Skip to main content

Overview

This section summarizes the mathematical outputs across all TIM Detects anomaly detection methods.

CSV result (table)

The following types of anomaly detection jobs return a result table.

build-model, detect and what-if jobs

The first table below gives an overview of the output to expect of the tabular response (csv output) for anomaly detection jobs of type build-model, detect and what-if :

timestamplabelanomaly_codeanomaly_indicator
2020-10-12T03:00:00.0false11.05
2020-10-12T04:00:00.0false00.45
2020-10-12T05:00:00.0false00.72
2020-10-12T06:00:00.0false01.23
2020-10-12T07:00:00.0false00.33
2020-10-12T08:00:00.0true11.56

Timestamp

The timestamp column represents the timestamp that corresponds to the given row of output.

Label

The label column is a boolean representing the system's status (true- anomalous, false- normal). It is present only in case the label is in the data and is selected as a label column; otherwise contains NULL values.

Anomaly code

The anomaly_code column contains integer values 0 or 1, indicating whether there is an anomaly in the system for a given timestamp. The returned values are evaluated by TIM based on anomaly indicator.

The anomaly code is 1 in case the anomaly indicator is above 1, and 0 otherwise.

Anomaly indicator

The anomaly_indicator column contains numbers from the interval (0, infinity) that specify the extent to which a given data point in time is anomalous. It is returned for the corresponding anomaly indicator window.

Data points with an anomaly indicator higher than 1 are considered abnormal. See the anomaly indicator section to learn more.

Model result

A model result consists of three parts: settings, model and parameters.


"model": {
"settings": {
"data": {
"rows": [
{
"to": "2007-05-25T00:00:00.000Z",
"from": "1989-10-12T00:00:00.000Z"
}
],
"columns": [
"PAAWZBCIPX",
"KCCTTREDLC",
"label"
],
"labelColumn": "label",
"imputation": {
"type": "1",
"maxGapLength": 0
},
"timeScale": {
"baseUnit": "Dates.Second",
"value": 86400
}
},
"domainSpecifics": {
"sensitivity": 0,
"anomalyIndicatorWindow": {
"baseUnit": "Sample",
"value": 1
}
},
"model": {
"numberOfTrees": 1,
"subSampleSize": 256,
"maxTreeDepth": 8,
"extensionLevel": "auto",
"normalization": true
}
},
"model": {
"trees": [
{
"rootNode": {
"type": "internal",
"leftNode": {},
"rightNode": {},
"hyperplane": {
"normal": [
0.37594988066170415,
-0.8139287302753926
],
"intercept": [
-0.6693418047460529,
-2.1671939393581408
]
},
"numOfRecords": 256,
"depth": 0
},
"numOfNodes": 47
}
],
"settings": {
"numOfTrees": 1,
"subSampleSize": 256,
"maxTreeDepth": 8,
"extensionLevel": 1
}
},
"parameters": {
"anomalyIndicator": {
"detectedSensitivity": 0,
"threshold": 0.3969069783973106,
"translation": 0.34601509654339446,
"windowLength": 1
},
"normalization": {
"variableNames": [
"PAAWZBCIPX",
"KCCTTREDLC"
],
"mu": [
69.4,
83.59487179487179
],
"sigma": [
13.605871485765359,
22.882234323099354
]
},
"samplingPeriod": "P1D"
}
}

The table below shows the availability of the model result in the anomaly detection methods:

Configuration fieldbuild-modeldetect
model

available in a given method
not available in a given method

Anomaly detection jobs of type build-model produce a model, while anomaly detection jobs of type detect make use of the model of their parent job.

Sensitivity

One of the parameters contained in the model is the sensitivity parameter that was used to build the model. If a concrete input sensitivity parameter is specified, output sensitivity will represent this same value. If it is not defined, TIM determines the sensitivity automatically (currently the default sensitivity is 0), and the result of this calculation is returned. The returned sensitivity can be found in the parameters/anomalyIndicator part of the model, under detectedSensitivity, as shown below.

  "model": {
"parameters": {
"anomalyIndicator": {
"detectedSensitivity": 0.5
}
}
}

Error measures result

A performance metrics result consists of two parts: AUC and confusionMatrix. The table below shows the availability of this result based on the type of job:

Configuration fieldbuild-modeldetect
errorMeasures

available in a given method, but only if an anomaly label is defined in the relevant job
not available in a given method

Anomaly detection jobs of type build-model and detect can produce error measures, but only in case an anomaly label is available in the data and was defined in the registration body of the job (build-model) or a parent job of the job (detect).

Example of the response:

{
"AUC": 0.9948358700639194,
"confusionMatrix": {
"truePositive": 30,
"trueNegative": 30502,
"falsePositive": 12,
"falseNegative": 200
}
}

If you want to learn more about these performance metrics, see the error measures section.