HawkEye: A Real-Time Anomaly Detection System

Satnam Singh

Use case: IT Infrastructure Monitoring

• Local Anomalies

• Global Anomalies

Anomaly Types: Demo

BaselineGlobal Anomaly

Number of Requests madeon Retail website

Tuesday Tuesday Tuesday

HawkEye: Anomaly Detection Framework

1. Data Stream

Complexity Estimator

2. Local Anomaly Detection

3. Global Anomaly Detection

4. AnomalySuppressionand Fusion

AlertsdB

Metricsdata

UserDashboard

Local Anomaly Detection

- Page’s Test- Parametric Models - One Class SVM- Kernel Density

Estimator- Ensemble of

Detectors

CPU

Baseline1

Baseline2

Anomaly1

Anomaly2

Anomaly3

Memory

µ +3σ-3σ

Local Anomaly Detection: Page’s Test

Process beginsat t = 75

Detectiondeclared at t = 80

h = 30

Test statistic 1max 0, ( )n n nS S g x

log likelihood ratio

Test statistic Sn is “clamped” at zero

( )( ) ln

( )K n

nH n

f xg x

f x

Local Anomaly Detection Results: Page’s Test

Seasonality Detection and Prediction

Time Series Models- ARMA

Summary• Real-time anomaly detection• Local anomalies + Global Anomalies• Anomaly suppression - alerts• Ensemble of detectors• Hyper-parameters tuning using multi-model

approach