AI Anomaly Detector (TS)

The AI Anomaly Detector (TS) activity detects anomalies in a time series using the SR-CNN (Spectral Residual + CNN) algorithm and writes detection results to an output staging table.

Purpose

Use the AI Anomaly Detector (TS) activity to:

• Identify time points in a series where values deviate unusually from the expected pattern
• Detect data quality issues in time series imports (sudden spikes, dropped values)
• Flag anomalous periods for investigation before they reach the model

Algorithm

Uses ML.NET DetectEntireAnomalyBySrCnn with these fixed settings:

• Threshold: 0.3
• Sensitivity: 64.0
• Detect Mode: AnomalyAndMargin (returns anomaly flag plus confidence bounds)
• Period: auto-detected from the series (falls back to 0 if detection returns negative)

Configuration

Input Staging Table

The staging table containing the time series. Must have a numeric value column and a sort column.

Sort Column

The column used to sort the series into time order before anomaly detection.

Output Staging Table

The staging table where detection results are written.

Transforms

Pre-processing pipeline. Use Convert Type to ensure the value column is numeric.

Train Model step settings:

Setting	Description
Forecasted Column	The name of the column containing the time series values to analyse

Row Filter (optional)

Filter the input data before processing.

Output Schema

Column	Description
Index	Row number (0-based)
Data	Original value
Anomaly	1 if anomaly detected, 0 otherwise
AnomalyScore	Confidence score for the anomaly label
Mag	Magnitude of the anomaly
ExpectedValue	Model's expected value for this point
UpperBoundary	Upper boundary of the expected range
LowerBoundary	Lower boundary of the expected range
<SortColumn>	The sort column value, carried through from input

A sample of the first 5 predictions is logged to the workflow run log, with anomaly alerts flagged.

Usage Notes

• The period is auto-detected from the series using ML.NET's seasonality detection. If the series has no detectable seasonal pattern, the period defaults to 0 (non-seasonal detection).
• SR-CNN analyses the entire series at once (not a streaming approach). The full input table is loaded into memory.
• The threshold and sensitivity are fixed at 0.3 and 64.0 respectively.

Best Practices

• Sort the input data by the Sort Column before this activity (or let the Sort Column setting handle it).
• Use a Row Filter if the staging table contains multiple entities or series — the algorithm expects a single series per run.
• Review the AnomalyScore column to understand confidence levels. A score near 1 is a high-confidence anomaly.

Needs Review

Threshold (0.3) and sensitivity (64.0) are currently hardcoded. Confirm whether these should be configurable, and update this documentation if they become user-settable.

JSON Reference

{
  "discriminator": "TimeSeriesAnomalyDetectionBySrCnnWorkflowActivity",
  "activityId": "<uuid>",
  "name": "AI Anomaly Detector (TS)",
  "positionX": 0,
  "positionY": 0,
  "advanceRule": 2,
  "inputStagingTable": "StagingTimeSeries",
  "outputStagingTable": "StagingAnomalies",
  "fsoPath": "",
  "mode": 0,
  "transforms": [],
  "filter": null,
  "sortColumnName": "Period",
  "inputColumnName": "Value",
  "outputColumnName": "IsSpike"
}

Property	Type	Description
inputStagingTable	string	Corresponds to the Input Staging Table field. The staging table containing the time series to analyse.
outputStagingTable	string	Corresponds to the Output Staging Table field. The staging table where anomaly detection results are written.
fsoPath	string	File system path. Not used by this activity but present as an inherited field.
mode	integer	0 = TrainModel, 1 = RunModel. Not applicable — this activity processes in a single pass.
transforms	array	Corresponds to the Transforms editor. Array of transform objects for pre-processing.
filter	object | null	Corresponds to the Row Filter field. An optional filter applied to input rows before processing. null means no filter.
sortColumnName	string	Corresponds to the Sort Column field. Column used to sort the series into time order.
inputColumnName	string	Corresponds to the Forecasted Column setting. The column containing the time series values to analyse.
outputColumnName	string	Column name used internally for the output anomaly vector. Default: "IsSpike".