This operator searches for anomalies in a sequence in comparison to the learned sequences. To do this, the operator uses the deviation information created by theĀ DeviationSequenceLearn operator. For each tuple of a sequence, the value is compared to the learned distribution (mean and standard deviation). The data input port is 0, the input port with learn data is 1.
The DeviationSequenceAnomalyDetection operator uses the learned data from the previous DeviationSequenceLearn operator.
#PARSER PQL #RUNQUERY /// Values above 50 will be 'true' (which means that the current sequence starts / runs) and smaller values to 'false' (means: sequence ended) stateInfo = MAP({ expressions = ['temp', ['temp > 50', 'state']] }, System.manual ) /// The elements within one sequence will be counted (starts from 1 with each new sequence) sequence = MAP({ expressions = ['temp','counter(state)'] }, stateInfo ) /// The tuple which marks the end of the sequence (and itself is not part of the sequence) has the counter_state_ 0 and will be filtered out onlySequence = SELECT({PREDICATE = 'counter_state_ > 0'}, sequence) /// Learn how a "normal" sequence is. The first 15 sequences will be learned and used as the definition of "normal" sequenceLearn = DEVIATIONSEQUENCELEARN({ group_by = ['counter_state_'], parameterAttribute = 'temp', sequencesToLearn = 15 }, onlySequence ) /// Check, if the current tuple of this sequence differes from the normal tuples of the sequence at the specific point of the sequence sequenceAnalysis = DEVIATIONSEQUENCEANOMALYDETECTION({ interval = 4.0, standardDeviationLearnAttribute = 'standardDeviation', group_by = ['group'], meanLearnAttribute = 'mean', valueDataAttribute = 'temp' }, 0:sequenceLearn, 1:sequenceLearn ) |