The article discusses the problem of predicting failures to ensure the uninterrupted state of the server and the application of anomaly detection methodology to solve this problem. Some solutions in this area are briefly analyzed and the advantage of the method based on the Holt-Winters forecasting model is described. A mathematical formulation of the problem of detecting anomalies and a formalized description of the method for solving the research objectives are carried out. Several shortcomings of the standard method for detecting anomalies in the operation of server systems have been identified. Several additions are proposed that allow you to adapt the method for solving work goals and reduce the number of false positives. To improve the forecasting accuracy, point anomalies entering the model input are additionally smoothed by a weighted moving average. To eliminate redundant detections associated with the simultaneous appearance of anomalies, a comprehensive assessment of the server state is introduced. To exclude false alarms associated with noisy data, only those anomalous events are recognized, in which an abnormal state of the server remains for a period of time. Computational experiments were carried out to evaluate the resulting improved method. It is concluded that the proposed additions make it possible to improve the forecasting accuracy of the model and reduce the number of false positives of the method, and the method can be used for early detection of gradual failures in the operation of server systems.
Server systems are often one of the central elements in the corporate information system
of enterprises. Server failures can lead to the loss of valuable information and
significant financial costs, which necessitates ensuring the smooth operation of such
systems. One of the relevant approaches for these purposes is the introduction of
proactive monitoring systems [
One of the tools for implementing proactive monitoring systems are anomaly
detection methods. An anomaly is understood as a piece of data in which the behavior
of an object significantly differs from the standard or expected behavior. In this context,
the task is reduced to the detection of contextual and collective new anomalies in real
time [
Analysis of the works shows that there is no universal method for detecting
anomalies for solving any problem [
The paper considers an anomaly detection method based on the Holt-Winters
forecasting model [
The purpose of this work is to study and supplement the anomaly detection method based on the Holt-Winters model for predicting failures in server systems. Within the framework of this goal, the article first provides a mathematical formulation of the problem of detecting anomalies and a formalized description of the application of the problem to the server's operation. Then, a number of additions to the standard anomaly detection method are proposed, which allow it to be adapted to achieve the set goal and to reduce the number of redundant detections. Taking into account the additions, a modified method for detecting anomalies is described. After that, computational experiments are carried out to evaluate the proposed additions. At the last stage, the results were discussed and tasks for further research were proposed.
Each corporate server S can be described with a list of parameters P characterizing its state, P = {x1, x2 ,.., xn} . Then the state of the server Zt at a moment in time t is described by a vector of values of its parameters.
= (⋮
) 1, ,
The standard formulation of the problem of detecting anomalies consists in constructing a functional dependence f : xi,t →{−1,1} such that: x i,t = normal, f (xi,t ) = 1 anomaly, f (xi,t ) = −1 ,
To analyze the state of the server, it is necessary to collect statistical information about its work. The values of each parameter xi P known at discrete points in time t = 1, T represent a time series Xi = {xi,1, xi,2 ,.., xi,T} .
To analyze the state of the server, it is necessary to collect statistical information about its work. The values of each parameter known at discrete points in time represent a time series.
The basic technique for detecting anomalies in time series, based on the forecasting
model, consists in generating a forecast for each parameter value and calculating the
forecast error. A significant deviation of the forecast from the actual value indicates the
presence of an anomaly [
To simplify further notation, information about an arbitrary parameter x О P is
described without specifying an index. The Holt-Winters multiplicative model was
used as a forecasting model. The model is described by the following system of
equations [
+ (1 − )∗ ( −1 + −1) = ∗ + (1 − )∗ − = ∗ ( − −1)+ (1 − )∗ −1 , { + = ( + ∗ )∗ − +
Where Rt is an exponentially smoothed series; Tt - trend value; St - the seasonal
component of the series; xt+ m - forecast for m steps; a,b , g - coefficients of
smoothing of the series, trend and seasonality; L - seasonality period. Training of the
model (3) consists in the selection of the optimal values a,b , g . The selection is carried
(1)
(2)
(3)
out using an enumeration of possible combinations of parameters in order to minimize
the loss function for cross-validation [
To detect anomalous values, the Brutlag method is used [
1, xt [ xmin t , xmax t ] f ( xt ) = −1, xt [ xmin t , xmax t ] .
Where m is the coefficient of the interval width.
As a result, the value xt is considered abnormal if it is outside the boundaries of the predicted value (4), and normal in the opposite case:
Using the Brutlag method to detect anomalies has a number of advantages: the administrator does not need to manually create thresholds, the threshold values are not static and are adjusted to the server state, and this method allows you to detect many anomalies. But when applying the method to solve research problems, a number of shortcomings were identified. Below is a number of author's additions that allow us to eliminate the disadvantages indicated below and to adapt the use of the Holt-Winters model and the Brutlag method for detecting anomalies in the operation of server systems and some other types of complex information systems.
Appendix 1. It has been investigated that the Holt-Winters model (3) shows less
accurate forecast results on the series with an increased noise level [
Parameter values that are recognized by the Brutlag method as anomalous, and do
not retain their anomalous value in the future, are considered single random outliers in
the data. When forming the next forecast, such emissions are additionally smoothed by
replacing the actual value with a weighted moving average [
K −1 (K − i) * xt −i xt* = i=0
, K i i=1
Where xt* is the value of the point outlier supplied to the input of the Holt-Winters model. This addition presumably leads to a decrease in the influence of noise on the formation of a forecast and an increase in its accuracy. (4) (5) Appendix 2. The server is a multi-parameter system; the occurrence of anomalies in its operation can be caused by the exit of several parameters at once outside the permissible intervals. The standard approach identifies each deviation as a new anomaly.
