Skip to content

Conversation

tveasey
Copy link
Contributor

@tveasey tveasey commented Jul 27, 2023

Backport #2270.

…nomalies (#2270)

We've had multiple issues reported in the past where we report high anomaly scores when the actual is the same as the
typical and both are equal to zero. This has been exacerbated in the past because we've also had some instabilities in the
modelling when we stop receiving data for a partition, which was an edge case when this could occur.

In all problematic cases, the underlying reason is the if we know the data are non-negative we truncate the prediction when
we report the typical value. However, up until now we haven't truncated when computing probabilities.

This changes switches to always truncating our prediction. (This is a halfway house to a more rigorous approach which
would condition the predicted distribution to be non-negative.) This should be good enough to ensure we never create non-
zero anomaly scores for cases where actual equals typical equals zero except when the result is a multi-bucket anomaly.
@tveasey tveasey merged commit df35a36 into 7.17 Jul 27, 2023
@tveasey tveasey deleted the port/2270 branch July 27, 2023 20:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant