This operator uses the Local Outlier Factor (LOF) algorithm to find anomalies. You should use this operator with a window, because the operator saves all tuples in the current window and uses the normal LOF-algorithm on this set of tuples. If the number of tuples is too high, the algorithm may take a while to process the calculations.

Parameters

• NEIGHBORS The number of neighbors used, sometimes called k
• LOFVALUE The value from which the tuples are declared as anomalies. Values near 1 are normal, higher values are anomalies. Standard is 1.5.
• nameOfParameter Name of the attribute which should be analysed
• GROUP_BY Group by the given attribute, e.g. if you have a context like 'on' and 'off' you want to analyse separately.
• fastGrouping Use hash code instead of tuple compare to create group. Potentially unsafe!
• ignoreEqual Set to true, if you want to ignore, if there are a lot of equal values. This can lead to false positives.
• deliverFirstElements The operator starts to work when the window contains at least the number of neighbors + 1 tuples. If you want to get the first elements before this is reached, you can set this to true. Default is false.

Example

/// Searches for anomalies in temperature data
#PARSER PQL
#ADDQUERY
temperatureWindow = ELEMENTWINDOW({
                        size = 100
                      },
                      System.temperature
                    )
                    
lofAnalysis = LOFANOMALYDETECTION({
                  lofvalue = 2.5,
                  neighbors = 5,
                  ignoreequal = 'true',
                  nameofparameter = 'temp',
                  deliverFirstElements = 'true'
                },
                temperatureWindow
              )