TIM Anomaly Detection is built on top of the proven technology for automatic model generation for time-series forecasting. By selecting the relevant domain specifics and creating the most appropriate model, TIM automates the anomaly detection process.
The model building process can be characterized as follows. First, data is gathered. This data is typically unlabelled and contains mostly normal observations, thus anomalies are rare. Then, the notion of normality is extracted in the normal behavior model. To do that, the forecasting capability of TIM is used. The normal behavior is used to calculate residuals - difference between normal behavior and KPI. These residuals are then used in the anomalous behavior model to create detection perspectives. Each detection perspective has a corresponding sensitivity parameter which can be found automatically or configured manually. The perspective - sensitivity pairs are used for building submodels - each producing an anomaly indicator as a result. The resulting anomaly indicators contain values indicating to what extent a particular data point goes beyond what could be considered as ‘normal’.