add threshold for RCA (#5218)

Author: suxi-ms

src/Microsoft.ML.TimeSeries/ExtensionsCatalog.cs

@@ -187,25 +187,28 @@ public static IDataView DetectEntireAnomalyBySrCnn(this AnomalyDetectionCatalog
         /// It is used when score is calculated for each root cause item. The range of beta should be in [0,1].
         /// For a larger beta, root cause items which have a large difference between value and expected value will get a high score.
         /// For a small beta, root cause items which have a high relative change will get a low score.</param>
+        /// <param name="rootCauseThreshold">A threshold to determine whether the point should be root cause. The range of this threshold should be in [0,1].
+        /// If the point's delta is equal to or larger than rootCauseThreshold multiplied by anomaly dimension point's delta, this point is treated as a root cause. Different threshold will turn out different results. Users can choose the delta according to their data and requirments.</param>
         /// <example>
         /// <format type="text/markdown">
         /// <![CDATA[
         /// [!code-csharp[LocalizeRootCause](~/../docs/samples/docs/samples/Microsoft.ML.Samples/Dynamic/Transforms/TimeSeries/LocalizeRootCause.cs)]
         /// ]]>
         /// </format>
         /// </example>
-        public static RootCause LocalizeRootCause(this AnomalyDetectionCatalog catalog, RootCauseLocalizationInput src, double beta = 0.5)
+        public static RootCause LocalizeRootCause(this AnomalyDetectionCatalog catalog, RootCauseLocalizationInput src, double beta = 0.3, double rootCauseThreshold = 0.95)
         {
             IHostEnvironment host = CatalogUtils.GetEnvironment(catalog);
 
             //check the root cause input
             CheckRootCauseInput(host, src);
 
-            //check beta
+            //check parameters
             host.CheckUserArg(beta >= 0 && beta <= 1, nameof(beta), "Must be in [0,1]");
+            host.CheckUserArg(rootCauseThreshold >= 0 && rootCauseThreshold <= 1, nameof(beta), "Must be in [0,1]");
 
             //find out the root cause
-            RootCauseAnalyzer analyzer = new RootCauseAnalyzer(src, beta);
+            RootCauseAnalyzer analyzer = new RootCauseAnalyzer(src, beta, rootCauseThreshold);
             RootCause dst = analyzer.Analyze();
             return dst;
         }

src/Microsoft.ML.TimeSeries/RootCauseAnalyzer.cs

@@ -13,16 +13,17 @@ namespace Microsoft.ML.TimeSeries
     public class RootCauseAnalyzer
     {
         private static double _anomalyRatioThreshold = 0.5;
-        private static double _anomalyDeltaThreshold = 0.95;
         private static double _anomalyPreDeltaThreshold = 2;
 
         private RootCauseLocalizationInput _src;
         private double _beta;
+        private double _rootCauseThreshold;
 
-        public RootCauseAnalyzer(RootCauseLocalizationInput src, double beta)
+        public RootCauseAnalyzer(RootCauseLocalizationInput src, double beta, double rootCauseThreshold)
         {
             _src = src;
             _beta = beta;
+            _rootCauseThreshold = rootCauseThreshold;
         }
 
         public RootCause Analyze()
@@ -39,10 +40,10 @@ private RootCause AnalyzeOneLayer(RootCauseLocalizationInput src)
             dst.Items = new List<RootCauseItem>();
 
             DimensionInfo dimensionInfo = SeparateDimension(src.AnomalyDimension, src.AggregateSymbol);
-            Tuple<PointTree, PointTree, Dictionary<string, TimeSeriesPoint>> pointInfo = GetPointsInfo(src, dimensionInfo);
+            Tuple<PointTree, PointTree, Dictionary<Dictionary<string, object>, TimeSeriesPoint>> pointInfo = GetPointsInfo(src, dimensionInfo);
             PointTree pointTree = pointInfo.Item1;
             PointTree anomalyTree = pointInfo.Item2;
-            Dictionary<string, TimeSeriesPoint> dimPointMapping = pointInfo.Item3;
+            Dictionary<Dictionary<string, Object>, TimeSeriesPoint> dimPointMapping = pointInfo.Item3;
 
             //which means there is no anomaly point with the anomaly dimension or no point under anomaly dimension
             if (anomalyTree.ParentNode == null || dimPointMapping.Count == 0)
@@ -81,11 +82,12 @@ private DimensionInfo SeparateDimension(Dictionary<string, Object> dimensions, O
             return info;
         }
 
