What is change point detection?什么是变点检测？
This focused article is part of the anomaly detection and root cause analysis guide; use the pillar guide to compare related concepts, methods, and implementation decisions across the full topic.
本文是异常检测与根因分析指南内容集群中的专题文章；如需比较完整主题下的相关概念、方法与实施决策，请返回基石指南。
Change point detection identifies times where a time series' statistical behavior changes and remains different, such as a shift in mean, variance, trend, seasonality, or the full distribution. The output is one or more candidate boundaries that divide the observations into internally consistent regimes.
变点检测用于识别时间序列统计行为发生并持续改变的时刻，例如均值、方差、趋势、季节性或整体分布的变化。其输出是一个或多个候选边界，把观测序列划分为内部相对一致的状态区间。
A change point is not automatically a fault or a cause. A software release, pricing policy, sensor recalibration, season transition, or data-pipeline rewrite can all create a valid regime shift. Detection locates evidence of change; interpretation requires event logs, domain knowledge, and a decision rule. This boundary matters because point anomaly detection asks whether an observation is unusual under the current regime, while changepoint detection asks whether the regime itself changed.
变点不一定代表故障，更不等于原因。软件发布、定价策略、传感器重新校准、季节切换或数据管道改写，都可能造成合理的状态变化。检测只负责定位变化证据；解释还需要事件日志、领域知识与决策规则。两者边界很重要：单点异常检测关注某个观测在当前状态下是否异常，而变点检测关注状态本身是否已经改变。
When change point detection is the right tool何时适合使用变点检测
Find sustained shifts in latency, defect rate, energy use, throughput, conversion, or sensor baselines after an unknown time.
发现延迟、缺陷率、能耗、吞吐、转化率或传感器基线从未知时刻开始的持续变化。
Split a historical series into stable regimes, then compare releases, operating modes, policies, or environmental conditions across segments.
把历史序列划分为稳定区间，再比较各区间对应的版本、工况、政策或环境条件。
Detect when residuals, score distributions, or error rates shift enough to trigger review, retraining, or recalibration.
识别残差、评分分布或错误率何时发生足以触发复核、重训或再校准的变化。
Check whether a measured shift aligns with a known intervention, while avoiding causal claims when timing is the only evidence.
检查观测变化是否与已知干预时间一致，但仅有时间重合时不能据此宣称因果。
Do not start with change detection when you only need isolated spike alerts, when timestamps or ordering are unreliable, or when the series is too short to estimate behavior on both sides of a boundary. If the intervention time is known and the question is its effect, interrupted time-series or causal methods may be more appropriate. If seasonality explains repeated shifts, model that structure before treating each cycle as a new regime.
如果只需孤立尖峰告警、时间戳或顺序不可靠，或序列短到无法估计边界两侧行为，就不应先用变点检测。若干预时间已知且问题是评估其效果，中断时间序列或因果方法可能更合适。若重复变化由季节性解释，应先建模该结构，避免把每个周期误判成新状态。
Prepare time-series data before detecting change points变点检测前如何准备时间序列
- Define the signal: state the metric, unit, entity, aggregation window, expected cadence, and operational question.定义信号：明确指标、单位、实体、聚合窗口、预期频率与业务问题。
- Audit time: sort records, resolve duplicate timestamps, expose missing intervals, and distinguish zero from missing. Resampling can create artificial boundaries.审计时间：排序记录、处理重复时间戳、暴露缺失区间，并区分零值与缺失；重采样可能制造假边界。
- Record context: keep deployments, maintenance, promotions, holidays, policy changes, sensor swaps, and pipeline versions in a separate event table.记录上下文：把部署、维护、促销、节假日、政策变化、传感器更换与管道版本保存在独立事件表中。
- Choose the target change: decide whether mean, variance, slope, autocorrelation, count rate, covariance, or a general distribution should be stable within segments.选择变化目标：确定希望区间内稳定的是均值、方差、斜率、自相关、计数率、协方差还是一般分布。
- Protect evaluation: separate method tuning from the incident periods used for final assessment, and preserve causal time order.保护评估：把方法调优与最终评估使用的事故区间分开，并保持正确时间顺序。
Prerequisite check: plot the raw series, missingness, sampling gaps, and known events before running an algorithm. A detector can optimize its objective perfectly while answering the wrong operational question.
