Anomaly Detection on IT Operation Series via Online Matrix Profile

TL;DR

This paper introduces an online, training-free matrix profile method for anomaly detection in IT system time series, combining efficiency, accuracy, and broad applicability without requiring prior training.

Contribution

It proposes a novel online matrix profile approach that detects anomalies without training, enhanced with spectral residuals and a cache strategy for speed, suitable for diverse time series.

Findings

At least four times faster detection for long series

Comparable accuracy to trained models in anomaly detection

Effective across various types of IT system time series

Abstract

Anomaly detection on time series is a fundamental task in monitoring the Key Performance Indicators (KPIs) of IT systems. Many of the existing approaches in the literature show good performance while requiring a lot of training resources. In this paper, the online matrix profile, which requires no training, is proposed to address this issue. The anomalies are detected by referring to the past subsequence that is the closest to the current one. The distance significance is introduced based on the online matrix profile, which demonstrates a prominent pattern when an anomaly occurs. Another training-free approach spectral residual is integrated into our approach to further enhance the detection accuracy. Moreover, the proposed approach is sped up by at least four times for long time series by the introduced cache strategy. In comparison to the existing approaches, the online matrix profile makes a good trade-off between accuracy and efficiency. More importantly, it is generic to various types of time series in the sense that it works without the constraint from any trained model.