Anomaly Detection in R

## Warning: package 'tibbletime' was built under R version 3.5.2

mmeKPI <- kpi_source[kpi_source$kpi_name == "EPS_ATTACH_SR_CMM",]
mmeKPI$spark_start_dt <- gsub("+0000","",mmeKPI$spark_start_dt)
mmeKPI$spark_start_dt <- gsub("[,+]","",mmeKPI$spark_start_dt)
mmeKPI <- arrange(mmeKPI, spark_start_dt)
mmeKPI$Datetime = as.POSIXct(strptime(mmeKPI$spark_start_dt, "%Y-%m-%d %H:%M:%S"))
mmeKPI$kpi_name <- as.character(mmeKPI$kpi_name)
mmeKPI_test <- mmeKPI[,c("Datetime","kpi_value"),]
mmeKPI_test <- arrange(mmeKPI_test, Datetime)
mmeKPI_test_ts = mmeKPI_test %>% as.tibble()

summary(mmeKPI_test_ts)

##     Datetime                     kpi_value     
##  Min.   :2018-06-26 20:06:03   Min.   :  0.00  
##  1st Qu.:2018-06-27 03:16:34   1st Qu.: 96.44  
##  Median :2018-06-27 09:11:34   Median : 97.38  
##  Mean   :2018-06-27 08:31:51   Mean   : 94.81  
##  3rd Qu.:2018-06-27 14:01:04   3rd Qu.: 98.09  
##  Max.   :2018-06-27 19:54:02   Max.   :200.00

group_mme <- mmeKPI_test_ts %>% count(Datetime) 
library(ggplot2)
ggplot(group_mme) + geom_line(aes(Datetime, n))

library(AnomalyDetection)
#1440 = 24 hrs * 60 minutes
res = AnomalyDetectionVec(mmeKPI_test_ts[,2], max_anoms=0.02,
period=1440, direction='both', only_last=FALSE, plot=TRUE)

res$plot

res$anoms

##    index  anoms
## 1     11  98.17
## 2     50  99.89
## 3     67   0.00
## 4    152  98.53
## 5    198   0.00
## 6    316   0.00
## 7    360 200.00
## 8    499  99.81
## 9    505 200.00
## 10   597   0.00
## 11   696   0.00
## 12   821   0.00
## 13   871 100.65
## 14   882   0.00
## 15   990   0.00
## 16  1041   0.00
## 17  1093 100.02
## 18  1121   0.00
## 19  1160 100.65
## 20  1201  98.45
## 21  1262   0.00
## 22  1317   0.00
## 23  1330   0.00
## 24  1394   0.00
## 25  1452   0.00
## 26  1470   0.00
## 27  1528   0.00
## 28  1544   0.00
## 29  1559  97.18
## 30  1564 100.33
## 31  1588   0.00
## 32  1608   0.00
## 33  1622 102.03
## 34  1652   0.00
## 35  1669  98.22
## 36  1681   0.00
## 37  1716   0.00
## 38  1726   0.00
## 39  1792   0.00
## 40  1798  98.49
## 41  1800  97.32
## 42  1812   0.00
## 43  1842  98.02
## 44  1907  97.88
## 45  1939   0.00
## 46  1945  99.53
## 47  2020  97.88
## 48  2037  98.22
## 49  2136  98.49
## 50  2261  98.53
## 51  2311   0.00
## 52  2322  98.81
## 53  2481 100.10
## 54  2533   0.00
## 55  2558   0.00
## 56  2600   0.00
## 57  2641   0.00
## 58  2722   0.00
## 59  2878   0.00
## 60  2930   0.00
## 61  2947 102.38
## 62  3032   0.00
## 63  3078  98.10
## 64  3196  98.22
## 65  3240  96.38

help(Anomal)

## No documentation for 'Anomal' in specified packages and libraries:
## you could try '??Anomal'

library(anomalize)

## Warning: package 'anomalize' was built under R version 3.5.2

mme_anomalized <- mmeKPI_test_ts  %>%
    time_decompose(kpi_value, method = "stl", merge = TRUE) %>%
    anomalize(remainder, method = "iqr", max_anoms = 0.49) %>%
    time_recompose() %>%  plot_anomalies(time_recomposed = TRUE, alpha_dots = 0.05)

## Converting from tbl_df to tbl_time.
## Auto-index message: index = Datetime

## frequency = 142 seconds

## trend = 1132 seconds

mme_anomalized

table(mme_anomalized$data$anomaly)

## 
##   No  Yes 
## 3124  133