Time Series Forecasting Algorithms and Their Application in NetEase Game Monitoring

Introduction

Traditional monitoring relies on threshold, slope, and rate alerts, each with limitations. To achieve simpler and more accurate alerts, AIOps anomaly detection algorithms have flourished. While anomaly detection reacts after an issue occurs, many scenarios require forecasting to anticipate when a metric will reach a warning level, such as predicting future disk usage.

This article combines common time‑series forecasting algorithms with NetEase game monitoring practice to illustrate how to perform time‑series prediction.

Overview of Time‑Series Forecasting Algorithms

Industry forecasting methods can be grouped into three categories:

Traditional statistical models (e.g., exponential smoothing, ARIMA) – suitable for short‑term forecasts and require stationary data.

Neural‑network models (e.g., GRU, LSTM) – need abundant data, have longer training times, but offer higher accuracy.

Open‑source component models (e.g., Facebook Prophet, Google AdaNet) – integrate features like seasonality and changepoint detection, providing higher accuracy at the cost of more parameters.

Because forecasting heavily depends on historical data, no single model fits all time‑series; each algorithm excels in different scenarios.

Time‑Series Forecasting in NetEase Game Intelligent Monitoring

Forecasting is used for disk usage, network traffic, online player count, etc. Requirements differ: short‑term forecasts need real‑time performance, while long‑term forecasts prioritize trend accuracy. NetEase provides multiple models to meet diverse needs.

Short‑Term Forecasting

Typically predicts 5‑30 minutes ahead and demands real‑time computation. Simple statistical models are preferred.

Holt‑Winters

Holt‑Winters (triple exponential smoothing) updates with each new observation, modeling level, trend, and seasonality. Additive models suit stable seasonality; multiplicative models suit proportional seasonality.

In practice, Holt‑Winters incurs low overhead and can be fitted in real time, making it suitable for real‑time scenarios.

ARIMA

ARIMA (AutoRegressive Integrated Moving Average) combines autoregressive, differencing, and moving‑average components. It works well for non‑seasonal data but is sensitive to the choice of parameters (p, d, q). Model order is often selected via AIC/BIC, though the lowest score does not guarantee the best model.

Mid‑to‑Long‑Term Forecasting

Accuracy requirements are lower; the goal is to capture trends and issue early warnings (e.g., predicting when disk usage will hit a warning threshold). Computation can be batch‑oriented.

Period Identification

Automatic period detection is needed because data periods may vary. Methods include Fourier series and autocorrelation; NetEase primarily uses autocorrelation.

Trend‑Invariant Model

For data with irregular patterns but stable short‑term trends, this model trains on recent history and extrapolates the current trend.

STL Seasonal Model

STL (Seasonal‑Trend decomposition based on Loess) separates a series into trend, seasonal, and residual components via iterative inner and outer loops. The best decomposition result is combined with a linear regression (LR) model for trend prediction and added to seasonal and residual forecasts.

outer loop:
    calculate robustness weight;
inner loop:
    Step 1 de‑trend;
    Step 2 smooth seasonal subsequence;
    Step 3 low‑pass filter seasonal subsequence;
    Step 4 smooth trend of seasonal subsequence;
    Step 5 remove seasonality;
    Step 6 smooth trend;

Prophet

Facebook’s open‑source Prophet handles outliers, missing values, and automatically fits trend, seasonality, and holiday effects. It supports logistic or piecewise‑linear trend functions and can detect changepoints either manually or via a Laplace‑based algorithm.

LSTM

LSTM (Long Short‑Term Memory) networks excel at learning complex temporal patterns and can incorporate multivariate inputs. However, they require large datasets, extensive hyper‑parameter tuning, and significant computational resources, making them more suitable for periodic batch forecasts such as disk‑usage alerts.

Conclusion

NetEase has deployed various forecasting models across its monitoring platform, achieving satisfactory prediction accuracy. Selecting the appropriate model for each scenario—balancing latency, accuracy, and resource consumption—is essential for effective AIOps.