[0, 2) 1 [2, 4) 2 [4, 6) 2 (“gearpump”, 1) WindowCounter In-memory Table • No window can be emitted since message as early as time 1 has not arrived (“gearpump”, 1) (“gearpump”, 3) (“gearpump”, 5) (“gearpump”, 4) (“gearpump”, 2) WindowCounter
states can cause anomaly words skipped • Duplicated states can cause false alarm States 4. Models 5. Anom aly words KafkaSource WindowCounter ModelCalculator AnomalyDetector KafkaSink kafka_offset window_counts models
1. Words 3. W indow Counts 2. Window Counts 4. Models 5. Anom aly words KafkaSource WindowCounter ModelCalculator AnomalyDetector KafkaSink The model algorithm doesn’t perform well