This operator uses the Local Outlier Factor (LOF) algorithm to find anomalies. You should use this operator with a window, because the operator saves all tuples in the current window and uses the normal LOF-algorithm on this set of tuples. If the number of tuples is too high, the algorithm may take a while to process the calculations.
Parameters
- NEIGHBORS The number of neighbors used, sometimes called k
- LOFVALUE The value from which the tuples are declared as anomalies. Values near 1 are normal, higher values are anomalies. Standard is 1.5.
- nameOfParameter Name of the attribute which should be analysed
- GROUP_BY Group by the given attribute, e.g. if you have a context like 'on' and 'off' you want to analyse separately.
- fastGrouping Use hash code instead of tuple compare to create group. Potentially unsafe!
- ignoreEqual Set to true, if you want to ignore, if there are a lot of equal values. This can lead to false positives.
- deliverFirstElements The operator starts to work when the window contains at least the number of neighbors + 1 tuples. If you want to get the first elements before this is reached, you can set this to true. Default is false.
Example
PQL query for the LOF operator
/// Searches for anomalies in temperature data #PARSER PQL #ADDQUERY temperatureWindow = ELEMENTWINDOW({ size = 100 }, System.temperature ) lofAnalysis = LOFANOMALYDETECTION({ lofvalue = 2.5, neighbors = 5, ignoreequal = 'true', nameofparameter = 'temp', deliverFirstElements = 'true' }, temperatureWindow )