any of the forecast data outside a sensitivity boundary of the predefined interval width.
15 . The computer-implemented method of claim 9 , wherein the time series data comprises multi-layer Performance Monitoring (PM) data selected from optical layer data, packet layer data, and service layer data, and wherein anomalies are detected by correlating deviations across at least two layers of PM data.
16 . The computer-implemented method of claim 15 , wherein the steps further include
performing the determining the forecast data, the combining, the determining the normal operating range, the detecting, and the providing for one or more additional time series that are each different PM data in the network.
17 . A processing device comprising:
one or more processors; and
memory storing instructions that, when executed, cause the one or more processors to
determine forecast data from historical data of time series data where the forecast data is for a desired future time span, wherein the time series data relates to a network and describes network traffic therein, wherein the forecast data includes recurring anomalies predicted for the desired future time span and the time series data represents telecommunications network traffic metrics including at least one of latency, jitter packet delay, throughput, or error rate
combine the forecast data with the historical data to form a combined time series,
determine a normal operating range using the combined time series such that the normal operating range is determined based on both the historical data and the forecast data, wherein the normal operating range is defined by a fixed, predefined sensitivity boundary interval width explicitly configured in advance and applied uniformly regardless of statistical variance, and wherein no statistica confidence intervals or residual error distributions are computed;
detect anomalies in the forecast data based on the normal operating range, wherein the normal operating range includes sensitivity boundaries defined by a predefined interval width on the combined time series, and wherein the anomalies are detected by determining forecast data points including forecasted recurring anomalies in periodic or seasonal patterns that lie outside the sensitivity boundaries,
provide an output including the detected anomalies in the forecast data, and
trigger a workflow based on the output, wherein the workflow includes scaling up or down network resources in the network through network control actions including scaling bandwidth, reallocating traffic, or adjusting routing parameters based on the detected anomalies and their corresponding times.
18 . The processing device of claim 17 , wherein the instructions that, when executed, cause the one or more processors to
provide the output as an alert in a graphical user interface.
19 . The processing device of claim 17 , wherein
time series data is for Performance Monitoring (PM) data for packet layer data, and wherein the PM data includes any of bandwidth, throughput, latency, jitter, error rate, RX bytes/packets, TX bytes/packets, or dropped packet bytes.
20 . The processing device of claim 17 , wherein the normal operating range is determined using a forecast envelope that incorpora easonality analysis to account for recurring traffic patterns, and the detecting anomalies includes determining any of the forecast data outside a sensitivity boundary of the predefined interval width.