Back office ops · Production

trivago builds ML anomaly detection for real-time partner internet traffic monitoring

The problem

trivago's highly dynamic environment—with daily product changes, hundreds of partners each having multi-level parameters that shift dynamically, and billions of partner-hotel-locale combinations—makes it difficult to distinguish genuine traffic anomalies from expected parameter-driven changes, while data outages across a large partner base add further complexity.

First attempt

Advanced machine learning solutions proved unhelpful for detecting anomalies at the granular partner-hotel-locale level due to excessive false positives, and the Elastic solution was not adopted because it lacked easy customization.

Workflow diagram · grounded in source
1
Historical traffic as training input
trigger
“a time series model used to predict expected traffic based on past data (which serves as the training data)”
2
Model predicts expected traffic
ai_action
“The predicted traffic is typically represented as a confidence interval, with the confidence level as an input parameter that can be individually chosen for different metrics”
3
Threshold comparison flags anomalies
validation
“we compare the actual results with the expected values, and if the difference exceeds a certain threshold (outside the confidence interval), we identify and report it as an anomaly”
4
Route to large-partner monitoring
routing
“For larger partners, we often monitor results in real-time or close to real-time, sending direct warning messages to the responsible team if anything suspicious occurs”
5
Route to small-partner process
routing
“For such cases, a 24/7 solution is not practical. Instead, we have implemented various processes tailored to small partners. These processes involve providing customized support and generating reports automatically once we have accumulat…”
6
Anomaly alert via email or Slack
output
“utilize appropriate tools for reporting, such as email or Slack messages, as well as visualization techniques to effectively display the time series data and highlight the detected anomalies”
7
Human root cause investigation
human_review
“we may need to adjust our mathematical model or conduct in-depth investigations outside our databases to understand the root cause and establish future processes”
Reported outcome

trivago deployed the Prophet model in production for ongoing partner traffic anomaly detection, implemented 24/7 monitoring for large partners and customized automated reporting for smaller partners, resulting in improved data quality and a broader selection of rates.

Reported metrics
Prophet model production performanceperforming well
Small partner data qualityimproved data quality
Rate selection breadth on trivagobroader selection of rates
Reported stack
ProphetARIMA+ElasticSlack
Source
https://tech.trivago.com/post/2024-02-13-real-world-insights-anomaly-detection-in-internet-traffic
Read source ↗

Frequently asked questions

What did this team achieve with this AI workflow?

trivago deployed the Prophet model in production for ongoing partner traffic anomaly detection, implemented 24/7 monitoring for large partners and customized automated reporting for smaller partners, resulting in impr…

What tools did this team use?

Prophet, ARIMA+, Elastic, Slack.

What results were reported?

Prophet model production performance: performing well; Small partner data quality: improved data quality; Rate selection breadth on trivago: broader selection of rates (source-reported, not independently verified).

What failed first in this deployment?

Advanced machine learning solutions proved unhelpful for detecting anomalies at the granular partner-hotel-locale level due to excessive false positives, and the Elastic solution was not adopted because it lacked easy…

How is this back office ops AI workflow structured?

Historical traffic as training input → Model predicts expected traffic → Threshold comparison flags anomalies → Route to large-partner monitoring → Route to small-partner process → Anomaly alert via email or Slack → Human root cause investigation.

Related back office ops cases