skip to main content
10.1145/3292500.3330680acmconferencesArticle/Chapter ViewAbstractPublication PageskddConference Proceedingsconference-collections
research-article

Time-Series Anomaly Detection Service at Microsoft

Published: 25 July 2019 Publication History

Abstract

Large companies need to monitor various metrics (for example, Page Views and Revenue) of their applications and services in real time. At Microsoft, we develop a time-series anomaly detection service which helps customers to monitor the time-series continuously and alert for potential incidents on time. In this paper, we introduce the pipeline and algorithm of our anomaly detection service, which is designed to be accurate, efficient and general. The pipeline consists of three major modules, including data ingestion, experimentation platform and online compute. To tackle the problem of time-series anomaly detection, we propose a novel algorithm based on Spectral Residual (SR) and Convolutional Neural Network (CNN). Our work is the first attempt to borrow the SR model from visual saliency detection domain to time-series anomaly detection. Moreover, we innovatively combine SR and CNN together to improve the performance of SR model. Our approach achieves superior experimental results compared with state-of-the-art baselines on both public datasets and Microsoft production data.

Supplementary Material

MP4 File (p3009-ren.mp4)

References

[1]
{n.d.}. https://github.com/linkedin/luminol.
[2]
{n.d.}. http://iops.ai/dataset_detail/?id=10.
[3]
{n.d.}. http://iops.ai/competition_detail/?competition_id=5&flag=1.
[4]
{n.d.}. http://workshop.aiops.org/files/logicmonitor2018.pdf.
[5]
Chris Chatfield. 1978. Holt-Winters forecasting Procedure. Journal of the Royal Statistical Society, Applied Statistics 27, 3 (1978), 264--279.
[6]
Laurens DeHaan and Ana Ferreira.2007. Extreme value theory: an introduction. Springer Science & Business Media.
[7]
Carl Doersch. 2016. Tutorial on variational autoencoders. arXiv preprint arXiv: 1606.05908 (2016).
[8]
Chenlei Guo, Qi Ma, and Liming Zhang.2008. Spatio-temporal saliency detection using phase spectrum of quaternion fourier transform. (2008).
[9]
Xiaodi Hou, Jonathan Harel, and Christof Koch. 2012. Image signature: Highlighting sparses alient regions. IEEE transactions on pattern analysis and machine intelligence 34, 1 (2012), 194--201.
[10]
Xiaodi Hou and Liqing Zhang. 2007. Saliency detection: A spectral residual approach. In Computer Vision and Pattern Recognition, 2007. CVPR'07. IEEE Conference on.IEEE, 1--8.
[11]
Nikolay Laptev, Saeed Amizadeh, and Ian Flint. 2015. Generic and Scalable Framework for Automated Time-series Anomaly Detection. In Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM, New York, NY, USA, 1939--1947.
[12]
Andy Liaw, Matthew Wiener, etal. 2002. Classification and regression by Random Forest. R news 2, 3 (2002), 18--22.
[13]
Dapeng Liu, Youjian Zhao, Haowen Xu, Yongqian Sun, Dan Pei, Jiao Luo, Xiaowei Jing, and Mei Feng. 2015. Opprentice:Toward spractical and automatic anomalydetection through machinelearning. In Proceedings of the 2015 Internet Measurement Conference. ACM, 211--224.
[14]
WeiLu and Ali A Ghorbani.2009. Network anomaly detection based on wavelet analysis. EURASIP Journal on Advances in Signal Processing 2009 (2009), 4.
[15]
Ajay Mahimkar, Zihui Ge, Jia Wang, Jennifer Yates, Yin Zhang, Joanne Emmons, Brian Huntley, and Mark Stockert. 2011. Rapid detection of maintenance induced changes in service performance. In Proceedings of the Seventh COnference on emerging Networking EXperiments and Technologies. ACM, 13.
[16]
Faraz Rasheed, Peter Peng, Reda Alhajj, and Jon Rokne. 2009. Fourier transform based spatial outlier mining. In International Conference on Intelligent Data Engineering and Automated Learning.Springer, 317--324.
[17]
Bernard Rosner. 1983. Percentage points for a generalized ESD many-outlier procedure. Technometrics 25, 2 (1983), 165--172.
[18]
Dominique Shipmon, Jason Gurevitch, Paolo M Piselli, and Steve Edwards.2017. Time Series Anomaly Detection: Detection of Anomalous Drops with Limited Features and Sparse Examples in Noisy Periodic Data. Technical Report. Google Inc.
[19]
Alban Siffer, Pierre-Alain Fouque, Alex and reTermier, and Christine Largouet. 2017. Anomaly detection in streams with extreme value theory. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM, 1067--1075.
[20]
Owen Vallis, Jordan Hochenbaum, and Arun Kejariwal. 2014. A Novel Technique for Long-Term Anomaly Detection in the Cloud. In 6th USENIX Workshop on Hot Topics in Cloud Computing (Hot Cloud14). USENIX Association, Philadelphia, PA.
[21]
Charles VanLoan. 1992. Computational frameworks for the fast Fourier transform. Vol.10. Siam.
[22]
Li Wei, Nitin Kumar, Venkata Lolla, Eamonn J. Keogh, Stefano Lonardi, and Chotirat Ratanamahatana. 2005. Assumption-freeAnomaly Detection in Time Series. In Proceedings of the 17th International Conference on Scientific and Statistical Database Management (SSDBM'2005).237--240.
[23]
Haowen Xu, Wenxiao Chen, Nengwen Zhao, Zeyan Li, Jiahao Bu, Zhihan Li, YingLiu, YoujianZhao, DanPei, YangFeng, etal.2018. Unsupervised Anomaly Detection viaV ariational Auto-Encoder for Seasonal KPIs in Web Applications. In Proceedings of the 2018 World Wide Web Conference on World Wide Web. International World Wide Web Conferences Steering Committee, 187--196.
[24]
Yin Zhang, Zihui Ge, Albert Greenberg, and Matthew Roughan. 2005. Network anomography. In Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement. USENIX Association, 30--30.
[25]
Rui Zhao, Wanli Ouyang, Hongsheng Li, and Xiaogang Wang. 2015. Saliency detection by multi-contextdeeplearning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.1265--1274.

