Entropy-based Anomaly Detection Module

The entropy-based anomaly detection module detects abrupt changes in the empirical entropy of a monitored feature. The entropy of a feature f is a well-suited synthetic index for describing an entire distribution, and in particular, useful for detecting important changes. Abrupt changes are detected by using a standard Exponential Weighted Moving Average (EWMA) algorithm.

Similar to ADTool, Entropy runs iteratively on the output of DBStream jobs. At every iteration, entropy retrieves the distribution corresponding to the last time-bin available, computes the corresponding empirical entropy, and uses the EWMA algorithm to decide on weather to flag an anomaly or not.

For further details on Entropy, we refer the reader to deliverable D4.3 and references therein.