Deutsch
Alerts & thresholds

Anomaly detection

Anomaly detection is the identification of observations, events or data points that deviate from what is usual or expected. In SEO monitoring it is applied to series such as clicks, impressions, indexed pages or the share of error responses.

How does anomaly detection work?

The method first establishes what normal looks like, for example from the history of a metric including weekly cycles, and then flags values that fall outside that range. IBM names three kinds of anomalies:

  • Point anomalies are single values far from the rest, such as one day with almost no clicks.
  • Contextual anomalies are unusual only in context, for example normal traffic volume at a time when the site is usually quiet.
  • Collective anomalies are groups of values that deviate together, for instance several consecutive days of unusually low clicks that look normal one by one.

Techniques range from statistical tests to machine learning. Wikipedia sorts approaches by labeling. Supervised methods need labeled normal and abnormal examples, which are rarely available. Unsupervised methods work on unlabeled data and are the most commonly used.

Normal range, outlier, false alarm (example data, made up)Line chart with made-up example data over 56 days, shown as an index (100 = a typical weekday). An expected band shows the normal range for each weekday; at weekends it is lower. The line mostly moves within the band, which is normal noise. On day 24, a public holiday, the value drops below the band. This triggers an alert even though the cause is known, so it is a false alarm. From day 44 the value drops sharply and stays below the band. That is a real drop and a justified alert. The lower edge of the band serves as the threshold.Example data, made upExpected bandMeasured valueAlertFalse alarmIndex(100 = typical weekday)6080100120Day 1Day 14Day 28Day 42Day 56lower edge= thresholdnormal noise within the bandDay 24, public holiday: below theband, cause known → false alarmfrom day 44: sharply andpersistently below the band→ alertMade-up values for illustration. Band = expected value per weekday ± tolerance.Example data, made up.
Made-up example data. A metric mostly moves within its expected range. A public holiday falls outside the band and triggers a false alarm, while a sustained drop triggers a justified alert. Example based on practice, not a standard method. Schematic illustration.

How does it differ from a fixed threshold?

A fixed threshold compares a value with one number. Anomaly detection compares it with a range derived from past behavior. Microsoft’s Azure Monitor, as one example, builds its dynamic thresholds from the metric’s history and treats hourly, daily and weekly patterns as normal. This suits metrics with a seasonal rhythm, such as organic clicks, where a Sunday value would trigger a fixed limit set for weekdays.

Example

A site gets about 2,000 organic clicks on weekdays and 1,200 on weekends. On a Tuesday it gets 1,150 clicks. A fixed threshold of 1,000 stays silent, while anomaly detection flags the value because it is far below the usual Tuesday range. The team finds a canonical tag that was changed in the last release. (Invented example.)

Common mistakes

  • Training on a period that already contains an outage, so the fault becomes the new normal.
  • Expecting results from too little history. Azure Monitor, for example, does not alert before three days and 30 samples of data.
  • Treating every flagged value as a problem without checking the cause.

Sources

  1. What Is Anomaly Detection? – IBMibm.com
  2. What is Anomaly Detection? – AWSaws.amazon.com
  3. Anomaly detection – Wikipedia (secondary)en.wikipedia.org
  4. Dynamic thresholds in Azure Monitor alerts – Microsoft Learnlearn.microsoft.com

Last updated: