Article body
Full article
Introduction
Traditional BI monitoring often relies on a fixed threshold, such as sending an alert whenever sales fall below RMB 1 million. This approach has two weaknesses.
A fixed threshold cannot adapt to the business. Singles’ Day sales differ from normal days, and a seasonal business cannot use one threshold throughout the year. A low threshold causes repeated false alerts during a promotion, while a high threshold can hide a real problem.
A fixed threshold evaluates a point, not a trend. A metric at RMB 1.02 million does not trigger an alert set below RMB 1 million. If the previous two periods were RMB 1.5 million and RMB 1.48 million, however, the continuing decline deserves attention.
Anomaly Detection uses statistics and machine learning to describe normal behavior, then identifies departures from its seasonal pattern, trend, and expected range. Hengshi BI provides a multi-algorithm anomaly detection system within its metric-monitoring capabilities.
1. The Limits of Fixed Thresholds
1.1 Three Blind Spots
Seasonal false positives
Weekend sales at a retailer may be three times weekday sales. A weekday threshold triggers repeated weekend alerts, while a weekend threshold can hide an unusual weekday decline. One fixed number cannot express different normal ranges within a cycle.
Trend-related false negatives
A metric can decline from 150 to 102 in small weekly steps. No single week crosses the alert threshold, but the cumulative decline reaches 32%. The problem may have continued for weeks by the time the metric crosses the fixed limit.
Multidimensional blind spots
Normal sales across East China do not guarantee that the “East China × new product line × mobile” segment is normal. Monitoring one dimension at a time cannot detect this combination.
1.2 The Principle Behind Intelligent Detection
Intelligent anomaly detection learns a metric’s normal behavior before identifying data points that depart from it.
Normal behavior is a historical pattern rather than a fixed number. It includes the mean, expected variation, seasonality, and trend. Detection algorithms learn these patterns from history and measure how far new data departs from them.
2. Hengshi BI’s Anomaly Detection Algorithm Matrix
Hengshi BI selects or combines several algorithms according to the data’s characteristics.
2.1 Statistical Methods
The 3σ rule (mean and standard deviation)
For data that approximates a normal distribution, values more than three standard deviations above or below the mean can be treated as anomalies.
- Suitable for metrics with a near-normal distribution and no strong seasonality, such as response time and error rate.
- Less effective for seasonal data and long-tailed distributions.
Interquartile range (IQR)
IQR defines the normal range as [Q1 - 1.5 × IQR, Q3 + 1.5 × IQR], where Q1 and Q3 are the lower and upper quartiles. Values outside this range are marked as anomalies.
- Suitable for non-normal data and more robust against extreme values.
- Still unable to model seasonality without an added seasonal model.
Period-over-period and year-over-year deviation
These methods compare the current value with a historical reference:
- Period over period divides the current value by the previous value and subtracts one.
- Year over year divides the current value by the same period last year and subtracts one.
Period-over-period checks capture short-term shocks, while year-over-year checks detect changes against a longer-term seasonal reference. Both are less sensitive to slow drift caused by small changes in each period.
2.2 Time-Series Decomposition
Data with trend and seasonality can be decomposed into three parts:
- Trend represents the long-term direction.
- Seasonality represents recurring daily, weekly, or annual movement.
- Residual represents the remaining variation after removing trend and seasonality.
The system detects anomalies in the residual. A point is anomalous only when it still exceeds the statistical limit after the expected trend and seasonal effects have been removed.
This method suits metrics with clear seasonality, such as daily retail sales, electricity load, and website traffic. Hengshi can use STL, Seasonal-Trend decomposition using Loess, or Fourier-based seasonality extraction.
2.3 Machine-Learning Methods
Isolation Forest
Isolation Forest uses randomized partitioning trees to identify uncommon points that differ from the rest of the data. Normal points require more partitions to isolate, while anomalies require fewer.
The algorithm suits multidimensional patterns, such as conversion falling while average transaction value rises and visit duration shortens.
LSTM autoencoder
An LSTM autoencoder learns normal time-series behavior and reconstructs its input. A large reconstruction error indicates an anomaly.
The method suits data with long-term dependencies and complex patterns, such as several years of minute-level monitoring. It requires more history and training resources and offers less explainability, so Hengshi reserves it for high-value core metrics.
Local Outlier Factor (LOF)
LOF compares a point’s local density with the density of its neighbors. A point with much lower density is marked as an anomaly.
The method suits local clusters of unusual behavior, such as an abnormal pattern within a market segment.
2.4 Algorithm Selection
Hengshi BI matches algorithms to the data:
- Strong seasonality calls for time-series decomposition.
- Multidimensional combinations call for Isolation Forest.
