This operator searches for anomalies in a sequence in comparison to the learned sequences. To do this, the operator uses the deviation information created by the DeviationSequenceLearn operator. For each tuple of a sequence, the value is compared to the learned distribution (mean and standard deviation). The data input port is 0, the input port with learn data is 1.
...
- interval Defines, how many standard deviations are allowed for a tuple to be different from the mean. 3.0 is the default value. Choose a smaller value to get more anomalies
- tupleCountLearnAttribute The attribute name on the learn port that gives the group count (the counter that gives each tuple in the sequence a number)
- meanLearnAttribute The attribute name on the learn port that has the mean
- standardDeviationLearnAttribute The attribute name on the learn port that has the standard deviation
- valueDataAttribute Name of the attribute which should be analysed
- GROUP_BY If you use a deviationSequenceLearn operator, use 'group' as grouping attribute.
- fastGrouping Use hash code instead of tuple compare to create group. Potentially unsafe!
Example
The DeviationSequenceAnomalyDetection operator uses the learned data from the previous DeviationSequenceLearn operator.
| Code Block | ||
|---|---|---|
| ||
#PARSER PQL
#RUNQUERY
///
Values above 50 will be 'true' (which means that the current sequence
starts / runs) and smaller values to 'false' (means: sequence ended)
stateInfo = MAP({
expressions = ['temp', ['temp > 50', 'state']]
},
System.manual
)
/// The elements within one sequence will be counted (starts from 1 with each new sequence)
sequence = MAP({
expressions = ['temp','counter(state)']
},
stateInfo
)
///
The tuple which marks the end of the sequence (and itself is not part
of the sequence) has the counter_state_ 0 and will be filtered out
onlySequence = SELECT({PREDICATE = 'counter_state_ > 0'}, sequence)
/// Learn how a "normal" sequence is. The first 15 sequences will be learned and used as the definition of "normal"
sequenceLearn = DEVIATIONSEQUENCELEARN({
group_by = ['counter_state_'],
parameterAttribute = 'temp',
sequencesToLearn = 15
},
onlySequence
)
///
Check, if the current tuple of this sequence differes from the normal
tuples of the sequence at the specific point of the sequence
sequenceAnalysis = DEVIATIONSEQUENCEANOMALYDETECTION({
interval = 4.0,
standardDeviationLearnAttribute = 'standardDeviation',
group_by = ['group'],
meanLearnAttribute = 'mean',
valueDataAttribute = 'temp'
},
0:sequenceLearn,
1:sequenceLearn
) |