Building an Anomaly Detection Model using TSI

Build an anomaly detection model for a signal over a representative normal operating period. Evaluate the model on historical data, refine it as needed, and once validated, deploy it to live monitoring to detect unseen behaviors in real time.

Creating a Baseline Model

How to create a univariate baseline anomaly detection model:

1. Select a numeric signal that (preferrably) has consistent data with good sampling rate (>100 mHz recommended)
2. Identify the baseline normal behavior period (learning range) represented in the selected signal
3. Run an ANOMALYLEARN flow using API. Run historical evaluation to see the output.
   1. If the output contains gaps, it is likely that the input data has missing values or irregular sampling. Consider revising the learning range to select a period where there is more consistent data in the input signal.
   2. For lower latency change the aperture setting to something smaller (non-default). Consult Falkonry Experts before settling on a non-default aperture.
4. Capture the Model ID from the flow response for the model version that has satisfactory results
5. Use the Signal ID and the Model ID to start live monitoring.

Evaluate Anomaly Model on Historical Data

Remember to evaluate your anomaly model on the hisotrical data which is explained in the video above. If you are satisfied with the output, you may write it to the M[0] output line.

Warning

NEVER write output to M[0] for any time range that was evaluated during live monitoring. Doing so may interfere with other system artifacts, creating confusion at best and unreliable results at worst.

Revising an Anomaly Model

To revise an existing anomaly detection AI model, we need 3 pieces of information.

1. Identifier for the signal whose anomaly model needs a revision
2. One or more new normal time ranges that the model should learn
3. Source Model that must be revised.