A system includes a metric data store configured to receive and store a time-series of values of a first metric, a seasonal trend identification module configured to generate an autoregressive moving average (ARMA)model. The modeling module includes a seasonal model module configured to generate a first model of the time-series of values, a non-seasonal model module configured to generate a second model of the time-series of values, and a combination module configured to generate a third model based on the first and second models. The modeling module is configured to, in response to determining that a first periodicity profile describes the time-series of values, output the third model as the ARMA model. The system includes an envelope determination module configured to determine a normal behavior of the first metric based on the ARMA model.