Cited By

View all
  • (2025)A Distributed System for Early Intrusion Detection and Assessment of CybersecurityBlockchain - Pioneering the Web3 Infrastructure for an Intelligent Future [Working Title]10.5772/intechopen.1007155Online publication date: 31-Jan-2025
  • (2025)A Survey of Deep Anomaly Detection in Multivariate Time Series: Taxonomy, Applications, and DirectionsSensors10.3390/s2501019025:1(190)Online publication date: 1-Jan-2025
  • (2025)SCConv-Denoising Diffusion Probabilistic Model Anomaly Detection Based on TimesNetElectronics10.3390/electronics1404074614:4(746)Online publication date: 14-Feb-2025
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
KDD '19: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining
July 2019
3305 pages
ISBN:9781450362016
DOI:10.1145/3292500
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 25 July 2019

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. anomaly detection
  2. spectral residual
  3. time-series

Qualifiers

  • Research-article

Conference

KDD '19
Sponsor:

Acceptance Rates

KDD '19 Paper Acceptance Rate 110 of 1,200 submissions, 9%;
Overall Acceptance Rate 1,133 of 8,635 submissions, 13%

Upcoming Conference

KDD '25

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)860
  • Downloads (Last 6 weeks)82
Reflects downloads up to 15 Feb 2025

Other Metrics

Citations

Cited By

View all
  • (2025)A Distributed System for Early Intrusion Detection and Assessment of CybersecurityBlockchain - Pioneering the Web3 Infrastructure for an Intelligent Future [Working Title]10.5772/intechopen.1007155Online publication date: 31-Jan-2025
  • (2025)A Survey of Deep Anomaly Detection in Multivariate Time Series: Taxonomy, Applications, and DirectionsSensors10.3390/s2501019025:1(190)Online publication date: 1-Jan-2025
  • (2025)SCConv-Denoising Diffusion Probabilistic Model Anomaly Detection Based on TimesNetElectronics10.3390/electronics1404074614:4(746)Online publication date: 14-Feb-2025
  • (2025)Trustworthy AI-based Performance Diagnosis Systems for Cloud Applications: A ReviewACM Computing Surveys10.1145/370174057:5(1-37)Online publication date: 9-Jan-2025
  • (2025)Enhancing Multivariate Time Series Anomaly Detection With an Inference Stacked Recurrent-Autoencoder in Strong Mechanistic ContextsIEEE Transactions on Industrial Informatics10.1109/TII.2024.348580821:2(1724-1733)Online publication date: Feb-2025
  • (2025)Securing One-Class Federated Learning Classifiers Against Trojan Attacks in Smart GridIEEE Internet of Things Journal10.1109/JIOT.2024.348121312:4(4006-4021)Online publication date: 15-Feb-2025
  • (2025)Enhanced graph diffusion learning with dynamic transformer for anomaly detection in multivariate time seriesNeurocomputing10.1016/j.neucom.2024.129168619(129168)Online publication date: Feb-2025
  • (2025)Graph Anomaly Detection via Diffusion Enhanced Multi-View Contrastive LearningKnowledge-Based Systems10.1016/j.knosys.2025.113093311(113093)Online publication date: Feb-2025
  • (2025)RGAnomaly: Data reconstruction-based generative adversarial networks for multivariate time series anomaly detection in the Internet of ThingsFuture Generation Computer Systems10.1016/j.future.2025.107751167(107751)Online publication date: Jun-2025
  • (2025)An anomaly detection model for in-vehicle networks based on lightweight convolution with spectral residualsComputers & Security10.1016/j.cose.2024.104304151(104304)Online publication date: Apr-2025
  • Show More Cited By

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media