For those following along - this method attempts to do anomaly detection in 3 dimensions: time, 'metric' and query. I interpret query to be something like 'polo

For those following along - this method attempts to do anomaly detection in 3 dimensions: time, 'metric' and query. I interpret query to be something like 'polo shirts' or 'PEZ dispensers,' and metric to be something like 'sales volume' or 'median sale price.' The 'aggregation' method just takes a preset number of changes (10 'percentile' or 'quantile' - the language is inconsistent) in a metric-query pair for a given time. After that, I get really confused (if you fix T, how can you have timeseries in T?) but the final output is essentially top 90 percentile of metrics, plotted over time (and independent of query). It's difficult to see how this method is groundbreaking or novel. At any rate - the final step in this post is to search for anomalies by metric. So if you have more than k anomalous metrics for a given time t you classify that as a disruption. I think this is calculated by median absolute deviation, which is probably fine. What isn't clear in the paper or in the post is how many (or which!) anomalies in the metrics are sufficient to qualify as a disruption. It's probably not a great idea to assume equal weight on the features, but I don't know if that's what's going on here. The associated paper also claims that 70% of the 'alerts' were on-target - but makes no mention of how many disruptions were uncaught. You're always going to have pretty good hit rate, but you're not always going to catch a lot!