Interval Detection V2¶

The V2 version of interval detection establishes a confidence interval based on the historical data of the current detection metrics to predict the normal fluctuation range. The Guance system compares the data characteristics of the current time period with historical data to check if the data exceeds the predetermined confidence interval. If a data point exceeds this range, the system will determine it as an anomaly and may trigger an alert; if the data point is within the normal range, the system will continue monitoring to ensure the stability and security of real-time data.

Key features:

• In-depth analysis: Establishes a confidence interval based on the historical data of the detection metrics to predict the normal fluctuation range.
• Continuous updates: Continuously updated by the Guance algorithm team to provide more data processing capabilities.

Concepts¶

Confidence interval range (confidence_interval): A metric used to define the tolerance for the upper and lower bounds of the confidence interval for time series data within a specific detection range. The parameter value ranges from 1% to 100%. For data with large fluctuations and strong randomness, a larger tolerance value can be appropriately chosen; conversely, for data with relatively regular fluctuations, the tolerance range can be correspondingly reduced.

Setting a larger confidence interval range results in wider upper and lower boundaries, thereby reducing the number of detected anomalies. If the confidence interval is set too small, it may detect a large number of anomalies. And if the confidence interval is set too large, it may fail to detect any anomalies. Therefore, setting the confidence_interval parameter reasonably according to the different characteristics of the data is crucial. Correct parameter settings ensure that important anomaly signals are not missed, and the system does not become overly sensitive to normal fluctuations in the data.

Illustration:

Detection Configuration¶

Detection Frequency¶

The execution frequency of the detection rule, default is 10 minutes, cannot be changed.

Detection Metrics¶

The monitored metrics data.

Trigger Conditions¶

Set the trigger conditions for alarm levels: You can configure any one of the emergency, critical, warning, or normal trigger conditions. Supports upward (data increase), downward (data decrease), or both upward and downward forms of data comparison.

Configure trigger conditions and severity levels, when the query result contains multiple values, any value meeting the trigger condition will generate an event.

For more details, refer to Event Level Description.

Data Gaps¶

For data gap states, seven strategies can be configured.

1. Link to the detection interval time range, judge the query results of the most recent minutes of the detection metrics, do not trigger events;

2. Link to the detection interval time range, judge the query results of the most recent minutes of the detection metrics, treat query results as 0; at this point, the query results will be re-compared with the thresholds configured in the Trigger Conditions section above to determine whether to trigger an anomaly event.

3. Customize filling the detection interval value, trigger data gap events, trigger urgent events, trigger critical events, trigger warning events, and trigger recovery events; if this configuration strategy is chosen, the custom data gap time configuration should be >= detection interval time. If the configured time <= the detection interval time, there may be simultaneous satisfaction of data gaps and anomalies; in such cases, only the data gap handling results will be applied.

Information Generation¶

After enabling this option, the detection results that do not match the above trigger conditions will generate “information” events and write them.

Other Configurations¶

For more details, refer to Rule Configuration.