3. Marco Parenzan
• Solution Sales Specialist @ Insight
• 1nn0va Community Lead (Pordenone)
• Microsoft Azure MVP
• Linkedin: https://www.linkedin.com/in/marcoparenzan/
• Slideshare: https://www.slideshare.net/marco.parenzan
• GitHub: https://github.com/marcoparenzan
• Anomaly Detection in Time Series
• Data Science for the .NET developer
• How Data Scientists work
• Bring ML.NET to Azure
• Anomaly Detection As A Service in Azure
• Time Series Anomaly Detection on Big Data (opt 1)
• Time Series Anomaly Detection on Big Data (opt 2)
• In an industrial fridge, you monitor temperatures to check
not the temperature «per se», but to check the healthy of
From real industrial fridges
7. With no any specific request...what happens
8. Threshold anomalies?
• Threshold Anomalies for a time window
• Slow changing damages
• Fridge is no more efficient
• Threshold alarms are not enough
• Anomalies cannot be just «over a threshold
for some time»...
• Condenser or Evaporator with difficulties
• Distinguish from Opening a door (that is
also an anomaly)
• Or also counting the number of times that
there are peaks (too many times)
• You can considering each of these events
as anomalies that alter the temperature
you measure in different part of the
10. How we can evolve...
11. A bit of theory
for Anomaly Detection
in Time Series
12. Anomaly Detection
• Anomaly detection is the process of identifying unexpected items or
events in data sets, which differ from the norm.
• And anomaly detection is often applied on unlabeled data which is
known as unsupervised anomaly detection.
13. Time Series
• Time series is a sequence of data points recorded in time order, often taken at successive
equally paced points in time.
• Stock prices, Sales demand, website traffic, daily temperatures, quarterly sales
• Time series is different from regression analysis because of its time-dependent
• Auto-correlation: Regression analysis requires that there is little or no autocorrelation in the
data. It occurs when the observations are not independent of each other. For example, in
stock prices, the current price is not independent of the previous price. [The observations
have to be dependent on time]
• Seasonality, a characteristic which we will discuss below.
14. Components of a Time Series
• is a general direction in which something is developing or changing. A trend can be
upward(uptrend) or downward(downtrend). It is not always necessary that the increase or
decrease is consistently in the same direction in a given period.
• Predictable pattern that recurs or repeats over regular intervals. Seasonality is often
observed within a year or less.
• Irregular fluctuation
• These are variations that occur due to sudden causes and are unpredictable. For example the
rise in prices of food due to war, flood, earthquakes, farmers striking etc.
15. Anomaly Detection in Time Series
• In time series data, an anomaly or outlier can be termed as a data
point which is not following the common collective trend or seasonal
or cyclic pattern of the entire data and is significantly distinct from
rest of the data. By significant, most data scientists mean statistical
significance, which in order words, signify that the statistical
properties of the data point is not in alignment with the rest of the
• Anomaly detection has two basic assumptions:
• Anomalies only occur very rarely in the data.
• Their features differ from the normal instances significantly.
17. Data Science and AI for the .NET developer
• ML.NET is first and foremost a framework that you can use
to create your own custom ML models. This custom
approach contrasts with “pre-built AI,” where you use pre-
designed general AI services from the cloud (like many of
the offerings from Azure Cognitive Services). This can work
great for many scenarios, but it might not always fit your
specific business needs due to the nature of the machine
learning problem or to the deployment context (cloud vs.
• ML.NET enables developers to use their existing .NET skills
to easily integrate machine learning into almost any .NET
application. This means that if C# (or F# or VB) is your
programming language of choice, you no longer have to
learn a new programming language, like Python or R, in
order to develop your own ML models and infuse custom
machine learning into your .NET apps.
20. Independent Identically Distributed (iid)
• Data points collected in the time series are independently sampled
from the same distribution (independent identically distributed).
Thus, the value at the current timestamp can be viewed as the value
at the next timestamp in expectation.
21. Singular Spectrum Analysis (SSA)
• This class implements the general anomaly detection transform based
on Singular Spectrum Analysis (SSA). SSA is a powerful framework for
decomposing the time-series into trend, seasonality and noise
components as well as forecasting the future values of the time-
• In principle, SSA performs spectral analysis on the input time-series
where each component in the spectrum corresponds to a trend,
seasonal or noise component in the time-series
22. Spectrum Residual Cnn (SrCnn)
• To monitor the time-series continuously and alert for potential incidents on time
• The algorithm first computes the Fourier Transform of the original data. Then it computes
the spectral residual of the log amplitude of the transformed signal before applying the Inverse
Fourier Transform to map the sequence back from the frequency to the time domain. This
sequence is called the saliency map. The anomaly score is then computed as the relative
difference between the saliency map values and their moving averages. If the score is above a
threshold, the value at a specific timestep is flagged as an outlier.