-        private Tuple<PointTree, PointTree, Dictionary<string, TimeSeriesPoint>> GetPointsInfo(RootCauseLocalizationInput src, DimensionInfo dimensionInfo)
+        private Tuple<PointTree, PointTree, Dictionary<Dictionary<string, object>, TimeSeriesPoint>> GetPointsInfo(RootCauseLocalizationInput src, DimensionInfo dimensionInfo)
         {
             PointTree pointTree = new PointTree();
             PointTree anomalyTree = new PointTree();
-            Dictionary<string, TimeSeriesPoint> dimPointMapping = new Dictionary<string, TimeSeriesPoint>();
+            DimensionComparer dc = new DimensionComparer();
+            Dictionary<Dictionary<string, object>, TimeSeriesPoint> dimPointMapping = new Dictionary<Dictionary<string, object>, TimeSeriesPoint>(dc);
 
             List<TimeSeriesPoint> totalPoints = GetTotalPointsForAnomalyTimestamp(src);
             Dictionary<string, Object> subDim = GetSubDim(src.AnomalyDimension, dimensionInfo.DetailDims);
@@ -94,9 +96,9 @@ private Tuple<PointTree, PointTree, Dictionary<string, TimeSeriesPoint>> GetPoin
             {
                 if (ContainsAll(point.Dimension, subDim))
                 {
-                    if (!dimPointMapping.ContainsKey(GetDicCode(point.Dimension)))
+                    if (!dimPointMapping.ContainsKey(point.Dimension))
                     {
-                        dimPointMapping.Add(GetDicCode(point.Dimension), point);
+                        dimPointMapping.Add(point.Dimension, point);
                         bool isValidPoint = point.IsAnomaly == true;
                         if (ContainsAll(point.Dimension, subDim))
                         {
@@ -111,7 +113,7 @@ private Tuple<PointTree, PointTree, Dictionary<string, TimeSeriesPoint>> GetPoin
                 }
             }
 
-            return new Tuple<PointTree, PointTree, Dictionary<string, TimeSeriesPoint>>(pointTree, anomalyTree, dimPointMapping);
+            return new Tuple<PointTree, PointTree, Dictionary<Dictionary<string, Object>, TimeSeriesPoint>>(pointTree, anomalyTree, dimPointMapping);
         }
 
         protected Dictionary<string, Object> GetSubDim(Dictionary<string, Object> dimension, List<string> keyList)
@@ -327,7 +329,7 @@ private AnomalyDirection GetRootCauseDirection(TimeSeriesPoint rootCausePoint)
             }
         }
 
-        private void GetRootCauseDirectionAndScore(Dictionary<string, TimeSeriesPoint> dimPointMapping, Dictionary<string, Object> anomalyRoot, RootCause dst, double beta, PointTree pointTree, AggregateType aggType, Object aggSymbol)
+        private void GetRootCauseDirectionAndScore(Dictionary<Dictionary<string, Object>, TimeSeriesPoint> dimPointMapping, Dictionary<string, Object> anomalyRoot, RootCause dst, double beta, PointTree pointTree, AggregateType aggType, Object aggSymbol)
         {
             TimeSeriesPoint anomalyPoint = GetPointByDimension(dimPointMapping, anomalyRoot, pointTree, aggType, aggSymbol);
             if (dst.Items.Count > 1)
@@ -378,11 +380,11 @@ private void GetRootCauseDirectionAndScore(Dictionary<string, TimeSeriesPoint> d
             }
         }
 
-        private TimeSeriesPoint GetPointByDimension(Dictionary<string, TimeSeriesPoint> dimPointMapping, Dictionary<string, Object> dimension, PointTree pointTree, AggregateType aggType, Object aggSymbol)
+        private TimeSeriesPoint GetPointByDimension(Dictionary<Dictionary<string, Object>, TimeSeriesPoint> dimPointMapping, Dictionary<string, Object> dimension, PointTree pointTree, AggregateType aggType, Object aggSymbol)
         {
-            if (dimPointMapping.ContainsKey(GetDicCode(dimension)))
+            if (dimPointMapping.ContainsKey(dimension))
             {
-                return dimPointMapping[GetDicCode(dimension)];
+                return dimPointMapping[dimension];
             }
 
             int count = 0;
@@ -419,11 +421,6 @@ private TimeSeriesPoint GetPointByDimension(Dictionary<string, TimeSeriesPoint>
             }
         }
 
