Meanies

[fanf]

In my previous post I said I was using the standard formula for the exponentially weighted moving average. This is not entirely true because the standard formula uses a complementary smoothing constant (α = 1 − a) which allows you to write the formula as an incremental adjustment to the previous value.

It's also possible to express the standard unweighted mean in a similar manner.

I was quite pleased when I found out about this analogy :-)

(Thanks to wikipedia for rendering the maths.)

Comments

[vatine]

Hm, I've used this very thing to detect spikes in incoming IP packets (using "daily packet count for protocol/port combo" as my averaged value) and simply using "average is less than 1/3 of next value" as a threshold for "something interesting just happened". I'm just wondering how good a technique that is.

[fanf]

Have a look at http://www.usenix.org/events/lisa2000/brutlag.html for a more sophisticated model.

[vatine]

Will do. I needed something quick half-way through doing an analysis on 13 months' worth of IP traffic aimed at non-responding destinations and that seemed to be a suitable mix of "understandable" and "quick to implement". Next round, I'll probably try both and see where they differ.