ARIMA

The AR(p) term models the dependent relationship between an observation and a specified number of lagged observations (p). It assumes past values linearly influence future values. For example, an AR(2) model predicts today's network latency based on latency readings from the two previous time steps. The coefficient for each lag quantifies its predictive weight, capturing momentum and cyclic patterns in network telemetry data.

The I(d) term applies differencing to make the time series stationary—removing trends and seasonality so statistical properties remain constant over time. A non-stationary series like cumulative call drops must be differenced (d=1) to stabilize its mean. This step is critical because AR and MA components assume stationarity. Without it, the model produces spurious regressions and unreliable forecasts.

The MA(q) term models the dependency between an observation and the residual errors from a moving average applied to lagged observations. It captures shock effects and short-term fluctuations. An MA(1) model adjusts its forecast based on the previous period's forecast error, making it effective for detecting sudden contextual anomalies in metrics like signal-to-noise ratio where random shocks are common.

ARIMA identifies anomalies by analyzing forecast residuals—the difference between predicted and actual values. When a residual exceeds a dynamic threshold (typically ±3 standard deviations of the historical residual distribution), it flags a potential anomaly. This approach distinguishes between:

• Additive outliers: single-point spikes
• Innovational outliers: sustained shifts affecting subsequent observations
• Level shifts: abrupt changes in the baseline mean

ARIMA generates prediction intervals around each forecast, typically at 95% or 99% confidence levels. Observations falling outside these bounds are candidates for anomaly alerts. Unlike static thresholds, these intervals dynamically widen as the forecast horizon extends, reflecting increasing uncertainty. This adaptive boundary reduces false positives compared to fixed-threshold methods like simple Z-Score analysis.

SARIMA(p,d,q)(P,D,Q)s extends ARIMA with seasonal components for data exhibiting recurring patterns—like hourly network traffic peaks. The seasonal order (P,D,Q) operates on observations separated by the seasonal period s (e.g., s=24 for daily cycles in hourly data). This makes SARIMA superior for KPI anomaly detection in telecom where diurnal usage patterns create predictable seasonality that must be modeled before residual analysis.