How Prime Video distills time series anomalies into actionable alarms


Prime Video customers must be able to reliably stream content at all times on any device that supports the Prime Video application, such as mobile phones, smart TVs, or video game consoles.

Related content

The switch to WebAssembly increases stability, speed.

For the Prime Video team, deploying and maintaining the application on such a broad scale entails custom code configurations and third-party integrations that are unique to particular geographical regions and families of devices. This diversity poses the risk of a fragmented customer experience, wherein device- or region-specific issues affect only a subset of customers.

Manually setting alarms that monitor the quality of the Prime Video application across all combinations of customer activities, device types, and regions is infeasible. However, this problem can be reframed as a large-scale, online, time-series anomaly detection problem, such that an automated monitoring solution alerts on-call engineers to deviations from expected behavior in observed traffic.

The Cartesian product of independent metric dimensions results in a combinatorial explosion of time series describing different aspects of customer activity on Prime Video.

In this post, we shed light on practical challenges that arise when applying anomaly detection to time series describing customer activity and present a selection of mitigating techniques. The proposed solutions distinguish different categories of deviations induced by fluctuating customer viewing behavior and have contributed to a significant reduction in the false alarms that would otherwise distract Prime Video engineers from meeting real customer needs.

Sample time series containing two notable deviations from expected behavior. Only the second deviation corresponds to a customer-impacting malfunction, whereas the first was caused by an external event.

This distinction is especially challenging because innocuous drops in metric traffic can look very similar to those caused by genuine incidents. The graph below depicts two independent deviations from expected behavior that would be regarded as anomalous in the absence of any additional information. However, after inspecting the contexts surrounding these two anomalies, we discovered that only the second was caused by a correctable software malfunction, whereas the first was simply an artifact of lower Prime Video viewership while an external event was taking place.

Innocuous changes to customer viewing behavior on media-streaming platforms such as Prime Video can be driven by several factors. In this post, we shall focus on what we shall henceforth refer to as special events, which we further categorize as

  1. anticipated special events, e.g., major sporting tournaments;
  2. unanticipated low-impact special events, e.g., sunny weather encouraging more outdoor activities;
  3. unanticipated high-impact special events, e.g., breaking news broadcasts or natural disasters.

Taxonomy of different types of special events affecting Prime Video customer traffic.

1. Anticipated special events

Prime Video viewers sometimes seek content that is available only on other services. For instance, highly anticipated sporting events, such as the NFL Super Bowl or the FIFA World Cup, are known to dominate TV ratings on regular broadcasting.

Related content

Detectors for block corruption, audio artifacts, and errors in audio-video synchronization are just three of Prime Video’s quality assurance tools.

Conversely, Prime Video exclusives, such as NFL Thursday Night Football games, and tentpole content launches, such as The Lord of the Rings: The Rings of Power, are expected to result in transient surges in metric traffic. In the absence of context, the deviations in either direction may be large enough to be flagged as anomalous, resulting in false alarms about the state of the Prime Video application.

If a complete schedule of events that are expected to affect metric traffic is available, anomaly detection models can be enhanced by covariates or exogenous variables. Taking forecasting-based anomaly detection as an example, the inclusion of covariates should result in more meaningful predictions against which anomaly scores can be computed.

A binary encoding of scheduled events, wherein an activation indicates the occurrence of an external event.

Leveraging covariates for this purpose remains nontrivial. For example, different matches within a tournament attract differing viewership, depending on which teams are playing, the risk of a popular team being knocked out, etc. It is challenging to encode such nuances in a binary covariate that is activated whenever any external event is ongoing, and further offline analysis of historical data is required to identify additional associative or causal variables that influence the deviations induced by different events.

2. Unanticipated low-impact special events

Curating an exhaustive list of relevant events for geographically dispersed customers is a near-impossible task, especially when compounded by the wide variety of devices on which the Prime Video application is available. Events can also be rescheduled at short notice, invalidating any provisions made to accommodate them. In our taxonomy, unanticipated low-impact events are events that are unaccounted for but whose overall impact may still be discernible by other means.

Related content

Team from Amazon Web Services also wins the best-paper award at the Workshop on Detection and Classification of Acoustic Scenes and Events.

To mitigate the impact of incomplete covariate information, we advocate for an ensemble-based approach combining multiple detectors that explicitly capture different characteristics of time series behavior, such as mean, variance, trend, etc. When monitoring Prime Video metrics, we found that relying solely on models that gauge the magnitude of a deviation, such as forecasting-based scorers, was insufficient. Meanwhile, introducing additional derivative and correlation-based detectors greatly enhanced our ability to filter out innocuous anomalies related to special events.

Examples of how two complementary anomaly scorers (forecasting- and derivative-based) can be treated as an ensemble for assessing the severity of an anomaly. Note how in the second example, the derivative-based scorer indicates an anomaly only during the period where the trend is reversed, whereas the increased forecasting-based score persists beyond the initial deviation.

3. Unanticipated high-impact special events

Some special events happen not only unexpectedly but with such sudden and drastic impact that they are especially hard to distinguish from a genuine malfunction. Examples include widespread power outages due to natural disasters and breaking-news broadcasts announcing election results, the unexpected passing of a public figure, etc.

Related content

CVPR papers examine the recovery of 3-D information from camera movement and learning general representations from weakly annotated data.

Mimicking the judgment of an end user triaging an anomaly post hoc is often the best way to handle such unpredictable and dramatic deviations. The effects of external events can often be distinguished from application malfunctions by their correlation with other metrics in the affected region. More specifically, at the time an anomaly is detected for Prime Video, we are interested in verifying whether similar deviations have also been observed for metrics describing services on distinct technology stacks.


Identifying distinct categories of special events and deploying appropriate remedies have been invaluable for improving how we monitor metrics describing customer activity. This has allowed Prime Video engineers to instead focus their time on delivering more new and exciting features for customers. One consideration this post hasn’t touched upon is the risk of missing a genuine incident as a result of introducing additional suppression mechanisms. This is an important factor that should be regularly assessed and effectively communicated to end users of the monitoring service.

Related content

Automated-reasoning method enables the calculation of tight bounds on the use of resources — such as computation or memory — that results from code changes.

The operational challenges of delivering reliable anomaly detection in practical settings are often disregarded as domain-specific idiosyncrasies. Consequently, they are largely overlooked in the prolific stream of novel modeling and methodological contributions appearing in the literature on time series anomaly detection. The insights shared in this blog post are not exhaustive either, but we hope this serves as a useful guide for practitioners facing similar issues and motivates broader research on both domain-specific and domain-agnostic mechanisms for translating detected anomalies into actionable alarms.

Source link


Please enter your comment!
Please enter your name here

Share post:


More like this

It’s Beginning To Look A Lot Like Annual Review Time—5 Inclusive Tips

Year-end employee reviews begin occurring this time...

Cisco, AWS further integrate cloud management capabilities

In addition AWS Internet Monitor lets customers quickly...

I got this titanium wallet in the post-Cyber Monday sale to match my titanium iPhone and Watch

I personally own a Ridge wallet because I...

Where Rosario Dawson Goes To Find Hope

During the past 27 years the Lower Eastside...