The time series that appear in IT monitoring environments are not always amenable to ARIMA or related methods. I have been exploring the mode as a statistic from which to build a signature for a time series. If time permits I will show how standard ML methods can be applied to these signatures for classification.

1. July 2015
Using Modes for Time Series Analysis
Extraordinary.
Everyday.

2. About this Talk
Time Series
Classification
IT
Operations
Analytics
Pattern
Recognition
Anomaly
Detection

3. About Me
Computer
Science
• UT Austin
Math
• UT Austin
• UW
Madison
Finance
• Interactive
Brokers
Software
Development
• Tally Solutions
Data
Science
• Microland
Rohit Chatterjee
RohitC@microland.com

4. IT Operations Management
IT Systems are monitored
continuously
Large quantities of
machine data generated
Scope for automated
analysis

5. Time Series in IT Monitoring Data

6. Goal
We Need Features
We Want to Classify These Series

7. Looking for Features
Mean
Variance
Max
Min
Peak-to-peak
Slope
Not enough
We could try:

8. Limitations of Mean and Variance
Both these series have the
same value for σ / μ
But they look very different!

9. Consider the Mode
Single Mode Two Modes

10. Modal “Strength”
One mode, almost 100% of
the series
Each mode is at around
50%

11. The “Run Ratio”
-The run is broken
-The longer run is around
80% of the modal series
-The first mode’s run is unbroken
-100% of the modal series
(Similarly for the second mode…)

12. The “Run Ratio w.r.t the Parent”
80% of the entire window Only 50% of the entire window

13. Using the Run Ratio
The mode in
each graph has
a strength of
98%
Vs.
This one has a
larger run ratio

14. What if There is No Mode?

15. The Difference Series
d(n) = s(n) – s(n-1)

16. The Difference Series of a Step Graph

17. A Signature

18. Also, We’re Hiring RohitC@microland.com

19. www.microland.com
Q & A