前提检查：运行算法前先绘制原始序列、缺失情况、采样间隔与已知事件。检测器可能完美优化数学目标，却回答了错误的业务问题。
Change point detection algorithms compared变点检测算法比较
| Method方法 | Best fit适合场景 | Key choice关键选择 | Main limitation主要局限 |
|---|---|---|---|
| CUSUM | Online monitoring for a specified shift from a reference process监控参考过程相对明确的在线偏移 | Reference value, allowance, threshold, reset rule参考值、容许量、阈值与重置规则 | Needs a credible baseline and shift model需要可信基线与变化模型 |
| PELT | Offline multiple-break segmentation with a penalized objective用惩罚目标离线识别多个断点 | Cost function, penalty, minimum segment length成本函数、惩罚项与最短区间 | Results can change materially with penalty结果可能对惩罚项高度敏感 |
| Binary segmentation二分分割 | Fast approximate offline search on longer series较长序列上的快速近似离线搜索 | Stopping rule and requested break count停止规则与预期断点数 | Greedy splits can miss interacting changes贪心切分可能漏掉相互影响的变化 |
| Dynamic programming动态规划 | Exact offline optimization when series length permits序列长度允许时的精确离线优化 | Break count or penalty and segment cost断点数或惩罚项及区间成本 | Higher computation and memory计算与内存成本较高 |
| BOCPD | Online Bayesian tracking of run length and uncertainty在线贝叶斯运行长度与不确定性跟踪 | Predictive model, hazard function, prior预测模型、风险函数与先验 | Misspecified probabilities can look authoritative模型设定错误时概率仍可能显得权威 |
The search algorithm and the segment cost answer different questions. An L2-style cost is sensitive to mean changes under squared error; robust L1 costs can reduce the influence of isolated extremes; linear or autoregressive costs target other structures. Kernel or likelihood-based costs can detect broader distribution changes but require more data and computation. Choose the change definition first, then the optimizer.
搜索算法与区间成本回答不同问题。L2 类成本在平方误差下对均值变化敏感；稳健 L1 成本可降低孤立极值影响；线性或自回归成本针对其他结构。核方法或基于似然的成本可以发现更广泛的分布变化，但通常需要更多数据与计算。应先定义要找的变化，再选择优化器。
A repeatable change point detection workflow可重复执行的变点检测流程
- Write the decision statement.写清决策陈述。Name the series, change type, maximum useful delay, acceptable review load, and action a confirmed change may trigger.明确序列、变化类型、最大可接受延迟、复核负担，以及确认变化后可能触发的动作。
- Build a transparent baseline.建立透明基线。Start with a plot, rolling summaries, missingness, known events, and a simple cost. Complex models need to beat this reference.从图形、滚动统计、缺失、已知事件和简单成本开始；复杂模型必须优于这一参考。
- Set constraints before viewing preferred results.在看到偏好结果前设定约束。Choose minimum segment length, online reset logic, plausible break frequency, penalty range, and evaluation tolerance from domain requirements.依据领域要求预先选择最短区间、在线重置逻辑、合理断点频率、惩罚范围与评估容差。
- Fit more than one defensible configuration.拟合多个合理配置。Compare a simple baseline with a method matching the intended change. Save code, library version, parameters, input hash, and detected indices.比较简单基线与匹配目标变化的方法，并保存代码、库版本、参数、输入哈希与断点索引。
- Validate and interpret.验证并解释。Measure location, delay, false alarms, and stability. Join candidates to business events only after detection, and label coincidence separately from supported explanation.衡量定位、延迟、误报与稳定性。检测后再把候选点与业务事件关联，并把时间巧合与有证据的解释分开。
- Deploy with monitoring and rollback.带监控与回滚上线。Version the detector, log suppressed alerts, monitor sampling and score drift, and define how humans confirm, reject, merge, or close incidents.对检测器进行版本管理，记录被抑制告警，监控采样与分数漂移，并定义人工如何确认、拒绝、合并或关闭事件。
Example: finding a sustained latency shift示例：发现持续的延迟变化
Hypothetical example — not a product benchmark假设示例——不是产品性能基准
Assume a service has 90 days of hourly median latency. The first 52 days fluctuate around 180 ms; after an unknown boundary the level stays near 230 ms. Three isolated spikes exceed 400 ms but immediately recover. The task is to locate the sustained regime shift, not to flag every spike.
假设某服务有 90 天的小时中位延迟。前 52 天在约 180 毫秒附近波动，某个未知边界后持续在约 230 毫秒。期间有三个超过 400 毫秒的孤立尖峰，但都立即恢复。任务是定位持续状态变化，而不是标记每个尖峰。
The analyst first checks missing hours, release timestamps, traffic mix, and aggregation changes. A robust segment cost limits the spikes' influence. PELT is run across a documented penalty range with a 48-hour minimum segment. Candidate boundaries that persist across reasonable penalties are compared with a held-out incident record. A boundary within six hours of a deployment is useful supporting evidence, but timing alone does not prove the deployment caused the shift. Component metrics, rollback behavior, and change logs are needed for root-cause analysis.