• There are several parameters for SR algorithm. To obtain a model with good performance, we
suggest to tune windowSize and threshold at first, these are the most important parameters to
SR. Then you could search for an appropriate judgementWindowSize which is no larger than
windowSize. And for the remaining parameters, you could use the default value directly.
• Time-Series Anomaly Detection Service at Microsoft [https://arxiv.org/pdf/1906.03821.pdf]
23. Helping no-data scientits developers (all! )
• Unsupervised Machine
• Automated Training Set for
Anomaly Detection Algorithms
• the algorithms automatically
generates a simulated training
set based non your input data
• Auto(mated) MLfind the best
tuning for you with parameters
24. Some tools required
• .NET 5 + WPF + ML.NET
• Mandatory , the platform where we try to make experiments
• Xplot.Ploty (soon you will understand I use this) https://fslab.org/XPlot/
• XPlot is a cross-platform data visualization package for the F# programming language powered by
mapping for the configuration options of the underlying libraries and so you get a nice F#
interface that gives you access to the full power of Plotly and Google Charts. The XPlot library can
be used interactively from F# Interactive, but charts can equally easy be embedded in F#
applications and in HTML reports.
• WebView2 https://docs.microsoft.com/en-us/microsoft-edge/webview2/gettingstarted/wpf
• The Microsoft Edge WebView2 control enables you to embed web technologies (HTML, CSS, and
rendering engine to display the web content in native apps. With WebView2, you may embed
web code in different parts of your native app. Build all of the native app within a single WebView
• Evolution and generalization of the seminal role of Mathematica
• In web standards way
• Web (HTTP+Markdown)
• Python adoption (ipynb)
• Written in Java
• Python has an interop bridge...not native (if ever
important)Python is a kernel for Jupyter
28. .NET Interactive and Jupyter
and Visual Studio Code
• .NET Interactive gives C# and F# kernels to Jupyter
• .NET Interactive gives all tools to create your hosting application
independently from Jupyter
• In Visual Studio Code, you have two different notebooks (looking similar
but developed in parallel by different teams)
• .NET Interactive Notebook (by the .NET Interactive Team) that can run also Python
• Jupyter Notebook (by the Azure Data Studio Team – probably) that can run also C#
• There is a little confusion on that
• .NET Interactive has a strong C#/F# Kernel...
• ...a less mature infrastructure (compared to Jupiter)
36. Azure Cognitive Services
• Cognitive Services brings AI within reach of every developer—without requiring
machine-learning expertise. All it takes is an API call to embed the ability to see,
hear, speak, search, understand, and accelerate decision-making into your apps.
Enable developers of all skill levels to easily add AI capabilities to their apps.
• Five areas:
• Web search
Identify potential problems early on.
Detect potentially offensive or unwanted
Metrics Advisor PREVIEW
Monitor metrics and diagnose issues.
Create rich, personalized experiences for every
37. Anomaly Detector
• Through an API, Anomaly Detector ingests time-series data of all
types and selects the best-fitting detection model for your data to
ensure high accuracy. Customize the service to detect any level of
anomaly and deploy it where you need it most -- from the cloud to
the intelligent edge with containers. Azure is the only major cloud
provider that offers anomaly detection as an AI service.
40. Azure Synapse Analytics
Limitless analytics service with unmatched time to insight
Data Lake Storage
Common Data Model
Optimized for Analytics
Python .NET Java Scala
Experience Synapse Analytics Studio
Artificial Intelligence / Machine Learning / Internet of Things
Intelligent Apps / Business Intelligence
41. Develop Hub - SQL scripts
Authoring SQL Scripts
Execute SQL script on dedicated SQL pool or serverless
Commit individual SQL script or multiple SQL scripts
through Commit all feature
Language support and intellisense
42. Develop Hub - Notebooks
As notebook cells run, the underlying Spark
application status is shown. Providing
immediate feedback and progress tracking.
43. Ingest Flat files to tables
Ingest flat file data into Azure Storage (Azure Data Lake Store Gen2)
• When your data sources are on-premises, you need to move the data to
Azure Storage before ingestion.
