Scan_Abnormal and Scan_Abnormal_Default functions

The Scan_Abnormal and Scan_Abnormal_Default functions return time series data that differ from nearby sequences.

Syntax

Scan_Abnormal (
                 ts                  TimeSeries,
                 ident               LVARCHAR,
                 col_name            LVARCHAR,
                 begin_tstamp        DATETIME YEAR TO FRACTION(5),
                 end_tstamp          DATETIME YEAR TO FRACTION(5),
                 window_length       INTEGER,
                 score_threshold     DOUBLE PRECISION,
                 subseq_length       INTEGER,
                 step_size           INTEGER,                         
                 k_value             INTEGER,
                 p_value             DOUBLE PRECISION) 
RETURNS LIST (SEARCHROW NOT NULL)

Scan_Abnormal_Default (
                 ts                  TimeSeries,
                 ident               LVARCHAR,
                 col_name            LVARCHAR,
                 begin_tstamp        DATETIME YEAR TO FRACTION(5),
                 end_tstamp          DATETIME YEAR TO FRACTION(5),
                 window_length       INTEGER,
                 score_threshold     DOUBLE PRECISION,                        
                 subseq_length       INTEGER,
                 p_value             DOUBLE PRECISION) 
RETURNS LIST (SEARCHROW NOT NULL)

ts: The time series value for the specified primary key.
ident: A string identifier that is associated with the time series instance.
col_name: The name of the column in the TimeSeries data type from which to retrieve the values.
begin_stamp: The begin point of the range to search. Can be NULL, which represents the first element in the time series.
end_stamp: The end point of the range to search. Can be NULL, which represents the last element in the time series.
window_length: The length of the sequence.
score_threshold: The abnormal score threshold. Range of values: 0.0 - 1.0.
subseq_length: The size of the sliding window.
step_size: How far the sliding window is advanced for each candidate match.
k_value: The number of nearest neighbor sequences on which to base the abnormality score.
p_value: The p value as defined in the Lp-norm function, which is used in the distance calculation.

Usage

Run the Scan_Abnormal function to find all subsequences that differ from nearby subsequences. The sliding window of the input time series steps over the target time series. The differences between the time series are a measure of Euclid distance. Use this function to find outlier data compared to historical data or to generate real-time alerts for current outlier data. See Abnormal sequence detection.

The Scan_Abnormal_Default function uses the same detection algorithm with the following fixed values:

step_size = 1
k_value = (window_length - subseq_length/step_size)

Returns

A list of matches in a LIST data type that contains a SEARCHROW data type value for each match. See Scanning functions.