Time series analysis of event data
You turn event counts into time series, find seasonality, trends, spikes and regular-interval communication (beaconing), and set expected levels with simple forecasts.
Level 301 · 16 lessons · 12 practice labs
Lessons
Basics
- What a time series is: regular intervals, frequency
- Resampling and gaps
- Time zone and daylight saving traps
- Quick task: an hourly series from raw events
Components
- Trend and seasonality
- Decomposing a series
- Autocorrelation: patterns that repeat
- Quick task: the weekly business pattern
Finding the unusual
- Baselines: how much is normal
- Spike detection: rolling z-score and MAD
- Change points
- Regular-interval connections (beaconing)
- Quick task: find regular traffic to a command server
Forecasting
- Simple forecasting: moving average and exponential smoothing
- Alert thresholds from forecast intervals
- Capstone: anomalies and beaconing in DNS query volume
Practice labs
- A per-minute series from raw events: Turn payment events with scattered timestamps into a per-minute series and fill the minutes without events with zeros.
- Gap or silence: Tell whether interruptions in a sensor series are data loss or real silence by comparing with a second source.
- An hour counted twice at the clock change: Find the fake peak and dip caused by a daylight-saving change in a series kept in local time and fix them by converting to UTC.
- Extract the weekly pattern: Derive the day-of-week average from three months of ticket openings and write down the quietest and busiest day.
- Decompose a series: Decompose hourly web traffic into trend, seasonality and residual and list the three largest deviations left in the residual.
- A hidden period through autocorrelation: Find the repeating period in a host's outbound-connection series with autocorrelation and assess whether working hours can explain it.
- Deviation from a baseline: Take the four-week same-hour average as the baseline and find the hours when today's login count went outside normal.
- Spike detection with a rolling MAD: Apply rolling z-score and rolling MAD to an e-mail send series and compare which spikes each one catches.
- Find regular-interval connections: Measure the variability of connection intervals to separate jittered beacon traffic from thousands of normal connections.
- A moving-average forecast: Compute tomorrow's forecast for daily VPN sessions with a seven-day moving average along with its past error.
- Find the change point: Find the moment of change in an error rate that rose for good after a configuration change and write the before and after averages.
- Alert thresholds from forecast intervals: Produce an hourly forecast and interval with exponential smoothing, flag the hours outside the interval as alerts and report the false-alarm count.
About this course
You turn event counts into time series, find seasonality, trends, spikes and regular-interval communication (beaconing), and set expected levels with simple forecasts.
What you will learn
- Basics
- Components
- Finding the unusual
- Forecasting
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.