Skip to content

Instantly share code, notes, and snippets.

@welch
welch / README.md
Last active April 27, 2016 20:44
exponential smoothing with de-seasonalization

Forecast

Holt-Winters smoother/forecaster for anomaly detection

Forecast threads a smooth curve through a noisy timeseries in a way that lets you visualize trends, cycles, and anomalies. It can be used as part of an automatic anomaly detection system for metric timeseries (that is, sequences of timestamped numerical values).

It accomplishes this using a variation of Holt-Winters forecasting -- more generally known as exponential smoothing. Forecast decomposes a noisy signal into level, trend, repetitive "seasonal" effects, and unexplained variation or noise. In this example, a "season" is a day long, and we model repeated day-over-day variation. The result is a smoothed version of the signal which may be used to forecast future values or detect unexpected variation. This approach has been successfully used for [network anomaly detection](https://www.usenix.org/legacy/event/lisa2000/full_papers/br

@welch
welch / holt.juttle
Last active August 29, 2015 14:14
Holt forecasting
// Holt forecaster, which models an unobserved
// level and trend component in a noisy signal. The result is a smoothed
// version of the signal which may be used to forecast future values.
//
// Y is the point field to smooth.
// slevel and strend are smoothing factors, numbers ranging [0..1].
// They determine how quickly the smoother adjusts to new values as they arrive.
// Setting a factor to 0 freezes the feature at its initial estimate,
// while setting a factor to 1 causes that feature to depend solely
// on the most recent point. Setting strend to null removes that feature
@welch
welch / main.juttle
Created January 17, 2015 00:36
forecast error-based timeseries anomaly detection example
// timeseries anomaly detection based on a forecast confidence interval
// A EWMA smoothed version of the timeseries is computed, and its time-varying
// variance provides an expected range for the subsequent point in the series.
// When the series falls outside this envelope, an event is generated.
//
// This is ad-hoc and difficult to tune, but demonstrates the basic
// idea of forecast-error-based anomaly detection in a single timeseries.
//
sub cpu(from, to) {
demo cdn metrics 'cpu' -from from -to to -every :m:
@welch
welch / installing-opencv-2.4.5-macosx-10.8.4-anaconda-1.6.0
Created September 6, 2013 19:17
How to to build OpenCV 2.4.5 from the distribution tarball using cmake, on Mac OSX 10.8.4, linked to an anaconda installation.
It is a rite of passage to post one's successful build instructions for OpenCV on a Mac
after you've tried all the other conflicting instructions out there and still failed.
brew failed for me (was this because I could never get a happy brew doctor situation?
I'll never know). macports? nope. build-from-source recipes? I didn't find one that
worked for me.
Here's what did work to build OpenCV 2.4.5 from the distribution tarball using cmake,
on Mac OSX 10.8.4, linked to an anaconda installation rather than the system python.
It is a mashup of various bits of advice out there. If you're already comfortable with
build/install from source, all you need to read is the cmake invocation in step 3 and