Anomaly detection algorithm
Summarize
Summary of Anomaly detection algorithm
Instance Observer uses an anomaly detection algorithm based on the Z-score statistical model (a univariate method) to analyze five key performance metrics: Memory Max, Semaphore Mean, SQL Response Time, Server Response Time, and Transaction Count. This model has been validated with data sampled at daily, weekly, and monthly intervals across multiple instances.
Show less
Key Features
- Z-score methodology: Applies to Transaction Count, Server Response Time, and SQL Response Time. It measures how far a metric deviates from its historical mean in terms of standard deviations, considering cyclical patterns such as daily or weekly trends to distinguish true anomalies from normal fluctuations.
- Upper threshold-based methodology: Used for Semaphore Mean, Memory Max, and Job Execution metrics, which have predefined exhaustion limits. Alarms are triggered only when metric values approach or exceed these upper limits, indicating resource constraints or potential issues.
- Cyclicity consideration: The model accounts for repeating patterns in data (daily, weekly, seasonal) by calculating a cyclicity score. This score measures the similarity of recent data vectors to historical trends, helping to avoid false positives in anomaly detection.
What This Enables You to Do
With this anomaly detection algorithm, ServiceNow customers can proactively monitor critical instance performance metrics, identify unusual behaviors, and respond to potential issues before they impact system stability. The combined use of Z-score and upper threshold methods ensures sensitive and context-aware detection tailored to different types of performance data.
Practical Application
- Monitor Transaction Count, Server Response Time, and SQL Response Time anomalies using the Z-score metric relative to historical patterns.
- Track Semaphore Mean and Memory Max metrics against set exhaustion limits to detect resource saturation.
- Leverage cyclicity scores to ensure anomaly alerts reflect true deviations rather than expected cyclical variations.
Instance Observer is performing anomalies detection through the Z-score Statistical model, otherwise referred to as a univariate method.
Anomaly detection analyzes a set of five metrics, Memory Max, Semaphore Mean, SQL response time, Server Response Time and Transaction count. The detection model has been validated with samplings with multiple instances of daily, weekly, and monthly level data.
Metrics representing anomalies using the Z-score model are Transaction count, Server Response Time & SQL Response time. Metrics representing anomalies using an upper threshold-based approach are Semaphore Mean, Node max Memory, and Job execution. Refer to Generate performance charts for details on the five metrics.
Upper threshold-based methodology
Upper threshold-based methodology uses metrics with an exhausting limit. For example, metric A, which has a semaphore mean value of 14 or 16, which is used on the platform to limit the number of transactions that can occur on a node at one time to protect resources on the node. Metric B, memory max of 2 GB, where each node memory has a pre-defined maximum capacity. In all such similar cases, the situation is alarming only when the metrics are closer to the exhaustion limit. Even if the deviation is higher than the mean, but lower than the exhausting limit, then the threshold limit wouldn’t result in an alarm.
Z-score methodology
A Z-score is a numerical measurement that describes the relationship between a value to the mean of a group of values. Z-score is measured in terms of standard deviations from the mean. If a Z-score is 0, then the data point score is identical to the mean score.
The formula for calculating a Z-score is z = (x-μ)/σ:
x: The raw score of the data, as the moving average of the previous 15 minutesμ: The data population mean that is the average of the previous four weeks on the same day, same hour, and same minuteσ: The data population standard deviation
The cyclicity score is the similarity between two series which measure the similarity between two vectors and helps ensure that the Z-score model provides reliable insights and identifies true anomalies or outliers while considering the natural patterns of the data.
The cyclical score is calculated at the instance level with a data selection of four weeks divided into two-week vector increments, excluding weekends. The score returns the similarity score between the two, where a higher score indicates a more aligned similarity trend in the compared vector data.