Clarification on anomaly score and anomalylikelihood


#1

Hi

Can someone clarify my doubt on Anomaly Score and Anomaly likelihood ?
I got anomaly score =0.1 and anomalylikelihood=0.999
Can I consider this is an anomaly ?


#2

There is a lot of stuff on the forums about anomaly likelihood and anomaly scores. Try out a few searches and see if you find anything useful before starting a new post. See the Before Posting section of the Read this first post.

You should fine that the anomaly likelihood score is generally more reliable and less fluctuating than the raw anomaly score. You can also find out how it is generated, and what thresholds you might use to indicate anomalies (0.9999 is typical, but you might want more or less 9s).


#3

Hi Matt(@rhyolight)
I dont post the question without going through previous posts and discussions , I got confused with different responses and clarifications on Anomaly likelihood , Hence I posted the question

In one of the documentation says , Anomaly likelihood is the
probability or confidence level on the current anomaly score , for ex : - anomaly score is .3 and Anomaly likelihood is .9999 , what I understood from the documentation is system is 99.99% confident that anomaly score is .3

As per the below documentation , System is 99.99% confident that current score is an anomaly .
AnomalyLikelihood

anomalyProbability(value, anomalyScore, timestamp=None)
Compute the probability that the current value plus anomaly score represents an anomaly given the historical distribution of anomaly scores. The closer the number is to 1, the higher the chance it is an anomaly.

Pls let me know which one is correct

Pls confirm my understanding
we have to use Anomaly likelihood when environment is extremely noisy (lot of fluctuations in the values )
We need look into Anomaly likelihood score when anomaly score is high .


#4

Hi @wip_user, I understand your confusion. The best reference code for anomaly detection is here:

In short, you should ignore the anomaly score completely. You should only use the anomaly likelihood. I recommend a threshold of >= 0.99999 The above code has some other best practices and has been proven to work well in a very wide variety of situations.

@rhyolight There are a lot of good questions about anomaly detection on the forum. It is hard for me to reply to each one. Perhaps at a future Hacker’s hangout we can cover the various questions in detail and more comprehensively?


#5

Thanks Subatai for valuable clarification . Apologies for inconvenience caused .


#6

Good idea, I’ll plan it!


#7

No inconvenience at all! Just hoped it helps!