Azure Multivariate Anomaly Detection: What start and end time, model and data set size is correct?

Question

question

Malte-8633 asked Feb 16, '22 GiftA-MSFT answered Mar 1, '22

Azure Multivariate Anomaly Detection: What start and end time, model and data set size is correct?

Hello,

I am experimenting with Azure Anomaly Detection (Multivariate) and used https://github.com/Azure-Samples/AnomalyDetector/blob/master/quickstarts-multivariate/Java/MultivariateSample.java as a starting point.

I want to batch infer data points in 24 hour intervals, e.g. between 2022-02-16T00:00:00 (inclusive) and 2022-02-16T23:59:00 (inclusive) with minute-level granularity.
Assuming anomaly detection should be based on a 1440 window. Thus having to provide data points in interval 2022-02-15T00:00:00 (inclusive) and 2022-02-15T23:59:00 (inclusive) also on minute-level granularity.

So for example
- to infer 2022-02-16T00:00:00, datapoints in interval 2022-02-15T00:00:00 (inclusive) to 2022-02-15T23:59:00 (inclusive) are used
- to infer 2022-02-16T00:01:00, datapoints in interval 2022-02-15T00:01:00 (inclusive) to 2022-02-16T00:00:00 (inclusive) are used
- ...

Question: What start and end time should be used for training (https://github.com/Azure-Samples/AnomalyDetector/blob/master/quickstarts-multivariate/Java/MultivariateSample.java#L140
) and inference (https://github.com/Azure-Samples/AnomalyDetector/blob/master/quickstarts-multivariate/Java/MultivariateSample.java#L175
)?

Currently I provide a dataset with size 1440*2 starting from 2022-02-15T00:00:00 to 2022-02-16T23:59:00 for both training and inference.
For
- training use startTime=2022-02-15T00:00:00 and endTime=2022-02-16T23:59:00 and window size 1440
- inference use startTime=2022-02-16T00:00:00 and endTime=2022-02-16T23:59:00 and window size 1440

Is that correct?
- When doing inference with startTime=2022-02-15T00:00:00 and endTime=2022-02-16T23:59:00 I am getting different results than when calling the model with startTime=2022-02-16T00:00:00 and endTime=2022-02-16T23:59:00
- Do i actually have to provide a size 1440*2 dataset if i only want to batch infer 1440 data points in a 24h interval?

Thanks

azure-anomaly-detector

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-02-16T21:55:12.753Z

GiftA-MSFT answered Feb 16, '22

Hi, according to the document, each variable must have two and only two fields, timestamp and value. For training data size, the maximum number of timestamps is 1000000, and a recommended minimum number is 15000 timestamps. For sliding window, you specify how many data points are used to determine anomalies (an integer between 28 and 2,880, the default value is 300). Please review the document for more details on input schema, input parameters, model training, etc. Let us know if you need further clarification after reviewing the document in it's entirety. Thanks.

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Malte-8633 · Feb 17 at 10:14 AM

Thanks for giving feedback. In docs ist says "startTime - The start time of data used for training or inference.". Should startTime for training/inference be the timestamp of the first data point minus the size of slidingWindow or just equal timestamp of the first data point? You say "15000 timestamps" => Whats is the lowest granularity the detector can handle? nano seconds, seconds, minutes, ...?

0 ·

GiftA-MSFT Malte-8633 · Feb 18 at 05:19 AM

The start time can be equal to or greater than earliest timestamp. If it's earlier than the actual earliest timestamp in the data, the actual earliest timestamp will be used as the starting point. According to best practices document, training a MVAD model requires 15,000 or more data points (timestamps) per variable to keep a good accuracy. I believe seconds is the lowest granularity. Also, you might find this information: How does MVAD sliding window work useful. Hope this helps.

0 ·

question