Design a system to detect sudden add-to-cart drops in real time

What's really being asked

This question evaluates whether you can design a real-time data pipeline for high-volume ecommerce events and choose an anomaly-detection strategy that respects complex seasonality. Interviewers want to see that you understand streaming ingestion, stateful windowing, and the difference between static thresholds and adaptive baselines that learn from historical patterns.

The full answer

First, event streaming and ingestion using a scalable platform like Apache Kafka or Amazon Kinesis Data Streams that can handle high throughput and partition events by user action or timestamp. Second, transformation and storage using Kinesis Data Firehose with AWS Lambda to normalize add-to-cart events and land them in Amazon S3 for historical training data while keeping a hot path for real-time analysis. Third, algorithmic detection that avoids false positives by using ML-based services such as Amazon Lookout for Metrics or self-hosted statistical models that learn hourly, daily, and weekly trends; the algorithm should compare current windowed counts against predicted baselines derived from the same hour and day of week over multiple weeks, and it should incorporate feedback loops to tune sensitivity over time. Fourth, notification via Amazon SNS or similar to alert on-call engineers when a statistically significant deviation persists across multiple consecutive windows rather than a single blip.

The mistakes people make

Proposing a simple percentage drop threshold without accounting for daily cyclicality or holiday spikes like Black Friday. Ignoring the need for historical data storage and retraining, which causes models to drift. Choosing batch-only processing instead of streaming, which introduces latency that makes real-time outage detection impossible. Failing to mention feedback mechanisms that let operators mark false positives so the system improves.

What usually comes next

How would you handle a gradual degradation versus a sudden cliff? What happens if the anomaly is caused by a legitimate traffic shift such as a marketing campaign ending? How do you balance cost between running your own statistical models versus a managed ML service? How would you backfill and retrain the baseline after a known outage skews the historical data?

A concrete example

An ecommerce site ingests add-to-cart events into Kinesis Data Streams with one-minute tumbling windows. Firehose transforms the events and writes aggregates to S3. Lookout for Metrics consumes the stream and compares the current minute's count against a baseline learned from the prior eight weeks of the same weekday and hour. If the count drops below two standard deviations for three consecutive minutes, SNS pages the platform team. The team can then flag the alert as a true outage or a false positive, and Lookout for Metrics adjusts future sensitivity accordingly.