Skip to content

Overview

The following subsections go through all the available settings of TIM Anomaly Detection. Each subsection is comprised of a text description and TIM API notation. Note that some of the configuration parameters are already explained in the TIM Forecasting Configuration section. To learn more see the table below.

General configuration

Configuration parameter model building model rebuilding
Sensitivity x
Maximum sensitivity x x
Detection intervals x
Rebuild type x

Normal behavior learner configuration

Configuration parameter model building model rebuilding
Use target offsets x
Dictionaries* x
Allow offsets* x
Data normalization* x
Model complexity* x
Time specific* x
Interpolation* x

Anomalous behavior learner configuration

Configuration parameter model building model rebuilding
Detection features x
Normalization x
Model complexity x

xx - required
x - optional
* - defined in the Configuration section inside TIM Forecasting

Sensitivity

A number in percentage that defines the sensitivity of the underlying model to anomalies. In general, the higher the sensitivity the more anomalies is detected. If the parameter is not specified, TIM determines sensitivity automatically. Read more about sensitivity and how it is connected with anomaly indicator.

sensitivity: 1.0

Maximum sensitivity

A number in percentage that defines the upper limit for the sensitivity if it is determined automatically. This setting applies only if Sensitivity parameter is not specified in configuration. By default it is equal to 5%.

maxSensitivity: 2.0

Detection intervals

A cron-like notation indicating what parts of day or week the detection model will be used. It helps to build more appropriate models or reduce model building time. By default, detection intervals are set to all samples.

"detectionIntervals": [
    {
        "type": "Day",
        "value": "*"
    },
    {
        "type": "Hour",
        "value": "6-18"
    },
    {
        "type": "Minute",
        "value": "0"
    }
]

Rebuild type

The type of the rebuild. Four possibilities are available:

  • Basic - recalibrating the anomalous behavior learner
  • AbnormalBehaviorModel - rebuilding the abnormal behavior learner
  • NormalBehaviorModel - rebuilding the normal behavior learner
  • All - rebuilding both normal and abnormal behavior learner
"rebuildType": "NormalBehaviorModel"

Use target offsets

A boolean value that decides whether the offsets of the target variable are used for modelling the normal behavior. Using the offsets tends to improve the accuracy of the forecast/normal behavior fit. In some cases, however, improving the normal behavior fit is not essential. By turning it off the context of the target variable is removed and the anomaly detection is based only on the context of the explanatory variables. If the parameter is not provided, TIM decides automatically.

abnormalBehaviorModellingConfiguration: {
    useTargetOffsets: false
}

Detection features

Each detection feature is dedicated to identify different types of anomalies. An arbitrary combination of them can be used, however, at least one has to be selected. The individual features are described here.

abnormalBehaviorModellingConfiguration: {
    features: [Residual, ResidualChange, Fluctuation, FluctuationChange, Imbalance, ImbalanceChange]
}

Normalization

When normalization is on, features entering the abnormal behavior learner are rescaled by mean and standard deviation. If not provided, a default value will be used.

abnormalBehaviorModellingConfiguration: {
    dataNormalization: true
}

Model complexity

Maximal complexity to search when building the anomalous behavior learner. You need to provide explicit number for exact model complexity selection. Defined range: 1 – 30. If not specified, TIM Engine will determine optimal model complexity automatically.

abnormalBehaviorModellingConfiguration: {
    maxModelComplexity: 20
}