Proposed Algorithm for Alert Generation

1
Proposed Algorithm for Alert Generation

• Connie Logg

2
Assumptions

• We do not want frequent alerts for small changes
• At this point I am only going to talk about this
  algorithm with respect to Jiris one minute abwe
  value
• It is still in refinement!

3
Overview

• We have a data set with fluctuating values
• We want to alert on major thruput drops
• Although the algorithm also identifies thruput
  increases

4
Overview

• There are 2 buffers that we work with in the code
• History buffer which contains previously analyzed
  data
• Trigger buffer where out of range values are
  stored
• Currently the history buffer has a max size of 60
  entries (one hour). It never has values of 0 in
  it.
• The Trigger buffer has a max size of 10 entries
  (ten minutes)

5
The algorithm (1)

• When invoked, the history buffer is loaded with
  the first 10 entries.
• The mean and stdev of these 10 entries is
  calculated
• These become the last mean (lastmean), the
  last stdev (laststdev), and the last
  variance (lastvar) last stdev2

6
The Algorithm (2)

• Definition
• Sensitivity sens factor applied to lastvar
  to calculate the trigger state
• Trigger definition
• A value (val) is stored in the Trigger buffer
  if
• ABS(val) gt lastmean(senslastvar)
• for val gt lastmean (BW increase) OR
• A value (val) is stored in the Trigger buffer
  if
• ABS(val) lt lastmean-(senslastvar)
• for val lt lastmean (BW decrease)

7
The Algorithm (3)

• Outlier definition
• A value is an outlier if
• ABS(val) gt lastmean (senslastvar2)
• For val gt lastmean (BW increase) OR
• ABS(val) gt lastmean - (senslastvar2)
• For val gt lastmean (BW decrease)
• Direction definition
• Direction is up if val gt lastmean
• Direction is down if val lt lastmean
• Direction none if it has not been defined

8
The Algorithm (4)

• oldval 0, unless history buffer is full. If
  full, oldest value is removed and stored in
  oldval.
• Significance definition If a value is
  significant, it is included in the history buffer
  and used in the stats. This is a filter to keep
  the standard deviation from becoming too small.
• if (ABS(val-lastmean)/lastmean lt.2) AND
• (Trigger buffer is empty) AND
• (History buffer is full) AND (NOT
  significance(oldval))
• then significance(val) false
• else significance(val) true

9
The Algorithm (5) trigger(val) false

• If NOT trigger(val) then
• Check if history buffer is full
• If so, oldval oldest value
• If significance(val), val is added to the
  history buffer and new mean and stdev are
  calculated AND the oldest value is removed from
  the trigger buffer if it has data
• ELSE If NOT significance(val), val -val. It
  is added to the history buffer, but it is not
  included in the stats calculation
• Move on to the next point

May need refinement
10
The Algorithm (6) trigger(val) true

• direction direction(last trigger buffer entry)
  
• newdirectiondirection(val).
• If outlier(val) val -val (quarantine it)
• If empty(triggerbuffer) direction
  newdirection
• add the value to the trigger buffer
• If direction NE none AND direction NE
  newdirection
• Note that the values have gone from below the
  mean to above the mean, or from above the mean to
  below the mean
• Add the ABS(trigger buffer values) to the summary
  buffer
• Calculate the new mean and stdev
• Empty the trigger buffer
• direction none
• Move on to the next point

11
The Algorithm (6) trigger(val)
true(continued)

• If full(Trigger buffer), we have a trigger for an
  alert
• Empty the history buffer OR add trigger buffer to
  history buffer (under study)
• Transfer the ABS(trigger buffer values) in the
  History buffer
• Calculate the new mean and stdev