Hansheng Ren
ABSTRACT
Large companies need to monitor various metrics (for example, Page Views and Revenue) of their applications and services in real time. At Microsoft, we develop a time-series anomaly detection service which helps customers to monitor the time-series continuously and alert for potential incidents on time. In this paper, we introduce the pipeline and algorithm of our anomaly detection service, which is designed to be accurate, efficient and general. The pipeline consists of three major modules, including data ingestion, experimentation platform and online compute. To tackle the problem of time-series anomaly detection, we propose a novel algorithm based on Spectral Residual (SR) and Convolutional Neural Network (CNN). Our work is the first attempt to borrow the SR model from visual saliency detection domain to time-series anomaly detection. Moreover, we innovatively combine SR and CNN together to improve the performance of SR model. Our approach achieves superior experimental results compared with state-of-the-art baselines on both public datasets and Microsoft production data.
Supplemental Material
- {n.d.}. https://github.com/linkedin/luminol.Google Scholar
- {n.d.}. http://iops.ai/dataset_detail/?id=10.Google Scholar
- {n.d.}. http://iops.ai/competition_detail/?competition_id=5&flag=1.Google Scholar
- {n.d.}. http://workshop.aiops.org/files/logicmonitor2018.pdf.Google Scholar
- Chris Chatfield. 1978. Holt-Winters forecasting Procedure. Journal of the Royal Statistical Society, Applied Statistics 27, 3 (1978), 264--279.Google ScholarCross Ref
- Laurens DeHaan and Ana Ferreira.2007. Extreme value theory: an introduction. Springer Science & Business Media.Google Scholar
- Carl Doersch. 2016. Tutorial on variational autoencoders. arXiv preprint arXiv: 1606.05908 (2016).Google Scholar
- Chenlei Guo, Qi Ma, and Liming Zhang.2008. Spatio-temporal saliency detection using phase spectrum of quaternion fourier transform. (2008).Google Scholar
- Xiaodi Hou, Jonathan Harel, and Christof Koch. 2012. Image signature: Highlighting sparses alient regions. IEEE transactions on pattern analysis and machine intelligence 34, 1 (2012), 194--201. Google ScholarDigital Library
- Xiaodi Hou and Liqing Zhang. 2007. Saliency detection: A spectral residual approach. In Computer Vision and Pattern Recognition, 2007. CVPR'07. IEEE Conference on.IEEE, 1--8.Google ScholarCross Ref
- Nikolay Laptev, Saeed Amizadeh, and Ian Flint. 2015. Generic and Scalable Framework for Automated Time-series Anomaly Detection. In Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM, New York, NY, USA, 1939--1947. Google ScholarDigital Library
- Andy Liaw, Matthew Wiener, etal. 2002. Classification and regression by Random Forest. R news 2, 3 (2002), 18--22.Google Scholar
- Dapeng Liu, Youjian Zhao, Haowen Xu, Yongqian Sun, Dan Pei, Jiao Luo, Xiaowei Jing, and Mei Feng. 2015. Opprentice:Toward spractical and automatic anomalydetection through machinelearning. In Proceedings of the 2015 Internet Measurement Conference. ACM, 211--224. Google ScholarDigital Library
- WeiLu and Ali A Ghorbani.2009. Network anomaly detection based on wavelet analysis. EURASIP Journal on Advances in Signal Processing 2009 (2009), 4.Google Scholar
- Ajay Mahimkar, Zihui Ge, Jia Wang, Jennifer Yates, Yin Zhang, Joanne Emmons, Brian Huntley, and Mark Stockert. 2011. Rapid detection of maintenance induced changes in service performance. In Proceedings of the Seventh COnference on emerging Networking EXperiments and Technologies. ACM, 13. Google ScholarDigital Library
- Faraz Rasheed, Peter Peng, Reda Alhajj, and Jon Rokne. 2009. Fourier transform based spatial outlier mining. In International Conference on Intelligent Data Engineering and Automated Learning.Springer, 317--324. Google ScholarDigital Library
- Bernard Rosner. 1983. Percentage points for a generalized ESD many-outlier procedure. Technometrics 25, 2 (1983), 165--172.Google ScholarCross Ref
- Dominique Shipmon, Jason Gurevitch, Paolo M Piselli, and Steve Edwards.2017. Time Series Anomaly Detection: Detection of Anomalous Drops with Limited Features and Sparse Examples in Noisy Periodic Data. Technical Report. Google Inc.Google Scholar
- Alban Siffer, Pierre-Alain Fouque, Alex and reTermier, and Christine Largouet. 2017. Anomaly detection in streams with extreme value theory. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM, 1067--1075. Google ScholarDigital Library
- Owen Vallis, Jordan Hochenbaum, and Arun Kejariwal. 2014. A Novel Technique for Long-Term Anomaly Detection in the Cloud. In 6th USENIX Workshop on Hot Topics in Cloud Computing (Hot Cloud14). USENIX Association, Philadelphia, PA. Google ScholarDigital Library
- Charles VanLoan. 1992. Computational frameworks for the fast Fourier transform. Vol.10. Siam.Google Scholar
- Li Wei, Nitin Kumar, Venkata Lolla, Eamonn J. Keogh, Stefano Lonardi, and Chotirat Ratanamahatana. 2005. Assumption-freeAnomaly Detection in Time Series. In Proceedings of the 17th International Conference on Scientific and Statistical Database Management (SSDBM'2005).237--240. Google ScholarDigital Library
- Haowen Xu, Wenxiao Chen, Nengwen Zhao, Zeyan Li, Jiahao Bu, Zhihan Li, YingLiu, YoujianZhao, DanPei, YangFeng, etal.2018. Unsupervised Anomaly Detection viaV ariational Auto-Encoder for Seasonal KPIs in Web Applications. In Proceedings of the 2018 World Wide Web Conference on World Wide Web. International World Wide Web Conferences Steering Committee, 187--196. Google ScholarDigital Library
- Yin Zhang, Zihui Ge, Albert Greenberg, and Matthew Roughan. 2005. Network anomography. In Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement. USENIX Association, 30--30. Google ScholarDigital Library
- Rui Zhao, Wanli Ouyang, Hongsheng Li, and Xiaogang Wang. 2015. Saliency detection by multi-contextdeeplearning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.1265--1274.Google Scholar
Index Terms
- Time-Series Anomaly Detection Service at Microsoft
Recommendations
Time-Series Aware Precision and Recall for Anomaly Detection: Considering Variety of Detection Result and Addressing Ambiguous Labeling
CIKM '19: Proceedings of the 28th ACM International Conference on Information and Knowledge ManagementWe proposetime-series aware precision andrecall, which are appropriate for evaluating anomaly detection methods in time-series data. In time-series data, an anomaly corresponds toa series of instances. The conventional metrics, however, overlook this ...
Self-adversarial variational autoencoder with spectral residual for time series anomaly detection
AbstractDetecting anomalies accurately in time series data has been receiving considerable attention due to its enormous potential for a wide array of applications. Numerous unsupervised anomaly detection methods for time series have been developed ...
Deep learning for anomaly detection in multivariate time series: Approaches, applications, and challenges
AbstractAnomaly detection has recently been applied to various areas, and several techniques based on deep learning have been proposed for the analysis of multivariate time series. In this study, we classify the anomalies into three types, ...
Highlights- The methods for anomaly detection on multivariate time series are reviewed.
- The ...
Comments