• Data in other cloud platforms needs to be moved to Azure Storage
Load from flat files as relational tables within the data warehouse
44. ADLS Gen 2 Filesystem
Ingest - Structuring ADLS Gen2
• Separate storage accounts for each environment: dev, test, & production.
• Use a common folder structure to organize data by degree of refinement.
45. Create External Table As Select (Polybase)
-- Create a database master key if one does not already exist
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'S0me!nfo'
-- Create a database scoped credential with Azure storage account key as the secret.
CREATE DATABASE SCOPED CREDENTIAL AzureStorageCredential
IDENTITY = '<my_account>'
, SECRET = '<azure_storage_account_key>'
-- Create an external data source with CREDENTIAL option.
CREATE EXTERNAL DATA SOURCE MyAzureStorage
( LOCATION = 'wasbs://firstname.lastname@example.org/'
, CREDENTIAL = AzureStorageCredential
, TYPE = HADOOP
-- Create an external file format
CREATE EXTERNAL FILE FORMAT MyAzureCSVFormat
WITH (FORMAT_TYPE = DELIMITEDTEXT,
FIELD_TERMINATOR = ',',
FIRST_ROW = 2)
--Create an external table
CREATE EXTERNAL TABLE dbo.FactInternetSalesNew
LOCATION = '/files/Customer',
DATA_SOURCE = MyAzureStorage,
FILE_FORMAT = MyAzureCSVFormat
AS SELECT T1.* FROM dbo.FactInternetSales T1 JOIN dbo.DimCustomer T2
ON ( T1.CustomerKey = T2.CustomerKey )
OPTION ( HASH JOIN );
• Start simple and bulk: you already have data
• If you have daily data, you need to aggregate (a month?) to have training
• take time for a correct Data Lake strategy
• there is time for realtime
• The right algorithm is the one that gives you what you want to see
• Also professionals make the same (besides REAL data scientists)
• But if you know statistics, if better for you
• Azure Cognitive Services will become more important
• New Metrics Advisor Service!
50. Thank you!
Solution Sales Specialist @ Insight
Microsoft Azure MVP
1nn0va Community Lead
Anomaly detection is the process of identifying unexpected items or events in data sets, which differ from the norm. And anomaly detection is often applied on unlabeled data which is known as unsupervised anomaly detection.
SSA works by decomposing a time-series into a set of principal components. These components can be interpreted as the parts of a signal that correspond to trends, noise, seasonality, and many other factors. Then, these components are reconstructed and used to forecast values some time in the future.
The Spectral Residual outlier detector is based on the paper Time-Series Anomaly Detection Service at Microsoft and is suitable for unsupervised online anomaly detection in univariate time series data. The algorithm first computes the Fourier Transform of the original data. Then it computes the spectral residual of the log amplitude of the transformed signal before applying the Inverse Fourier Transform to map the sequence back from the frequency to the time domain. This sequence is called the saliency map. The anomaly score is then computed as the relative difference between the saliency map values and their moving averages. If the score is above a threshold, the value at a specific timestep is flagged as an outlier. For more details, please check out the paper.
Modernize applications with .NET Core
Today we focused on Cloud-optimized .NET Framework apps. However, many applications will benefit from modern architecture built on .NET Core – a much faster, modular, cross-platform, open source .NET. Websites can be modernized with ASP.NET Core to bring in better security, compliance, and much better performance than ASP.NET on .NET Framework. .NET Core also provides code patterns for building resilient, high-performance microservices on Linux and Windows.
What specific approach would you say is the most efficient way for moving flat file data from the ingest storage locations to the data lake?
Follow the pattern of landing data in the data lake first, then ingest from the flat files into relational tables within the data warehouse. Then create pipelines that extract the source data and store in Azure Data Lake Store Gen2 as Parquet files.
What storage service would you recommend to use?
They should use Azure Data Lake Store (ADLS) Gen2 (Azure Storage with hierarchical file systems).
How would you recommend to structure the folder to manage the data at the various levels of refinement?
They should use Azure Data Lake Store (ADLS) Gen2 (Azure Storage with hierarchical file systems).
In ADLS, it is a best practice to have a dedicated Storage Account for production, and a separate Storage Account for dev and test workloads. This will ensure that dev or test workloads never interfere with production.
One common folder structure is to organize the data in separate folders by degree of refinement. For example a bronze folder contains the raw data, silver contains the cleaned, prepared and integrated data and gold contains data ready to support analytics, which might include final refinements such as pre-computed aggregates.
Use external tables with Synapse SQL - Azure Synapse Analytics | Microsoft Docs