# Time Series Anomaly Detection for KPIs Based on Correlation Analysis and HMM
## 1 Introduction
However, it is difficult to analyze all abnormal data and solve faults in a short time during intelligent operation and maintenance. In the actual maintenance process, it is necessary to find other KPIs that cause a KPI anomaly, so as to reduce the time of investigation and improve the processing efficiency. Therefore, it is necessary to quickly find the class of abnormal KPIs so as to repair and eliminate the corresponding fault. The Hidden Markov Model (HMM) [9] can capture the transition relationship between time-dependent data, and infer corresponding hidden states by establishing the transition relationship between observation states and hidden states, which fulfills the requirements of the system maintenance process. There are some problems in the current KPI anomaly detection methods:  
1. Most of the current anomaly detection methods ignore the correlation between multiple indicators. Without considering this correlation, false negatives may arise. In addition, the factors considered by the correlation analysis methods are not comprehensive enough, and the effect of the volatility of the original data on the correlation analysis of abnormal trends is also ignored. 2. Some time series-based anomaly detection methods are processed by RNN, LSTM, and other models, but these models themselves have the problem of error accumulation and require a lot of training memory. 3. Most anomaly detection methods only focus on the detection of indicators with anomalies, and ignore the influence relationship between multiple indicators. A large number of abnormal indicators will make the operation and maintenance personnel's troubleshooting efficiency low. To solve these problems, this paper first proposes a time series prediction model, 1D-CNN-TCN (1D Convolutional Neural Network and Temporal Convolutional Network),to predict and obtain a residual sequence of KPIs, as well as to screen abnormal KPIs in a certain period. Then, a time series anomaly detection method for KPIs based on correlation analysis and HMM is proposed to detect exceptional KPIs and find other KPIs that may cause a KPI exception. The contributions of this paper are summarized as follows:  
This paper considers such problems as the lack of consideration for the volatility of original KPI data interfering with correlation and correlation factors. In the KPI anomaly detection method, correlation analysis based on a KPI residual sequence is included. The residual sequence can highlight an abnormal section of the time series data, and exclude the influence of the original fluctuation trend of the time series data on the abnormal fluctuation. At the same time, correlation analysis of KPIs is carried out by comprehensively considering multiple factors, such as correlation value, shift value along the time axis, and the order of influence. Through the above methods, the accuracy of the correlation analysis is improved;  
1. This paper considers that RNN, LSTM and other methods have error accumulation problems and require a large amount of training memory. 1D CNN (One-Dimensional Convolutional Neural Network) and TCN (Temporal Convolutional Network) are combined, and a time series prediction model, 1D-CNN-TCN, is proposed to predict KPIs. The structural characteristics of 1D CNN and TCN make it possible to avoid the gradient explosion and error accumulation caused by insufficient memory during model training;
2. In this paper, correlation analysis and HMM are combined to realize anomaly detection in KPI time series. Using the correlation matrix constructed by correlation analysis as the parameters, HMM can adaptively adjust the initial parameters and quickly infer abnormal KPIs that affect specific KPIs. The rest of this paper is organized as follows: Section 2 introduces the background knowledge of KPI anomaly detection and the groundwork of correlation analysis. Section 3 elaborates the time series anomaly detection framework based on correlation analysis and HMM. Section 4 evaluates the performance of the proposed framework and compares it with related methods.