Snowflake Anomaly Detection

Anomaly detection is a critical capability for businesses to identify unusual patterns and outliers in their data that could indicate fraud, errors, or opportunities. Snowflake, the leading cloud data platform, offers powerful anomaly detection capabilities through Snowflake Anomaly Detection. In this article, we’ll dive into what Snowflake Anomaly Detection is, how it works under the hood using machine learning, and some examples of how to use it.

What is Anomaly Detection?

Anomaly detection is a crucial process in data analysis that involves identifying and flagging unusual or rare occurrences within a dataset. Anomalies, like outliers or errors, can affect data analysis and interpretation. They come in various forms and can have a big impact on the overall results.

Analysts can make sure their findings are accurate and reliable by finding and fixing anomalies. This can also help them discover new insights or opportunities they may have missed.

Different types of data require different anomaly detection techniques. Some common methods include statistics, machine learning, and visualization. Overall, anomaly detection plays a vital role in data-driven decision-making and helps organizations to better understand and leverage the information at their disposal. These anomalies could represent:

• Fraudulent transactions in financial data
• Faulty equipment readings in manufacturing sensor data
• Intrusion attempts in cybersecurity network logs
• Irregular symptoms or test results in healthcare data

By surfacing these anomalies, organizations can take quick action to investigate and remediate issues. However, given the massive scale of data that most organizations generate, manually sifting through data to find anomalies is like finding a needle in a haystack. This is where machine learning anomaly detection models come into play.

Snowflake’s Anomaly Detection Capability

Snowflake has built anomaly detection as a native capability directly into its cloud data platform. With a few simple SQL commands, you can train an anomaly detection model on your Snowflake data and use it to assign anomaly scores to new data points.

The core of Snowflake’s anomaly detection is the Cortex service. Cortex is Snowflake’s new machine learning platform that changes how data scientists and analysts work with data.

Users can create, train, and deploy machine learning models in Snowflake using Cortex. They don’t need to transfer data to another platform or learn new tools. Cortex simplifies the process of working with machine learning models in Snowflake.

This streamlined process allows for faster model development and deployment, as well as increased efficiency and collaboration among team members. Cortex simplifies machine learning for users by using SQL commands.

Users do not need to switch between different tools or environments. This makes it easier for users to work with machine learning. Overall, Cortex provides a user-friendly and efficient solution for organizations looking to leverage machine learning capabilities within their existing data infrastructure.

Key Benefits

Some of the key benefits of Snowflake Anomaly Detection include:

1. Fully SQL-based experience – train and score models using SQL
2. Automated model optimization – Cortex automatically tunes model hyperparameters
3. Scalable across massive datasets – leverages Snowflake’s distributed processing
4. Real-time scoring – score anomalies on streaming data as it arrives
5. Integration with other Snowflake services like data sharing and access control

How Anomaly Detection Works

Under the hood, Snowflake Anomaly Detection is powered by an optimized gradient boosting machine (GBM) model. Gradient Boosting Machine (GBM) is a powerful machine learning model that belongs to the ensemble learning family.

It works by combining multiple decision trees in a sequential manner to improve the predictive accuracy of the model. Each new decision tree learns from the mistakes of the ones before it. The goal is to decrease the total errors of the model.

GBM is good at finding complicated patterns in data that other machine learning algorithms may struggle to uncover. This model uses multiple decision trees. These trees are used to analyze how variables interact with each other. They help uncover relationships that may not be obvious with just one tree.

Gradient boosting is great because it can work with both numbers and categories, making it useful for many different things. GBM is reliable for real-world datasets because it can handle outliers and noise well.

This model is a popular choice for machine learning because it is accurate, flexible, and can handle complex data patterns.

The high-level steps are:

1. Train model – use CREATE SNOWFLAKE.ML.ANOMALY_DETECTION command to train GBM on historical data
2. Use <model_name>!DETECT_ANOMALIES to run the model. Output of the method is a table. In the table each input row is labeled as an anomaly or not.
3. Analyze the output.

To save the results you should get the ID of the last SQL command and save the result using RESULT_SCAN into the ‘my_ad_results’ table:

LET ad_res := SQLID;
CREATE TABLE my_ad_results AS SELECT * FROM TABLE(RESULT_SCAN(:ad_res));

Refer to the Snowflake documentation for an example of training an anomaly detection model.

Limitations

While a powerful technique, anomaly detection does have some limitations to be aware of:

• Requires sufficient historical data to establish a “normal” baseline
• Detects anomalies but doesn’t explain why they are anomalous
• Can have false positives for rare but legitimate data points
• Models can drift over time as data evolves and may need retraining

Additionally, the GBM model used by Snowflake is primarily suited for anomaly detection use cases rather than other ML tasks like classification or regression.

Other Snowflake ML Capabilities

Beyond anomaly detection, Snowflake Cortex offers other ML capabilities including:

• Linear and logistic regression models
• Time series forecasting
• Text and sentiment analysis
• Custom model import via ONNX and External Functions

Data scientists can enhance anomaly detection using customized machine learning solutions within the Snowflake environment.

Conclusion

Anomaly detection is a powerful tool for organizations to proactively identify and address data outliers. Snowflake Anomaly Detection is a machine learning technique that can be easily accessed through SQL. This makes it simple to add to current data pipelines and BI workflows.

Anomaly detection is not a solution for all problems. It can, however, notify you early about issues. It can also complement other practices related to data quality and security. We encourage you to try out Snowflake Anomaly Detection on your own data and see what insights you uncover.

DataSunrise uses its built-in anomaly detection model to detect suspicious user behavior. To learn more about anomaly detection for data security, audit, and compliance, please request for an online demo.