Anomaly Detection

Anomaly

class nupic.algorithms.anomaly.Anomaly(slidingWindowSize=None, mode='pure', binaryAnomalyThreshold=None)

Utility class for generating anomaly scores in different ways.

Supported modes:

MODE_PURE - the raw anomaly score as computed by computeRawAnomalyScore MODE_LIKELIHOOD - uses the AnomalyLikelihood class on top of the raw

anomaly scores

MODE_WEIGHTED - multiplies the likelihood result with the raw anomaly score

that was used to generate the likelihood

compute(activeColumns, predictedColumns, inputValue=None, timestamp=None)

Compute the anomaly score as the percent of active columns not predicted.

@param activeColumns: array of active column indices @param predictedColumns: array of columns indices predicted in this step

(used for anomaly in step T+1)

@param inputValue: (optional) value of current input to encoders

(eg “cat” for category encoder) (used in anomaly-likelihood)

@param timestamp: (optional) date timestamp when the sample occured

(used in anomaly-likelihood)

@return the computed anomaly score; float 0..1

AnomalyLikelihood

class nupic.algorithms.anomaly_likelihood.AnomalyLikelihood(claLearningPeriod=None, learningPeriod=288, estimationSamples=100, historicWindowSize=8640, reestimationPeriod=100)

Helper class for running anomaly likelihood computation.

anomalyProbability(value, anomalyScore, timestamp=None)

Compute the probability that the current value plus anomaly score represents an anomaly given the historical distribution of anomaly scores. The closer the number is to 1, the higher the chance it is an anomaly.

@param value - the current metric (“raw”) input value, eg. “orange”, or

‘21.2’ (deg. Celsius), ...

@param anomalyScore - the current anomaly score @param timestamp - (optional) timestamp of the ocurrence,

default (None) results in using iteration step.

@return the anomalyLikelihood for this record.

static computeLogLikelihood(likelihood)

Compute a log scale representation of the likelihood value. Since the likelihood computations return low probabilities that often go into four 9’s or five 9’s, a log value is more useful for visualization, thresholding, etc.

classmethod read(proto)

capnp deserialization method for the anomaly likelihood object

@param proto (Object) capnp proto object specified in

nupic.regions.AnomalyLikelihoodRegion.capnp

@return (Object) the deserialized AnomalyLikelihood object

write(proto)

capnp serialization method for the anomaly likelihood object

@param proto (Object) capnp proto object specified in

nupic.regions.AnomalyLikelihoodRegion.capnp