Overview

The following subsections go through all the available mathematical configuration of TIM Anomaly Detection. Each subsection is comprised of a text description and TIM API notation. Note that some of the configuration parameters are already explained in the TIM Forecasting Configuration section. To learn more, see the table below.

Configuration

Configuration parameter	build-model	rebuild-model	detect
Domain specifics	☑	☑	☐
Rebuild type	☐	☑	☐

Normal behavior model configuration

Configuration parameter	build-model	rebuild-model	detect
Use normal behavior model	☑	☐	☐
Use KPI offsets	☑	☐	☐
Allow offsets*	☑	☐	☐
Daily cycle*	☑	☐	☐
Features*	☑	☐	☐
Model complexity*	☑	☐	☐
Normalization*	☑	☐	☐
Offset Limit*	☑	☐	☐

Anomalous behavior model configuration

Configuration parameter	build-model	rebuild-model	detect
Model complexity	☑	☐	☐
Detection intervals	☑	☐	☐

☑ adjustable in a given method
☐ not adjustable in a given method
^* defined in the Configuration section inside TIM Forecasting

Domain specifics¶

Perspectives with their Sensitivity, minSensitivity and maxSensitivity entering the anomalous behavior model. It allows you to adjust anomaly detection to your best preferences. It is a part of the build-model API and rebuild-model API. If domain specifics are not provided, in build-model are determined by default, in rebuild-model are read from the input model.

Detection perspectives¶

Each detection perspective is dedicated to identify different types of anomalies. An arbitrary combination of them can be used; however, at least one has to be selected. The individual perspectives are described here.

"domainSpecifics": [
      {
        "name": "Residual"
      },
      {
        "name": "ResidualChange"
      },
      {
        "name": "Fluctuation"
      },
      {
        "name": "FluctuationChange"
      },
      {
        "name": "Imbalance"
      },
      {
        "name": "ImbalanceChange"
      }
    ]

Sensitivity¶

A number in percentage that defines the sensitivity of the underlying model to anomalies. In general, the higher the sensitivity the more anomalies is detected. If the parameter is not specified, TIM determines sensitivity automatically. Read more about sensitivity and how it is connected with anomaly indicator.

"domainSpecifics": [
      {
        "name": "Residual",
        "sensitivity": 5
      }
]

Minimum sensitivity¶

A number in percentage that defines the bottom limit for the sensitivity if it is determined automatically. This setting applies only if Sensitivity parameter is not specified in configuration. By default, it is equal to 0%.

"domainSpecifics": [
      {
        "name": "ResidualChange",
        "minSensitivity": 0.5
      }
]

Maximum sensitivity¶

A number in percentage that defines the upper limit for the sensitivity if it is determined automatically. This setting applies only if Sensitivity parameter is not specified in configuration. By default, it is equal to 5%.

"domainSpecifics": [
      {
        "name": "ResidualChange",
        "maxSensitivity": 3
      }
]

Rebuild type¶

The type of the rebuild. Three possibilities are available:

DomainSpecifics - reconfiguration of domain specifics (perspectives/sensitivities)
AnomalousBehaviorModel - rebuilding the anomalous behavior model
All - rebuilding both normal and anomalous behavior model

If the parameter is not provided, TIM's default is All.

"rebuildType": "AnomalousBehaviorModel"

Use KPI offsets¶

A boolean value that decides whether the offsets of the KPI variable are used for modelling the normal behavior. Using the offsets tends to improve the accuracy of the normal behavior fit. In some cases, however, improving the normal behavior fit is not essential. By turning it off the context of the KPI variable is removed and the anomaly detection is based only on the context of the influencers (explanatory variables). If the parameter is not provided, TIM decides automatically.

"normalBehaviorModel": {
    "useKPIoffsets": false
}

Use normal behavior model¶

A boolean value that decides whether TIM should model normal behavior of a given KPI. When "useNormalBehaviorModel" is on, TIM finds normal behavior of a given KPI and so detects based on the difference between KPI and its normal behavior, otherwise TIM detects only based on KPI. Turning off the normal behavior model makes sense only for univariate problems as it brings the possibility to take a look purely on the course of individual time series(KPI's). If the parameter is not provided, TIM's default is true.

NOTE: In case useNormalBehaviorModel is set to false, the rest of normalBehaviorModel parameters are irelevant ; also normal behavior, residuals and root cause analysis can not be returned.

"normalBehaviorModel": {
    "useNormalBehaviorModel": true
}

Allow offsets¶

Sometimes it is desirable to create models that do not use any data offsets, only values of predictors from the current timestamp. When set to false, TIM automatically disables features that would otherwise require data offsets.

"normalBehaviorModel": {
    allowOffsets: true
}

Model complexity¶

Maximal complexity to search when building the anomalous behavior model. You need to provide an explicit number for exact model complexity selection. Defined range: 1 – 30. If not specified, TIM Engine will determine optimal model complexity automatically.

"anomalousBehaviorModel": {
    "maxModelComplexity": 20
}

Detection intervals¶

A cron-like notation indicating what parts of day or week the detection model will be used. It helps to build more appropriate models or reduce model building time. By default, detection intervals are set to all samples.

"anomalousBehaviorModel": {  
      "detectionIntervals": [
        {
          "type": "Day",
          "value": "*"
        },
        {
          "type": "Hour",
          "value": "6-18"
        },
        {
          "type": "Minute",
          "value": "0"
        }
      ]
    }