Anomaly is designed for detecting anomalies in your data. Anomalies are unusual events that may disrupt your production, indicate an impending failure, incorrect data and other bad situations. However, anomalies can be good things too and can lead to new discoveries about how things work. With Anomaly, you access and synchronize data, pre-process it as you desire to get the variables you want to monitor in the form you want, then apply any number of anomaly detectors. Validate your solution on historical data and then save your solutions to disk and put them on-line in the Intellect Server using Designer.

Create Data Handling Solutions

You can monitor raw data streams, but often you wish to create particular results to monitor. For example, in the data pre-processing of all the desktop tools there are functions that are particularly well suited for anomaly detection. One is "WinZ", the windowed Z-Score, the number of standard deviations a data point is from the mean. By windowing this function it becomes adaptive through time. Another is WinStdDev which is similar but is in the units of measure. You may also wish to monitor rates of change, moving averages, ratios and logs and other functions available to you. It depends on your application.

Build Detector Schemes

Anomaly comes with 5 different detectors. Some are univariate (watches one variable at a time) which can be applied to any variables you supply from the data pre-processing step. Others are multivariate which means they watch all variables as a system, together. More detectors can be added on request. All detectors have properties of the number of consecutive cases required so you don't get spurious alerts and latching so you get only one alert per occurrence, or for every occurrence while the condition exists.

• Anomaly Rule
  Computes a result based on a data value compared to a threshold. This is useful when a data value is known to be abnormal when outside of limits, such as greater than, less than, equal to, between limits, outside of limits.
• Anomaly Numeric Histogram
  Identifies infrequent, therefore unusual values. Infrequency is defined by settable standard deviations when the data is "histogrammed".
• Anomaly Stat High or Low
  Identifies statistically high or low values compared to history when compared to a settable number of standard deviations.
• Anomaly Systemic Range
  Identifies when all values as a unit "orb" is excessively distorted as defined by a settable % distortion.
• Anomaly Systemic Distance
  Identifies if a multi-dimensional point is far from the historical cluster using a settable distance criterion and the number of nearest neighbors.

Any and all, and multiples can be applied in combination to create a solution. You can validate the behavior of your Anomaly solution on historical data.

When an alert fires you receive "facts", such as when it occurred, the name(s) of the variables, their values at the time, the reason for the alert and the degree the detector was violated. These facts are broadcast "downstream" to other tasks that can take some action automatically or issue email, text or other notifications.