To exclude redundant detections, not the value of an individual parameter is analyzed, but the state of the object as a whole. The state of the server Zt is considered normal Z N if all values of the server parameters are in the normal range, and abnormal
(6) (7) Zt = ZN , x P, xt [ xmin t , xmax t ] .
ZA , x P, xt [ xmin t , xmax t ]
Appendix 3. Time series describing server states are not stationary and can be quite
noisy [
To exclude such alarms, only those anomalous events A are recognized, in which the abnormal state of the server remains at the time interval p:
A = Z1,.., Z p , Zt , Zt = Z A , t = 1, p .
Taking into account the additions, the modified anomaly detection method consists of the following steps: ─ Collect statistical data on the values of parameters that characterize the state of the server; ─ Determine the value of seasonality L and smoothing parameters a, b, g for model (3), the coefficient of the width of the interval for detecting anomalies; ─ Collect new actual values of the server parameters that require analysis; ─ For each parameter, generate a forecast based on the history of previous values, taking into account the condition: if there are point anomalies in the history, replace each outlier value with a weighted moving average based on K of previous normal values; ─ Determine the measure of deviation of the predicted values from the actual ones; ─ For each forecast, determine the boundaries of the area of normal values (4); ─ For each parameter value, determine the belonging to the area of normal or abnormal data (5); ─ Record the anomalous state of the server if there is at least one parameter that is in the area of anomalous values (6); ─ Record the occurrence of an anomalous event, while maintaining an anomalous state of the server during p time steps (7); ─ Repeat from step 3.
To assess the correctness of the proposed improved method for detecting anomalies, computational experiments were carried out, the results of which are presented in the next section of the article.
To prepare an experimental study, the values of 4 parameters were recorded from 2 computer servers within 3 weeks with a discreteness of 1 minute. The sufficiency of these parameters for assessing the state of servers is not considered in the article. The statistics for the first two weeks served as a training sample for further experiments. The selection of the optimal smoothing coefficients a, b, c for the Holt-Winters model was made on the training sample. Seasonality parameter L corresponds to a weekly period and is equal to 1440 measurements. The parameter of the interval width m for the Brutlag method is empirically selected as 6 units. A smaller value leads to a larger number of detections that slightly deviate from the normal range.
On the control sample, for each parameter value, a short-term forecast one step ahead
was formed based on the previous history. The accuracy of the obtained model results
was assessed using the MAPE metric [
Where xt is the actual value of the series, xt is the predicted value of the series, N is the number of measurements.
Two options for the formation of forecasts are considered. In the first version, the average accuracy of which is indicated in the table as MAPE1 , the classical application of the Holt-Winters model was carried out. The implementation of the second version of the forecasts ( MAPE2 ) was carried out taking into account the first addition described in the previous section. The previously recognized point anomalous values, when fed into the model (3), are replaced by a weighted moving average of the three previous normal values. Information about server parameters, smoothing coefficients and experiment results is presented in Table 1.
According to the results of the experiment, it can be seen that, in general, the HoltWinters model shows a fairly high accuracy in predicting the values of server parameters. For parameters with a high random component, the forecast accuracy is slightly lower. For such parameters, an increase in accuracy is observed when applying the principle described in the first supplement of the previous section.
For the first server: For the second server:
2.65 MAPE1 9.5, MAPE1 = 4.88. 2.65 MAPE2 9.08, MAPE2 = 4.77.
2.4 MAPE1 12.7, MAPE1 = 5.5. 2.4 MAPE2 11.29, MAPE
(8) (9) (10)
Using the described additions, the method recognized only those anomalous values that were simulated by software. The Brutlag method additionally recognized point random outliers that are caused by the partially stochastic behavior of the server and are not of interest for diagnosing the state of the object.
The occurrence of an anomalous event on the Memory Usage graph of the first server
is shown in Figure 1. The blue line on the graph denotes actual values, orange
predicted values. The green and brown lines indicate the upper and lower boundaries
of the normal range. The occurrence of an anomalous event is marked in the figure with
red dots.
The development of anomaly detection methods based on the Holt-Winters forecasting
model is of practical and research interest, which is confirmed by research in this
direction [
Based on the results of the experiment, it can be argued that the Holt-Winters model
shows good results when predicting the values of server parameters. A study on the
analysis of the SARIMA model for predicting server load demonstrates less accurate
forecast results [
When using the Brutlag method, it is recommended [
It was revealed that the Brutlag method generates redundant triggers in the case when several server parameters are simultaneously abnormal. To exclude redundant detections, not the value of an individual parameter is analyzed, but the state of the object as a whole. In addition, the method detects point random outliers that are caused by the partially stochastic behavior of the server and are not of interest for diagnosing its state. To exclude such alarms, only those anomalous events are recognized, in which the anomalous state of the server persists for a time interval. The proposed additions to the method make it possible to reduce the number of false positives, which is demonstrated using a computational experiment.
The application of the modified method makes it possible to recognize contextual collective anomalies, which may indicate the occurrence of gradual failures in the functioning of the server, which makes it possible to eliminate possible problems even at the stage of their inception. 5
The work is based on the results of a previous study by the authors [