|
|
|
|
|
by d4rti
1320 days ago
|
|
Stuff I've used: - Prophet - seems to be the current 'standard' choice
- ARIMA - Classical choice
- Exponential Moving Average - dead simple to implement, works well for stuff that's a time series but not very seasonal
- Kalman/Statespace model - used by Splunk's predict[1] command (pretty sure I always used LLP5)
I did some anomaly detection work, in business transactions, and found the best way was to create a sort of ensemble model, where we applied all the models, and kept any anomalies, then used simple rules to only alert on 'interesting' anomalies, like: - 2-3 anomalies in a row
- high deviation from expected
- multiple models all detected anomaly
To improve signal vs noise.[1] :https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchRef... |
|
> - high deviation from expected
> - multiple models all detected anomaly
This is basically what statistical process control charts do for you. If you haven't learned about it already, I can recommend looking it up!