Anomaly Indicator

Informatively detecting anomalies in data requires more than just distinguishing whether a particular observation is anomalous or not. An anomaly indicator is designed indicate how anomalous a particular observation is. A separate anomaly indicator is returned for each detection feature that was used for model building, the extend to which an observation is anomalous is indicated for each feature individually.

An anomaly indicator is a number in the interval (0, infinity) returned for each observation during model building, or for each observation in the detection period during detection (with the exception of a small number of data points at the beginning of each data range in case detection can't be done because of model offsets). The number 1 is the anomaly indicator threshold - if the indicator is below or equal to 1, the corresponding observation is considered normal; if it is above, it is considered an anomaly. The higher the number, the more anomalous that particular observation is.

The anomaly indicators are closely related to the sensitivity parameters. Each anomaly indicator has a corresponding sensitivity parameter which can be set manually or detected automatically. By setting a sensitivity of 'x', TIM expects 'x'% of the data to be anomalous on the model building period, which causes the anomaly indicator to exceed the threshold on exactly 'x'% of this data.

When such a model is used for detecting anomalies on out-of-sample ranges, a higher sensitivity will generally result in the anomaly indicator exceeding the threshold more often, than a sensitivity closer to zero would.