Algorithms

Anomalies

Overlay a band on the metric, showing the expected behavior of a series based on past values.

...

Kloudfuse provides these possible implementations of anomaly detection:

basic

Implements the Rolling quantile algorithm.

...

Has the possible values of 1, 2, or 3.

Example

In the example abovebelow, the time series graph displays unique count of errors over a period. The gray band represents the expected range based on recent data, while red markers indicate anomalies—data points outside the predicted range. Here, a sudden increase in errors during peak hours is flagged as an anomaly, allowing for quick detection and investigation.

...

Basic Anomaly Detection is ideal for monitoring metrics with frequent, non-seasonal fluctuations, where rapid response to changes is essential. Use it to detect unexpected spikes or drops without needing to account for cyclic patterns or trends.

agile

Implements the SARIMA algorithm.

Numeric parameter

Has the possible values of 1, 2, or 3.

The Agile Anomaly Detection algorithm uses the SARIMA (Seasonal AutoRegressive Integrated Moving Average) model to identify anomalies in time series data. Agile detection allows for quick adaptation to changes in the data

Key Arguments

• Seasonality (Hourly, Daily):

  • Hourly: This setting is used for metrics that display hourly cyclic behavior. For instance, if your log data typically fluctuates each hour based on user activity or background processes, setting the seasonality to Hourly enables the SARIMA model to capture these hourly patterns accurately.

  • Daily: This setting captures daily seasonality, suitable for log metrics with a daily recurring pattern. For example, if log entries spike every evening due to daily system maintenance tasks, setting the seasonality to Daily allows the model to recognize these daily trends.

• Bands (1, 2, 3):

  • Band 1 (Narrow): Offers high sensitivity by setting a tighter range around predicted values, detecting even minor deviations. This band is useful when you need to capture subtle changes in log volume that might indicate early signs of issues.

  • Band 2 (Moderate): Provides a moderate range, making the algorithm less sensitive to minor fluctuations and ideal for monitoring with fewer false positives.

  • Band 3 (Wide): Defines the widest range, capturing only significant deviations. This setting is suitable for metrics where only large, impactful anomalies are of interest, reducing alert noise for minor variations.

Image Added

robust

Implements the Seasonal decompose algorithm.

...

Has the possible values of 1, 2, or 3.

agile-robust

Implements the Prophet algorithm.

sampling interval

Sampling intervals hourly, daily, or weekly.

Numeric parameter

Has the possible values of 1, 2, or 3.The Agile Robust Anomaly Detection algorithm applies the Prophet model to detect anomalies in log metrics with recurring patterns and occasional level shifts. This approach is especially useful for identifying irregularities in logs that exhibit seasonal behaviors, such as error spikes, request rates, or event frequencies, which follow daily or hourly patterns.

Key Arguments

1. Seasonality (Hourly, Daily):

   • Hourly: This setting is used for log metrics that exhibit hourly patterns within a 24-hour cycle. For example, if your error logs tend to spike each hour due to automated checks or periodic background processes, selecting Hourly allows the algorithm to model these regular occurrences and detect deviations that fall outside the norm.

   • Daily: This setting captures daily seasonality, making it useful for metrics that show daily patterns. For instance, a daily surge in user login errors each morning when users start their workday would be expected. With Daily seasonality, the algorithm anticipates these recurring daily trends, flagging only unusual changes outside the expected pattern.

2. Bands (1, 2, 3):

   • Band 1 (Narrow)

   • Band 2 (Moderate)

   • Band 3 (Wide)

Image Added

Image Added

Outliers

Highlight outliers series.

Kloudfuse provides the DBSCAN implementation of outlier detection.

...

In DBSCAN, the tolerance level (referred to as eps) determines the radius of the neighborhood around each point for clustering purposes. In this example, eps is set to 0.8, which controls the sensitivity of outlier detection. A lower tolerance will detect more subtle outliers, while a higher tolerance will detect only the most significant deviations.

...

In the following examples, a cube root transformation is applied to the data before DBSCAN processing. The choice of eps significantly affects the number of detected outliers:

• Tolerance = 0.8
  In the first example fig-1 , eps is set to 0.8, making the detection process highly sensitive to deviations. As a result:

  • Solid lines in the chart represent data points marked as outliers, where even small deviations from the normal pattern are detected.

  • Dotted lines indicate non-outliers, showing stable or expected behavior.

• Tolerance = 5
  In the second example fig-2 , eps is increased to 5. With this higher tolerance:

  • Only significant deviations are identified as outliers, with most series marked as dotted lines (non-outliers).

  • Solid lines (outliers) appear only for major deviations, filtering out more minor deviations.

  This setting is appropriate when you only want to capture large deviations and are not concerned with smaller fluctuations in the data.

...

• Seasonal Forecast (Prophet):
  Prophet is a sophisticated forecasting model designed to handle time series data with seasonal patterns and holiday effects. This algorithm is especially effective for data that shows recurring patterns (e.g., hourly, daily, weekly) and is capable of capturing seasonality and trends. Seasonal forecasting is suitable for applications with clear cyclical behaviors.

...