# Time Series Anomaly Detection for KPIs Based on Correlation Analysis and HMM
## 4 Experiment
### Abnormal Screening of KPIs Based on 1D-CNN-TCN
#### 4.1.2 Results of Anomaly Screening Based on 1D-CNN-TCN  
The KPI indexes in Table 1 are filtered to derive KPI indicators with overall anomalies at known times. The anomalies for each KPI are shown in Figure 5. The red annotation in the image shows the suspected anomaly point, and the blue line segment is the starting time of the injection anomalies. In the anomaly detection diagram in Figure 5, the \(x\)-axis represents the time in seconds, and the \(y\)-axis represents the value of each indicator at each time point. After using the method of this paper to screen the indicators in Table 1, the results are compared with the abnormal time points of specific KPIs given by the competition. If 3-sigma screens out abnormal KPI points, the KPI anomaly is considered in the whole period. Figure 5a-s correspond to the abnormal screening results of the 18 KPIs given in Table 1. In general, abnormal KPIs with the same cause usually show anomalies within the same short period. The red node represents some of the abnormal points in the KPI abnormal period, and the two blue lines represent the starting periods of the two different faults given in the game fault label file. The abnormal times selected in Figure 5c-h,j are closer to the starting period of the first fault (the first blue line), indicating that these seven KPIs are anomalies caused by the first fault. The abnormal times selected in Figure 5a,k-p are closer to the starting time of the second fault (the second blue line), indicating that these seven KPIs are anomalies caused by the second fault. The abnormal periods of the 14 selected abnormal KPIs are near to the abnormal periods of corresponding KPIs in the fault label file given by the 2021 AIOps competition, so the abnormality screening is accurate. In Figure 5b,i, the time corresponding to the anomalies is too far from the starting time of the two faults, and so it cannot be considered that these two KPIs are caused by the faults marked by the blue line in the figure. The KPIs corresponding to Figure 5c,s do not filter out outliers, and this conforms to the instructions given by the fault tag file. Figure 5 shows that the abnormal period detected in Figure 5i does not conform to the description in the fault label file. The abnormal KPI results obtained by abnormal screening are not accurate enough. It is necessary to further analyze the abnormal KPIs screened via correlation analysis to improve the accuracy of detection. At the same time, the abnormal influence sequence between multiple indicators can be obtained. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Time** & **Duration** & **cmbdid** & **Anomalous Indicator** \\ \hline \multirow{8}{*}{8:39:00-04-03-2021} & \multirow{8}{*}{300} & \multirow{8}{*}{MG02} & OSlinux-CPU\_CPU-3\_SingleCpuUtil; & \multirow{8}{*}{OS Linux-CPU\_CPU-0\_SingleCpuidle; } \\  & & & & OSlinux-CPU\_CPU-0\_SingleCpuidle; \\  & & & & OSlinux-CPU\_CPU-0\_SingleCpuidle; \\  & & & & OSlinux-CPU\_CPU-1\_SingleCpuidle; \\  & & & & OSlinux-CPU\_CPU-1\_SingleCpuidle; \\  & & & & OSlinux-CPU\_CPU-1\_SingleCpuidle; \\  & & & & OSlinux-CPU\_CPU-CpuUtil; \\  & & & & OSlinux-CPU\_CPU\_CPUUdleutil; \\  & & & & OSlinux-CPU\_CPU\_CPUUdleutil; \\ \hline \multirow{8}{*}{19:49:00-04-03-2021} & \multirow{8}{*}{300} & \multirow{8}{*}{Tomcat03} & OSlinux-OSlinux, LOCALDISK, LOCALDISK-sdb, DSKTsp; & \multirow{8}{*}{OS Linux-OSlinux\_LOCALDISK, LOCALDISK-sdb, DSKWTp; } \\  & & & OSlinux-OSlinux, LOCALDISK, LOCALDISK-sdb, DSKReadWrite; & \multirow{8}{*}{OSlinux-OSlinux\_LOCALDISK, LOCALDISK-sdb, DSKBsp; } \\  & & & OSlinux-OSlinux, LOCALDISK, LOCALDISK-sdb, DSKBsp; & \multirow{8}{*}{OS Linux-OSlinux\_LOCALDISK, LOCALDISK-sdb, DSKPercentBusy;} \\ \cline{1-1} \cline{5-5} \cline{7-7}  & & & OSlinux-OSlinux, LOCALDISK, LOCALFigure 5: Cont.