-        private static string GetDicCode(Dictionary<string, Object> dic)
-        {
-            return string.Join(";", dic.Select(x => x.Key + "=" + (string)x.Value).ToArray());
-        }
-
         private void BuildTree(PointTree tree, List<string> aggDims, TimeSeriesPoint point, Object aggSymbol)
         {
             int aggNum = 0;
@@ -476,22 +473,23 @@ private BestDimension FindBestDimension(SortedDictionary<BestDimension, double>
                         bool isRatioNan = Double.IsNaN(valueRatioMap[best]);
                         if (dimension.Key.AnomalyDis.Count > 1)
                         {
-                            if (!isRatioNan && (best.AnomalyDis.Count != 1 && (isLeavesLevel ? valueRatioMap[best].CompareTo(dimension.Value) <= 0 : valueRatioMap[best].CompareTo(dimension.Value) >= 0)))
+                            if (best.AnomalyDis.Count != 1 && !isRatioNan && (isLeavesLevel ? valueRatioMap[best].CompareTo(dimension.Value) <= 0 : valueRatioMap[best].CompareTo(dimension.Value) >= 0))
                             {
-                                best = dimension.Key;
+                                best = GetBestDimension(best, dimension, valueRatioMap);
                             }
                         }
-                        else
+                        else if (dimension.Key.AnomalyDis.Count == 1)
                         {
+
                             if (best.AnomalyDis.Count > 1)
                             {
                                 best = dimension.Key;
                             }
-                            else
+                            else if (best.AnomalyDis.Count == 1)
                             {
                                 if (!isRatioNan && (isLeavesLevel ? valueRatioMap[best].CompareTo(dimension.Value) <= 0 : valueRatioMap[best].CompareTo(dimension.Value) >= 0))
                                 {
-                                    best = dimension.Key;
+                                    best = GetBestDimension(best, dimension, valueRatioMap);
                                 }
                             }
                         }
@@ -502,6 +500,22 @@ private BestDimension FindBestDimension(SortedDictionary<BestDimension, double>
             return best;
         }
 
+        private BestDimension GetBestDimension(BestDimension best, KeyValuePair<BestDimension, double> dimension, Dictionary<BestDimension, Double> valueRatioMap)
+        {
+            if (valueRatioMap[best].CompareTo(dimension.Value) == 0)
+            {
+                if (dimension.Key.AnomalyDis.Count != dimension.Key.PointDis.Count)
+                {
+                    best = dimension.Key;
+                }
+            }
+            else
+            {
+                best = dimension.Key;
+            }
+            return best;
+        }
+
         /// <summary>
         /// Calculate the surprise score according to root cause point and anomaly point
         /// </summary>
@@ -569,6 +583,10 @@ private double GetFinalScore(double surprise, double ep, double beta)
             else
             {
                 a = (1 - Math.Pow(2, -surprise));
+                if (Double.IsNaN(a))
+                {
+                    a = 1;
+                }
                 b = (1 - Math.Pow(2, -ep));
             }
 
@@ -593,7 +611,7 @@ private static Dictionary<string, Object> UpdateDimensionValue(Dictionary<string
 
         private bool StopAnomalyComparison(double preTotal, double parent, double current, double pre)
         {
-            if (Math.Abs(preTotal) < Math.Abs(parent) * _anomalyDeltaThreshold)
+            if (Math.Abs(preTotal) < Math.Abs(parent) * _rootCauseThreshold)
             {
                 return false;
             }
@@ -603,7 +621,7 @@ private bool StopAnomalyComparison(double preTotal, double parent, double curren
 
         private bool ShouldSeparateAnomaly(double total, double parent, int totalSize, int size)
         {
-            if (Math.Abs(total) < Math.Abs(parent) * _anomalyDeltaThreshold)
+            if (Math.Abs(total) < Math.Abs(parent) * _rootCauseThreshold)
             {
                 return false;
             }
@@ -657,7 +675,7 @@ private void UpdateDistribution(Dictionary<string, int> distribution, List<TimeS
         {
             foreach (TimeSeriesPoint point in points)
             {
-                string dimVal = (string)point.Dimension[dimKey];
+                string dimVal = Convert.ToString(point.Dimension[dimKey]);
                 if (!distribution.ContainsKey(dimVal))
                 {
                     distribution.Add(dimVal, 0);
@@ -684,7 +702,7 @@ private static bool ContainsAll(Dictionary<string, Object> bigDictionary, Dictio
 
         private bool IsAggregationDimension(Object val, Object aggSymbol)
         {
-            return val.Equals(aggSymbol);
+            return Convert.ToString(val).Equals(aggSymbol);
         }
     }
 
@@ -748,4 +766,47 @@ public RootCauseScore(double surprise, double explanatoryScore)
             ExplanatoryScore = explanatoryScore;
         }
     }
-}
+
+    internal class DimensionComparer : EqualityComparer<Dictionary<string, object>>
+    {
+        public override bool Equals(Dictionary<string, object> x, Dictionary<string, object> y)
+        {
+            if (x == null && y == null)
+            {
+                return true;
+            }
+            if ((x == null && y != null) || (x != null && y == null))
+            {
+                return false;
+            }
+            if (x.Count != y.Count)
+            {
+                return false;
+            }
+            if (x.Keys.Except(y.Keys).Any())
+            {
+                return false;
+            }
+            if (y.Keys.Except(x.Keys).Any())
+            {
+                return false;
+            }
+            foreach (var pair in x)
+            {
+                if (!pair.Value.Equals(y[pair.Key]))
+                {
+                    return false;
+                }
+            }
+            return true;
+        }
+
+        public override int GetHashCode(Dictionary<string, object> obj)
+        {
+            int code = 0;
+            foreach (KeyValuePair<string, object> pair in obj)
+                code = code ^ pair.GetHashCode();
+            return code;
+        }
+    }
+}