/** * Return the probability that the current value plus anomaly score represents * an anomaly given the historical distribution of anomaly scores. The closer * the number is to 1, the higher the chance it is an anomaly. * * Given the current metric value, plus the current anomaly score, output the * anomalyLikelihood for this record. * * @param value input value * @param anomalyScore current anomaly score * @param timestamp (optional) timestamp * @return Given the current metric value, plus the current anomaly score, output the * anomalyLikelihood for this record. */ public double AnomalyProbability(double value, double anomalyScore, DateTime timestamp) { if (timestamp == null) { timestamp = new DateTime(); } Sample dataPoint = new Sample(timestamp, value, anomalyScore); double likelihoodRetval; if (historicalScores.Count < probationaryPeriod) { likelihoodRetval = 0.5; } else { if (distribution == null || iteration % reestimationPeriod == 0) { this.distribution = EstimateAnomalyLikelihoods( historicalScores, 10, claLearningPeriod).GetParams(); } AnomalyLikelihoodMetrics metrics = UpdateAnomalyLikelihoods(new List <Sample> { dataPoint }, this.distribution); this.distribution = metrics.GetParams(); likelihoodRetval = 1.0 - metrics.GetLikelihoods()[0]; } historicalScores.Add(dataPoint); this.iteration += 1; return(likelihoodRetval); }