- Near-normal, stable metrics can use 3σ or IQR.
- Metrics with a clear historical reference can use period-over-period or year-over-year deviation.
- Core metrics with enough history can use an LSTM autoencoder.
Users choose high or low sensitivity, and the system adjusts algorithm parameters within that range. High sensitivity detects more signals and may create more false positives. Low sensitivity reports only more severe anomalies.
3. Engineering Anomaly Detection
3.1 Baseline Learning
A new metric must accumulate enough data to establish normal behavior:
- Learning period: The data should cover at least two complete cycles. A weekly metric needs at least two weeks, while an annual metric needs much more history. Transfer learning can shorten the cold start.
- Behavior during learning: The system collects data without sending alerts, avoiding cold-start false positives.
- Learning result: The system derives baseline parameters such as mean, variance, seasonality, and trend before enabling detection.
Limited history can be supplemented with a metric that has a strong correlation. South China sales, for example, can borrow a preliminary baseline from national sales.
3.2 Multidimensional Drill-Down
An aggregate metric can appear normal while a segment is anomalous. The system might find that “sales × East China × online × appliances” fell 28% from the previous period.
The system can:
- Pre-aggregate metrics across commonly used dimension combinations.
- Run anomaly detection for each combination.
- Drill through the dimension hierarchy to locate the segment with the highest anomaly concentration.
The final result can explain that the East China online-appliance segment contributed 62% of the total decline instead of reporting only that sales were abnormal.
3.3 Reducing Alert Noise
Too many low-value alerts cause users to ignore important signals. Hengshi uses four controls to reduce noise.
Severity levels
- P0, critical: More than 3σ from the baseline or a decline greater than 50%; alert immediately.
- P1, attention: Between 2σ and 3σ or a decline of 20% to 50%; include it in the daily digest.
- P2, observation: Between 1σ and 2σ; record it without an active alert.
Root-cause grouping
One cause can affect several metrics. In that case, the system combines them into one root-cause alert. A data-source delay that disrupts several metrics produces one alert naming the source and affected metrics.
Quiet periods
The system sends only one real-time alert for the same anomaly on the same metric within 24 hours. A continuing issue remains visible in the daily digest.
Dynamic suppression
During a major promotion, the system can switch to a baseline derived from earlier promotions, reducing false positives caused by expected campaign volatility.
3.4 Explanation and Attribution
After detecting an anomaly, the system also looks for possible causes.
Correlation analysis searches other metrics from the same period. If sales fall while website availability drops from 99.9% to 97%, the system can identify service instability as a possible cause.
Event correlation compares the anomaly with enterprise events such as campaigns, maintenance windows, and holidays.
Natural-language explanation turns the detection and attribution results into text that names the time, magnitude, related metrics, and recommended investigation.
4. Connecting Anomaly Detection with Agentic BI
4.1 Detection Triggers Analysis
A traditional workflow alerts a person and waits for manual analysis. Agentic BI can trigger a Data Agent after detection, run a root-cause analysis, and generate a report. The user receives an analytical conclusion rather than an unexplained signal.
4.2 A Feedback Loop
User feedback can improve the detection model:
- A false-positive label adjusts the metric’s sensitivity or baseline.
- Confirmation of a real issue increases the weight of similar patterns.
Ongoing feedback helps the system adapt to the specific business.
5. Common Problems and Remedies
Problem 1: Historical Anomalies Contaminate the Baseline
A promotional spike or outage during the learning period can distort the baseline and cause normal data to appear anomalous.
Remedy: Use robust statistical methods such as Median Absolute Deviation (MAD) to identify and remove historical anomalies before calculating the baseline.
Problem 2: Ignoring Data Granularity
Daily and minute-level sales have different noise levels and should not use identical parameters.
Remedy: Smooth real-time data with a time window, such as a five-minute moving average, then select parameters for that granularity.
Problem 3: Uniform Sensitivity Across Metrics
Uniform parameters can miss a critical KPI while creating repeated false positives for a secondary metric.
Remedy: Configure sensitivity by business importance. Use more conservative thresholds for core KPIs such as revenue and gross margin, and higher sensitivity for exploratory metrics.
6. Summary
Once an enterprise grows from dozens of metrics to thousands, fixed thresholds cannot represent seasonality, trend, and multidimensional combinations. Hengshi BI’s anomaly detection system uses three main design elements:
- An algorithm matrix that combines statistics, time-series decomposition, and machine learning according to the data.
- Multidimensional drill-down that traces an aggregate anomaly to a segment and its contribution.
- Alert reduction through severity levels, root-cause grouping, quiet periods, and dynamic suppression.
Metric monitoring can then detect departures from normal behavior before a value crosses a fixed boundary.