Dynamic Thresholding

Dynamic Thresholding

Introduction

The purpose of the Dynamic Thresholding Evaluation Tool is to demonstrate the creation of dynamic thresholding values on a live stream of data using a subset of the actual product’s features.  The evaluation tool is limited to the use of time series data, though this is not a limitation of the product or platform.

Deriving a Dynamic Threshold

To produce Dynamic Thresholding values for a dataset, we divide the dataset into a series of windows. The definition of a window is configurable with the command-line parameters described below. Thresholding bounds are created for each window by looking at a set of previous windows and using the real high and low values from that set. In order to obtain a more “normal” set of context windows, we discard windows that have been determined to be anomalous. Elements of the historical context used to determine thresholds are configurable with command-line parameters.

Architecture

The Dynamic Thresholding Evaluation Tool runs as a java command-line application, with data input through a dedicated ingress port.  Once enough data is provided to the tool, thresholds can be calculated on the server and displayed in the visualization available via a WebKit-based browser on another port.  Results of these calculations can be exported to CSV from this interface.

The Demo Interface

Overview

  • the information bar,
  • the main chart viewport,
  • the chart navigation brush, and
  • the control area

The Information Bar

The information bar shows information relevant to the current analysis.  It shows the number of records currently in the system as well as the date ranges represented by the data.  This information bar is updated as new data is added into the system.

 

 

The Main Chart Viewport

The main chart viewport shows is responsible for depicting the underlying data and the analysis of that data.  This viewport depicts three kinds of information at various times:

  • underlying data
  • threshold values
  • context details

Underlying Data

The underlying data records are depicted as a line chart.  The X-axis corresponds to time series values in the data and the Y-axis corresponds to the raw data values for the metric.  Note that display data is sometimes compressed to avoid oversampling the chart.  The analysis is still performed on full-resolution data.  The compression technique employed is designed to retain data shape and will not eliminate important data elements.

Threshold Values

Threshold values are depicted as a conjoined floating bar chart.  The upper portion of each bar indicates the upper threshold of the related window and the lower portion indicates the lower threshold.  Violations of the thresholds are depicted as red, heat mapped regions above or below the thresholds violated.

Context Details

Analysis contexts are depicted in several ways.  When viewing a very large scope of time, context windows are indicated yellow or red vertical bars corresponding to the subject window, indicated as a white vertical bar.  Viewing the context details while in a narrow data scope yields a more complete view of the data in the context.  In both cases, yellow context windows are windows that fit the contextual profile and have been included as elements of the given context.  Red context windows are windows that were excluded because they were too anomalous when compared with other context windows (as defined by the context window inclusivity option described below in the Threshold Manipulation section).

The Chart Navigation Brush

The chart navigation brush enables the user to navigate to different portions of the data.  The brush always contains a depiction of the complete data set in order to provide the user with a means of looking at any portion of the data quickly.