Package: sesd
Anomaly Detection: Seasonal ESDNote: All credit goes to Jordan Hochenbaum, Owen S. Vallis and Arun Kejariwa at Twitter, Inc. Any errors in the code are, of course, my mistake. Feel free to fix them.IntroSeasonal ESD is an anomaly detection algorithm implemented at Twitterhttps://arxiv.org/pdf/1704.07706.pdf. What better definition than the one they use in their paper:"we developed two novel statistical techniques
for automatically detecting anomalies in cloud infrastructure
data. Specifically, the techniques employ statistical learning
to detect anomalies in both application, and system metrics.
Seasonal decomposition is employed to filter the trend and
seasonal components of the time series, followed by the use
of robust statistical metrics – median and median absolute
deviation (MAD) – to accurately detect anomalies, even in
the presence of seasonal spikes."InstallationTo installsesd, use pip:pip install sesdExplanationThe algorithm uses the Extreme Studentized Deviate test to calculate the anomalies. In fact, the novelty doesn't come
in the fact that ESD is used, but rather onwhatit is tested.The problem with the ESD test on its own is that it assumes a normal data distribution, while real world data can have a multimodal distribution. To circumvent this, STL decomposition is used. Any time series can be decomposed with STL decomposition into a seasonal, trend, and residual component. The key is that the residual has a unimodal distribution that ESD can test.However, there is still the problem that extreme, spurious anomalies can corrupt the residual component. To fix it, the paper proposes to use the median to represent the "stable" trend, instead of the trend found by means of STL decomposition.Finally, for data sets that have a high percentage of anomalies, the research papers proposes to use the median and Median Absolute Deviate (MAD) instead of the mean and standard deviation to compute the zscore. Using MAD enables a more consistent measure of central tendency of a time series with a high percentage of anomalies.Usageimportnumpyasnpimportsesdts=np.random.random(100)# Introduce artificial anomaliests[14]=9ts[83]=10outliers_indices=sesd.seasonal_esd(ts,hybrid=True,max_anomalies=2)foridxinoutliers_indices:print(f'Anomaly index:{idx}, anomaly value:{ts[idx]}')>>>Anomalyindex:83,anomalyvalue:10.0>>>Anomalyindex:14,anomalyvalue:9.0Documentationseasonal_esd(seasonality=None, hybrid=False, max_anomalies=10, alpha=0.05): Computes the Seasonal Extreme Studentized Deviate of a time series. The steps taken are first to to decompose the time series into STL decomposition (trend, seasonality, residual). Then, calculate the Median Absolute Deviate (MAD) if hybrid (otherwise the median) and perform a regular ESD test on the residual, which we calculate as: `R = ts - seasonality - MAD or median.Argumentsts: The time series to compute the SESD.periodicity: The statsmodel library requires a periodicity to compute the STL decomposition If none is given, then it will automatically be calculated to be 20% of the total time series.hybrid: See Twitter’s research paper for the difference.`max_anomalies: The number of times the Grubbs’ Test will be applied to the time series.alpha: the significance level.ReturnsThe indices of the anomalies in the time series.esd(timeseries, max_anomalies=10, alpha=0.05, hybrid=False): Computes the Extreme Studentized Deviate of a time series. A Grubbs Test is performed max_anomalies times with the caveat that each time the top value is removed. For more details visithttp://www.itl.nist.gov/div898/handbook/eda/section3/eda35h3.htmArgumentsts: The time series to compute the ESD.max_anomalies: The number of times the Grubbs’ Test will be applied to the time series.alpha: the significance level.hybrid: If set to fa`lse then the mean and standard deviation will be used to calculate the zscores in the Grubbs test. If set to true, then median and MAD will be used.ReturnsThe indices of the anomalies in the time series.