Skip to main content

Configuration

The following subsections go through all available mathematical configuration settings of TIM Detection's anomaly detection with a kpi-driven approach. Each subsection is comprised of a description accompanied by its TIM API notation. Note that there is some overlap in terms of configuration parameters with the configuration of TIM Detect's system-driven anomaly detection and the TIM Forecasting configuration. To learn more, see the table below.

Overall configuration​

Configuration parameterbuild-modelrebuild-modeldetect
Domain specifics☑☑☐
Rebuild type☐☑☐

☑ available in a given method
☐ not available in a given method
* defined in the configuration section inside TIM Forecast

Domain specifics​

The domain specific configuration contains perspectives with their sensitivity, minSensitivity and maxSensitivity entering the anomalous behavior model. It allows you to adjust anomaly detection to your best preferences. It is a part of the build-model API and rebuild-model API. If domain specifics are not provided, defaults are used for build-model, and the settings of the input model are used for rebuild-model.

Detection perspectives​

Each detection perspective is dedicated to identify a different type of anomalies. Any combination of them can be used, however, at least one has to be selected. More information about the individual perspectives can be found in the dedicated documentation section.

"domainSpecifics": [
      {
        "name": "Residual"
      },
      {
        "name": "ResidualChange"
      },
      {
        "name": "Fluctuation"
      },
      {
        "name": "FluctuationChange"
      },
      {
        "name": "Imbalance"
      },
      {
        "name": "ImbalanceChange"
      }
    ]

Sensitivity​

The sensitivity setting is a percentual number that defines the sensitivity of the underlying model to anomalies. In general, the higher the sensitivity the more anomalies are detected. If the parameter is not specified, TIM determines the sensitivity automatically. Read more about sensitivity and how it is connected with an anomaly indicator in the section about anomaly indicators.

"domainSpecifics": [
      {
        "name": "Residual",
        "sensitivity": 5
      }
]

Instead of setting an exact sensitivity, TIM Detect also supports setting a range in the form of a minimum sensitivity and a maximum sensitivity.

Minimum sensitivity​

The minimum sensitivity setting is a percentual number that defines the lower limit for the sensitivity. This setting makes sense if the sensitivity parameter is chosen automatically. By default, it is equal to 0%.

"domainSpecifics": [
        "name": "ResidualChange",
        "minSensitivity": 0.5
      }
]
Maximum sensitivity​

The maximum sensitivity setting is a percentual number that defines the upper limit for the sensitivity. This setting makes sense if the sensitivity parameter is selected automatically. By default, it is equal to 5%.

"domainSpecifics": [
      {
        "name": "ResidualChange",
        "maxSensitivity": 3
      }
]

Rebuild type​

This setting determines the type of the rebuild. There are three available types:

  • DomainSpecifics: Reconfiguration of the domain specifics (perspectives/sensitivities)
  • AnomalousBehaviorModel: Rebuilding the anomalous behavior model
  • All: Rebuilding both the normal and anomalous behavior model

If the parameter is not provided, TIM defaults to All.

"rebuildType": "AnomalousBehaviorModel"

Normal behavior model configuration​

Configuration parameterbuild-modelrebuild-modeldetect
Use normal behavior model☑☐☐
Use KPI offsets☑☐☐
Allow offsets*☑☐☐
Daily cycle*☑☐☐
Features*☑☐☐
Model complexity*☑☐☐
Normalization*☑☐☐
Offset Limit*☑☐☐

☑ available in a given method
☐ not available in a given method
* defined in the configuration section inside TIM Forecast

Use normal behavior model​

This setting contains a boolean value that decides whether TIM should model the normal behavior of a given KPI. When useNormalBehaviorModel is on, TIM finds the KPI's normal behavior and detects anomalies based on the difference between the KPI and its normal behavior; otherwise TIM detects only based on the KPI itself. Turning off the normal behavior model makes sense only for univariate problems, as it brings the possibility to take a look purely on the course of individual time series (KPIs). If the parameter is not provided, TIM defaults to true.

NOTE: In case useNormalBehaviorModel is set to false, the rest of the normalBehaviorModel parameters are irelevant and the normal behavior, residuals and root cause analysis cannot be returned.

"normalBehaviorModel": {
    "useNormalBehaviorModel": true
}

Use KPI offsets​

This setting contains a boolean value that decides whether the offsets of the KPI variable are used for modeling the normal behavior. Using the offsets tends to improve the accuracy of the normal behavior fit. In some cases, however, improving the normal behavior fit is not essential. By turning it off the context of the KPI variable is removed and the anomaly detection is based only on the context of the influencers (explanatory variables). If the parameter is not provided, TIM decides automatically.

"normalBehaviorModel": {
    "useKPIoffsets": false
}

Allow offsets​

Sometimes it is desirable to create models that do not use any data offsets, only values of predictors from the current timestamp. When set to false, TIM automatically disables features that would otherwise require data offsets.

"normalBehaviorModel": {
    allowOffsets: true
}

Anomalous behavior model configuration​

Configuration parameterbuild-modelrebuild-modeldetect
Model complexity☑☐☐
Detection intervals☑☐☐

☑ available in a given method
☐ not available in a given method
* defined in the configuration section inside TIM Forecast

Detection intervals​

The detection intervals setting contains a cron-like notation indicating on what parts of a day or week the detection model will be used. Setting this helps to build more appropriate models and reduce model building time. By default, the detection intervals are set to all samples.

"anomalousBehaviorModel": {  
      "detectionIntervals": [
        {
          "type": "Day",
          "value": "*"
        },
        {
          "type": "Hour",
          "value": "6-18"
        },
        {
          "type": "Minute",
          "value": "0"
        }
      ]
    }

Model complexity​

This setting defines the maximal complexity to search for when building the anomalous behavior model. For exact maximal model complexity selection, an explicit number needs to be set in the defined range of 1 – 30. If not specified, the TIM Engine will determine the optimal model complexity automatically.

"anomalousBehaviorModel": {
    "maxModelComplexity": 20
}