分析人员先检查缺失小时、发布时间、流量构成与聚合变化。稳健区间成本可降低尖峰影响。随后在有记录的惩罚范围内运行 PELT，并设定 48 小时最短区间。对合理惩罚项下仍稳定存在的候选边界，再与留出的事故记录比较。若边界距某次部署不到 6 小时，这只是有用的支持证据；时间接近本身不能证明部署造成变化。根因分析还需要组件指标、回滚表现与变更日志。
How to validate detected change points如何验证检测到的变点
| Measure指标 | What it checks检查内容 | Caution注意事项 |
|---|---|---|
| Windowed precision / recall容差窗口精确率 / 召回率 | Whether candidates fall near labeled events候选点是否落在已标注事件附近 | Declare tolerance before scoring; labels may be incomplete评分前声明容差，且标签可能不完整 |
| Localization error定位误差 | Distance between detected and reference boundaries检测边界与参考边界的距离 | A real transition may be gradual rather than instantaneous真实转换可能是渐变而非瞬时 |
| Detection delay检测延迟 | How long an online method waits before alerting在线方法等待多久才告警 | Lower delay often increases false alarms延迟更低通常会增加误报 |
| Stability稳定性 | Whether results persist under reasonable cost, penalty, and preprocessing choices结果在合理成本、惩罚与预处理选择下是否保持 | Stability does not prove business importance稳定并不能证明业务重要性 |
| Segment usefulness区间有用性 | Whether adjacent regimes differ in interpretable, actionable ways相邻状态是否存在可解释、可行动的差异 | Avoid explaining with variables measured after the decision避免用决策后才产生的变量解释 |
When no complete ground truth exists, construct a review set from known interventions, simulated changes added to clean historical windows, and blinded domain review. Simulation checks implementation under declared assumptions; it does not establish live performance. Report false alarms per monitoring period and reviewer workload alongside point-wise scores. For gradual drift, evaluate an acceptable transition interval rather than pretending one timestamp is uniquely correct.
若没有完整真值，可用已知干预、在干净历史窗口中注入的模拟变化，以及盲化领域复核来构建评估集。模拟只能检查实现在既定假设下是否工作，不能证明线上表现。除逐点分数外，还应报告每个监控周期的误报与复核工作量。对于渐进漂移，应评估可接受的转换区间，而不是假装只有一个唯一正确时刻。
Common mistakes and failure conditions常见错误与失败条件
A few extremes can distort squared-error costs. Inspect robustness and require a meaningful minimum segment.
少数极值会扭曲平方误差成本，应检查稳健性并设置有意义的最短区间。
Selecting penalties after seeing desired events creates optimistic results. Predefine ranges and use held-out periods.
看到目标事件后再选惩罚项会产生乐观结果，应预先定义范围并使用留出区间。
Calendar cycles, outages, imputation, and changing sample counts can appear as structural breaks.
日历周期、停机、插补与样本数量变化都可能表现成结构断点。
A nearby deployment is a hypothesis. Compare component evidence, alternative causes, and reversal behavior.
时间接近的部署只是一个假设，还需比较组件证据、替代原因与回退表现。
Other limits include dependence between observations, multiple related series, high-dimensional changes, very short segments, gradual transitions, nonstationary noise, revised historical data, and feedback from alerts into the process. A univariate detector can miss a covariance change where each marginal series looks stable. Multivariate methods need enough representative data and careful scaling; more dimensions do not automatically improve detection.
其他局限包括观测依赖、多条相关序列、高维变化、极短区间、渐进转换、非平稳噪声、历史数据修订，以及告警反过来改变过程。各单变量都稳定时，单变量检测器可能漏掉协方差变化。多变量方法需要足够的代表性数据和谨慎缩放；维度更多并不会自动提高检测效果。
Investigate validated breakpoints with connected evidence结合关联证据调查已验证断点
Before opening the tool, prepare a table containing timestamps, raw and transformed values, detected breakpoint indices, segment labels, algorithm and parameter versions, validation status, and stable source IDs. Add relevant deployment logs, maintenance records, incident notes, and business documents. InfiniSynapse is an AI-powered analysis workspace across connected databases, files, and documents; this page does not claim it provides a built-in change point algorithm. Compute candidate breakpoints with a documented statistical implementation, then use InfiniSynapse to compare the reviewed segments with connected operational evidence.
