Prime Video customers must be able to reliably stream content at all times on any device that supports the Prime Video application, such as mobile phones, smart TVs, or video game consoles.
For the Prime Video team, deploying and maintaining the application on such a broad scale entails custom code configurations and third-party integrations that are unique to particular geographical regions and families of devices. This diversity poses the risk of a fragmented customer experience, wherein device- or region-specific issues affect only a subset of customers.
Manually setting alarms that monitor the quality of the Prime Video application across all combinations of customer activities, device types, and regions is infeasible. However, this problem can be reframed as a large-scale, online, time-series anomaly detection problem, such that an automated monitoring solution alerts on-call engineers to deviations from expected behavior in observed traffic.
In this post, we shed light on practical challenges that arise when applying anomaly detection to time series describing customer activity and present a selection of mitigating techniques. The proposed solutions distinguish different categories of deviations induced by fluctuating customer viewing behavior and have contributed to a significant reduction in the false alarms that would otherwise distract Prime Video engineers from meeting real customer needs.
This distinction is especially challenging because innocuous drops in metric traffic can look very similar to those caused by genuine incidents. The graph below depicts two independent deviations from expected behavior that would be regarded as anomalous in the absence of any additional information. However, after inspecting the contexts surrounding these two anomalies, we discovered that only the second was caused by a correctable software malfunction, whereas the first was simply an artifact of lower Prime Video viewership while an external event was taking place.
Innocuous changes to customer viewing behavior on media-streaming platforms such as Prime Video can be driven by several factors. In this post, we shall focus on what we shall henceforth refer to as special events, which we further categorize as
- anticipated special events, e.g., major sporting tournaments;
- unanticipated low-impact special events, e.g., sunny weather encouraging more outdoor activities;
- unanticipated high-impact special events, e.g., breaking news broadcasts or natural disasters.
1. Anticipated special events
Prime Video viewers sometimes seek content that is available only on other services. For instance, highly anticipated sporting events, such as the NFL Super Bowl or the FIFA World Cup, are known to dominate TV ratings on regular broadcasting.
Conversely, Prime Video exclusives, such as NFL Thursday Night Football games, and tentpole content launches, such as The Lord of the Rings: The Rings of Power, are expected to result in transient surges in metric traffic. In the absence of context, the deviations in either direction may be large enough to be flagged as anomalous, resulting in false alarms about the state of the Prime Video application.
If a complete schedule of events that are expected to affect metric traffic is available, anomaly detection models can be enhanced by covariates or exogenous variables. Taking forecasting-based anomaly detection as an example, the inclusion of covariates should result in more meaningful predictions against which anomaly scores can be computed.
Leveraging covariates for this purpose remains nontrivial. For example, different matches within a tournament attract differing viewership, depending on which teams are playing, the risk of a popular team being knocked out, etc. It is challenging to encode such nuances in a binary covariate that is activated whenever any external event is ongoing, and further offline analysis of historical data is required to identify additional associative or causal variables that influence the deviations induced by different events.
2. Unanticipated low-impact special events
Curating an exhaustive list of relevant events for geographically dispersed customers is a near-impossible task, especially when compounded by the wide variety of devices on which the Prime Video application is available. Events can also be rescheduled at short notice, invalidating any provisions made to accommodate them. In our taxonomy, unanticipated low-impact events are events that are unaccounted for but whose overall impact may still be discernible by other means.
To mitigate the impact of incomplete covariate information, we advocate for an ensemble-based approach combining multiple detectors that explicitly capture different characteristics of time series behavior, such as mean, variance, trend, etc. When monitoring Prime Video metrics, we found that relying solely on models that gauge the magnitude of a deviation, such as forecasting-based scorers, was insufficient. Meanwhile, introducing additional derivative and correlation-based detectors greatly enhanced our ability to filter out innocuous anomalies related to special events.
3. Unanticipated high-impact special events
Some special events happen not only unexpectedly but with such sudden and drastic impact that they are especially hard to distinguish from a genuine malfunction. Examples include widespread power outages due to natural disasters and breaking-news broadcasts announcing election results, the unexpected passing of a public figure, etc.
Mimicking the judgment of an end user triaging an anomaly post hoc is often the best way to handle such unpredictable and dramatic deviations. The effects of external events can often be distinguished from application malfunctions by their correlation with other metrics in the affected region. More specifically, at the time an anomaly is detected for Prime Video, we are interested in verifying whether similar deviations have also been observed for metrics describing services on distinct technology stacks.
Outlook
Identifying distinct categories of special events and deploying appropriate remedies have been invaluable for improving how we monitor metrics describing customer activity. This has allowed Prime Video engineers to instead focus their time on delivering more new and exciting features for customers. One consideration this post hasn’t touched upon is the risk of missing a genuine incident as a result of introducing additional suppression mechanisms. This is an important factor that should be regularly assessed and effectively communicated to end users of the monitoring service.
The operational challenges of delivering reliable anomaly detection in practical settings are often disregarded as domain-specific idiosyncrasies. Consequently, they are largely overlooked in the prolific stream of novel modeling and methodological contributions appearing in the literature on time series anomaly detection. The insights shared in this blog post are not exhaustive either, but we hope this serves as a useful guide for practitioners facing similar issues and motivates broader research on both domain-specific and domain-agnostic mechanisms for translating detected anomalies into actionable alarms.
