Algorithms

Stream graph algorithm

The stream graph algorithm is based on Time-Series Event Prediction with Evolutionary State Graph (Time2Graph). It reduces data noise and calculates the offset of abnormal samples. This algorithm suits scenarios with a large number of noisy time series and minimal cyclic changes.

Scenarios

The stream graph algorithm analyzes each sample in real time using online machine learning. It identifies anomalies in the following time series types:

Machine-level metrics, such as CPU utilization, memory usage, and disk read and write speeds
Performance metrics, such as queries per second (QPS), traffic volume, success rates, and latency
Golden metrics

Parameters

Configure stream graph parameters in the Algorithm Configurations section of the Create Intelligent Inspection Job wizard. Use SQL statements to aggregate metrics for real-time inspection.

Parameter	Subparameter	Description
(Required) Advanced Parameters	Time Series Segments	The number of segments into which the time series is discretized. Discretization helps construct metric charts. Default value: 8. Recommended range: 5 to 20. Anomaly detection sensitivity decreases linearly as this value increases.
	Observation Length	The number of historical samples used for anomaly detection. Default value: 2880. Recommended range: 200 to 4000. For cyclical time series, set this value to cover at least two full cycles. For example, with 1-minute granularity and a 1-day cycle, two cycles contain 2,880 samples — set this parameter to 2880 or higher.
	Period-over-period Comparison Length	The period (in days) for period-over-period comparison during anomaly detection. Set to 0 to disable period-over-period analysis.
	Major Capture Type	The anomaly types to prioritize. Valid values: Upward Spike: A sudden increase in the metric value. Downward Spike: A sudden decrease in the metric value. Upward Shift: The metric value rises and stabilizes over a period. Downward Shift: The metric value drops and stabilizes over a period. Upward Trend: A sustained increase in the metric value. Downward Trend: A sustained decrease in the metric value.
	Trees	The number of decision trees used for auxiliary anomaly inspection.
	Sample Size per Tree	The number of samples collected per detection tree during construction.
	Overall Anomaly Rate	The estimated anomaly rate in the time series. Valid values: 0.001 to 0.01.
	Minimum Window of Anomaly Type Check	The minimum time series length referenced during anomaly capture.
	Maximum Window of Anomaly Type Check	The maximum time series length referenced during anomaly capture.
	Minimum Window for Anomaly Confirmation	The minimum time series length inspected during anomaly confirmation.
	Maximum Window for Anomaly Confirmation	The maximum time series length inspected during anomaly confirmation.
Single-dimension Feature Configuration	-	The time series features to inspect. Configure each feature separately: Maximum Value: the maximum value of the time series. Minimum Value: the minimum value of the time series. Normalization: the normalization method applied during inspection. Anomaly Type to Follow: the anomaly types to prioritize during inspection.
Notification Sensitivity Configuration	-	The alert notification threshold. Configure different thresholds for different time periods. For example, suppress alerts during scheduled maintenance windows.

Stream decomposition algorithm

The stream decomposition algorithm is based on RobustSTL: A Robust Seasonal-Trend Decomposition Algorithm for Long Time Series. It supports batch processing at higher cost than the stream graph algorithm and suits precise inspection of a small number of performance metrics. For large datasets, split data into batches or use the stream graph algorithm.

Scenarios

Use the stream decomposition algorithm for data with major cyclic changes, such as performance metrics with strong periodic patterns.

Note

Examples of cyclic data: game visit counts and customer order volumes.

Parameters

Configure stream decomposition parameters in the Algorithm Configurations section of the Create Intelligent Inspection Job wizard. Use SQL statements to aggregate metrics for real-time inspection.

Configure the algorithm.

Parameter	Subparameter	Description
Automatic period detection	-	Enable automatic period detection for time series data that has a periodic pattern. If the time series has a constant period, disable this feature and set the period length manually.
Period detection frequency	-	This parameter takes effect when automatic period detection is enabled. The algorithm updates the period of the time series at the specified frequency. For example, if you set the period detection frequency to 12 hours, the algorithm detects and updates the series period every 12 hours.
Period length	-	This parameter takes effect when automatic period detection is disabled. Set the period length of the series. If the series has no period, set this value to 0.
Observation length	-	The length of historical data to reference for anomaly detection. If the series is periodic, set the observation length to three times the period length. For example, if the series has a period length of 1 day, set the observation length to 3 days.
Sensitivity	-	A higher sensitivity value results in more detected anomalies and higher anomaly scores. This increases the recall rate for anomalies but decreases the precision rate.
Advanced parameters	Trend component sensitivity	The algorithm decomposes a series into trend, periodicity, and noise components. This parameter adjusts the sensitivity for anomaly detection on the trend component. A higher value results in more detected anomalies and higher anomaly scores, which increases the recall rate but decreases the precision rate.
	Noise component sensitivity	The algorithm decomposes a series into trend, periodicity, and noise components. This parameter adjusts the sensitivity for anomaly detection on the noise component. A higher value results in more detected anomalies and higher anomaly scores, which increases the recall rate but decreases the precision rate.
	Trend component sample length	The algorithm decomposes a series into trend, periodicity, and noise components. If the observation length is too long, trend analysis can be slow. A longer sample length speeds up the analysis but may reduce accuracy. For example, if the sample length is 8, the algorithm analyzes one data point for every 8 points in the original series.
	Periodicity component sample length	The algorithm decomposes a series into trend, periodicity, and noise components. If the observation length is too long, periodicity analysis can be slow. A longer sample length speeds up the analysis but may reduce accuracy. For example, if the sample length is 8, the algorithm analyzes one data point for every 8 points in the original series. Set this value to 5 or less.
	Window length	If the series observation length is too long, anomaly detection can be slow. Set a window length to make the detection algorithm use a sliding window. The algorithm detects anomalies in segments of the data series, which improves detection speed. Set this value to 5000 or less. If you do not need to use a sliding window, set this value to 0.

Preview the algorithm's performance with the current parameter settings.
1. Set a time range to specify the start and end times for the time series. Click Data Query. The query and analysis statements that you set in Data Feature Settings are used to process the data in the specified time range and generate time series data.
2. Select Entity Information and Feature to specify the feature series for detection. Click Preview. The detection algorithm processes the specified feature series and displays the results below. Click Show Parameters to view the current parameter settings for the algorithm.
3. The detection results show the Trend Component Preview, Periodicity Component Preview, and Noise Component Preview. Adjust the anomaly threshold in the Trend Component Preview and Noise Component Preview. Only anomalous events with a score greater than the threshold can generate alerts.

Supervised anomaly detection algorithm

The supervised anomaly detection algorithm constructs features from time series data and uses these features along with anomaly labels to train classification models such as decision trees and random forests. The trained models then perform anomaly detection.

Scenarios

The supervised anomaly detection algorithm suits labeled time series data that the stream graph or stream decomposition algorithms cannot handle effectively.

Parameters

Configure supervised anomaly detection parameters in the Algorithm Configurations section of the Create Model Training Job wizard. Use SQL statements to aggregate metrics for model training.