打开工具前，请准备包含时间戳、原始与转换值、检测断点索引、区间标签、算法与参数版本、验证状态及稳定来源 ID 的表格，并加入相关部署日志、维护记录、事故说明与业务文档。InfiniSynapse 是跨已连接数据库、文件和文档的 AI 辅助分析工作区；本页不声称它内置变点算法。请先用有明确文档的统计实现计算候选断点，再用 InfiniSynapse 把已复核区间与关联运营证据进行比较。
Open InfiniSynapse for connected data analysis打开 InfiniSynapse 进行关联数据分析Production checklist and next steps生产检查清单与下一步
- Keep a simple visual and statistical baseline; require added complexity to improve the stated decision metric.保留简单的可视化与统计基线，要求新增复杂度能改善既定决策指标。
- Version data extraction, resampling, transformations, cost, algorithm, penalty, minimum segment length, and alert rules together.统一版本管理数据提取、重采样、变换、成本、算法、惩罚、最短区间与告警规则。
- Store both the raw timestamp and positional index because libraries may return segment endpoints rather than event times.同时保存原始时间戳与位置索引，因为程序库可能返回区间终点而不是事件时间。
- Backtest quiet periods and incident periods; measure delay, duplicates, false alarms, suppression, and reviewer burden.回测平静期与事故期，衡量延迟、重复、误报、抑制与复核负担。
- Monitor sampling frequency, missingness, score distribution, break frequency, segment length, and confirmation rate after launch.上线后监控采样频率、缺失、分数分布、断点频率、区间长度与确认率。
- Link detection to root-cause analysis, but keep detection evidence, explanatory evidence, inference, and remediation decisions separate.把检测衔接到根因分析，但要分开记录检测证据、解释证据、推断与修复决策。
For adjacent methods, compare the local outlier detection methods guide and Local Outlier Factor guide when the task concerns unusual points or local density rather than sustained temporal change. Their production routes still require deployment verification before being treated as live internal links.
若任务关注异常点或局部密度，而非持续的时间结构变化，可对照本地的离群值检测方法指南与 Local Outlier Factor 指南。这些文章的生产路由在正式部署前仍需核验，不能把本地文件直接当作已上线页面。
Frequently asked questions about change point detection关于变点检测的常见问题
What is change point detection?什么是变点检测？
It identifies times where a series' statistical behavior changes, such as a sustained shift in mean, variance, trend, or distribution. Candidate boundaries divide the sequence into regimes for validation and interpretation.
它用于识别序列统计行为发生变化的时刻，例如均值、方差、趋势或分布的持续偏移。候选边界把序列划分成不同状态，供后续验证与解释。
How is a change point different from an anomaly?变点与异常点有什么区别？
A point anomaly is unusual under the current regime. A change point marks a boundary after which the regime remains different. One spike may be anomalous without starting a new regime.
异常点是在当前状态下不寻常的观测；变点则标记其后状态持续不同的边界。一个尖峰可以异常，却不一定开启新状态。
Which change point detection algorithm should I use?应该选择哪种变点检测算法？
Choose from the goal and assumptions: CUSUM for specified online shifts, PELT or dynamic programming for offline segmentation, binary segmentation for a faster approximation, and Bayesian methods when uncertainty and run length matter.
应根据目标与假设选择：明确的在线偏移可用 CUSUM；离线分段可用 PELT 或动态规划；需要更快近似可用二分分割；重视不确定性和运行长度时可考虑贝叶斯方法。
How do you validate detected change points?如何验证检测到的变点？
Use known events when available, tolerance-window precision and recall, localization error, online detection delay, stability under reasonable parameters, and domain review of each segment.
可使用已知事件、容差窗口精确率与召回率、定位误差、在线检测延迟、合理参数下的稳定性，以及对每个区间的领域复核。
Can InfiniSynapse perform change point detection?InfiniSynapse 能执行变点检测吗？
This page does not claim a built-in change point algorithm. Compute candidates with a documented statistical library, then use InfiniSynapse to analyze the prepared results with connected business data and documents.
本页不声称 InfiniSynapse 内置变点算法。请先用有明确文档的统计程序库计算候选点，再用 InfiniSynapse 把准备好的结果与关联业务数据和文档一起分析。
Official sources and verification notes官方来源与验证说明
- official ruptures documentation for offline change point detection—implementation guidance for offline segmentation methods.
- NIST/SEMATECH CUSUM control chart guidance—official statistical guidance for cumulative-sum monitoring.
- Bayesian Online Changepoint Detection paper by Adams and MacKay—the original online Bayesian method paper.
- PELT paper by Killick, Fearnhead, and Eckley—the original optimal-pruning method paper.
- 离线变点检测的 ruptures 官方文档——离线分割方法的实现指导。
- NIST/SEMATECH CUSUM 控制图指南——累积和监控的官方统计指导。
- Adams 与 MacKay 的贝叶斯在线变点检测论文——在线贝叶斯方法的原始论文。
- Killick、Fearnhead 与 Eckley 的 PELT 论文——最优剪枝方法的原始论文。
Library interfaces and defaults can change. Confirm current documentation and validate every breakpoint against your own process, sampling design, and operational context.
程序库接口与默认值可能变化。实施时应核验当前文档，并根据自身过程、采样设计与运行背景验证每个断点。