Supervised Learning

Anomify uses a consensus of multiple detection analysis alongside a semi-supervised learning process to classify data points as normal or abnormal. Lets look at the semi-supervised learning process in more detail.

Supervised learning involves training Anomify to recognise patterns of expected behaviour present in your metrics. Doing so will reduce anomalies.

You can supervise Anomify by labelling a section of time series data as normal. A pattern is created from this time series. Anomify checks the pattern against new data at each analysis run. When a pattern match occurs a false positive anomaly is prevented.

Semi-Supervised Learning

Anomify will also create new patterns of expected behaviour that are similar to trained patterns, which are created by users. It does this of its own accord.

Seasonality

Metrics exhibit seasonality, they repeat in expected ways. Take a look at this metric for instance it changes in this way and that:

Creating a pattern of normal behaviour

A pattern is a section of metric data which represents normal functioning of the metric.

Patterns match with future metric data which reduces false positive alerts.

The sections of time series you can convert into expected patterns of behaviour are the days running up to and including a anomaly.

If you think Anomify has wrongly classified an data point as an anomaly you should consider training the anomaly.

When you train Anomify you are - retabling an anomaly and the data running up to it as a false positive. - creating a pattern of expected behaviour from the data running up to and including the anomaly.

To create a pattern of normal behaviour from the dashboard (Slack version): 1. Select an anomaly from a the main metric graph on a metric page 2. Select the TRAIN ANOMIFY button 3. Answer EXPECTED to "Does this behaviour look unexpected?"

Short-term patterns are used to create a baseline of normal metric behaviour. Long-term patterns enable Anomify to learn related patterns of expected behaviour autonomously from future metric data.

Seasonality

When you train the system you are arming Anomify with expected patterns of behaviour. For a pattern to be expected it’s likely that you will have seen it before and you will see it again, it might come and go like the seasons each year. Once you’ve captured these seasonal changes in expected patterns. You will receive far fewer alerts and then Anomify will start to define similar expected patterns by its own accord. Across a typical organisation's metrics, patterns prevent two thirds of anomalies, and save hours of unnecessary debug time.