Skip to content

Overview

Below is a summary of mathematical outputs across all TIM Anomaly Detection methods.

Model result

The table shows availability of the model result in the anomaly detection methods:

Configuration field build-model rebuild-model detect rca
model

☑ available in a given method
☐ not available in a given method
* - model consists of three parts: settings, normalBehaviorModel and anomalousBehaviorModel

CSV response (table)

There are two different tables based on the type of anomaly detection job.

The first table gathers outputs* that are a part of tabular response (csv output) :

timestamp model_index kpi normal_behavior anomaly_code anomaly_indicator_"name of Detection Perspective"
2020-10-12T03:00:00.0 4 70115.16 71277.24 0 0.31
2020-10-12T04:00:00.0 5 83422.47 83687.43 0 0.45
2020-10-12T05:00:00.0 6 85931.01 92960.32 0 0.72
2020-10-12T06:00:00.0 7 91858.28 90857.38 1 1.23
2020-10-12T07:00:00.0 8 94156.52 91852.39 0 0.33
2020-10-12T08:00:00.0 9 94503.08 93413.58 0 0.56

* - for build model job, rebuild-model job and detect job

The second table gathers outputs* that are a part of tabular response (csv output) :

timestamp model_index kpi normal_behavior "name of Influencer 1" "name of Influencer 2" ... "name of Influencer N" normal_behavior_change "name of Influencer 1"_change "name of Influencer 2"_change ... "name of Influencer N"_change
2020-10-12T03:00:00.0 4 70115.16 71277.24 0 0.31 0.0856867739083295 6371.5959080431 5250.57478589984 ... 727.376704085072
2020-10-12T04:00:00.0 5 83422.47 83687.43 0 0.45 0.00976161198813676 7563.0550795337 3450.52478589984 ... 825.976580193047
2020-10-12T05:00:00.0 6 85931.01 92960.32 0 0.72 1.27804752760902 83898.8481559912 -2250.174728489984 ... 1029.63298605852
2020-10-12T06:00:00.0 7 91858.28 90857.38 1 1.23 0.0337970522302838 4671.2022090489 3240.87478589984 ... 1362.98733337759
2020-10-12T07:00:00.0 8 94156.52 91852.39 0 0.33 0.229208764902578 8997.1516298713 -1231.14178543984 ... -1345.38208161086
2020-10-12T08:00:00.0 9 94503.08 93413.58 0 0.56 0.0415544217174877 9128.3621537876 3210.17578289984 ... -400.37972214374

* - for rca job

Timestamp

A timestamp corresponding to the given row of outputs.

Model index

Index of a model that was used for normal behavior evaluation of a given KPI. Number of possible model indexes depends on the configuration of Time specific parameter.

KPI

It is an actual value of the determined column for anomaly detection.

Normal behavior

A real number returned from the normal behavior model evaluation for a given data point. It describes how the KPI should behave under the circumstances given by influencers.

Anomaly code

It is a integer value telling you whether there is an anomaly in your KPI for a given timestamp. It is evaluated based on all anomaly indicators(corresponding to determined perspectives).

In case the anomaly indicators for all chosen perspectives were calculated, it is 1 in case at least one of them is above 1, otherwise is 0. In case the anomaly indicator for at least one perspective was not calculated, it is 3 in case at least one of them is above 1, otherwise is 4.

Anomaly indicators

A number from the interval (0, infinity) that specifies the extent to which a given data point in time is anomalous. It is returned for each detection perspective selected in the model building configuration. Data points with anomaly indicator higher than 1 are considered as anomalies. See Anomaly indicator section to learn more.

Root cause analysis

A real number that reveals the involvement of a concrete influencer("NameOfInfluencer") in normal behavior for a given data point. It is returned for each influencer that occurs in the normal behavior model. For a given data point, the sum of RCA terms equals to normal behavior value. See Root cause analysis section to learn more.

Sensitivity

A sensitivity parameter that was used to build the model. If a concrete input sensitivity parameter is specified then it is equal to the output sensitivity. If, however, only the maximum sensitivity parameter or minimum sensitivity are specified then TIM determines the sensitivity automatically and its result is returned in the anomalous behavior part of the model under detectedSensitivity. It is always linked to detection perspective.

"model": {
  "anomalousBehaviorModel": {
    "submodels": [
      {
        "perspective": "Residual",
        "detectedSensitivity": 0.35
      }
    ]
  }
}