| | | 1 | | using Intentum.Analytics.Models; |
| | | 2 | | using Intentum.Persistence.Repositories; |
| | | 3 | | |
| | | 4 | | namespace Intentum.Analytics; |
| | | 5 | | |
| | | 6 | | /// <summary> |
| | | 7 | | /// Detects behavior patterns and frequency anomalies from intent history using intent-name sequences. |
| | | 8 | | /// </summary> |
| | | 9 | | public sealed class BehaviorPatternDetector : IBehaviorPatternDetector |
| | | 10 | | { |
| | | 11 | | private readonly IIntentHistoryRepository _historyRepository; |
| | | 12 | | |
| | 8 | 13 | | public BehaviorPatternDetector(IIntentHistoryRepository historyRepository) |
| | 8 | 14 | | { |
| | 8 | 15 | | _historyRepository = historyRepository ?? throw new ArgumentNullException(nameof(historyRepository)); |
| | 7 | 16 | | } |
| | | 17 | | |
| | | 18 | | /// <inheritdoc /> |
| | | 19 | | public async Task<IReadOnlyList<BehaviorPattern>> GetBehaviorPatternsAsync( |
| | | 20 | | DateTimeOffset start, |
| | | 21 | | DateTimeOffset end, |
| | | 22 | | int minSequenceLength = 2, |
| | | 23 | | int maxSequenceLength = 5, |
| | | 24 | | CancellationToken cancellationToken = default) |
| | 2 | 25 | | { |
| | 2 | 26 | | var records = await _historyRepository.GetByTimeWindowAsync(start, end, cancellationToken); |
| | 6 | 27 | | var ordered = records.OrderBy(r => r.RecordedAt).ToList(); |
| | 2 | 28 | | var sequenceCounts = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase); |
| | | 29 | | |
| | 14 | 30 | | for (var len = Math.Min(minSequenceLength, maxSequenceLength); len <= maxSequenceLength; len++) |
| | 5 | 31 | | { |
| | 16 | 32 | | for (var i = 0; i <= ordered.Count - len; i++) |
| | 3 | 33 | | { |
| | 9 | 34 | | var seq = ordered.Skip(i).Take(len).Select(r => r.IntentName).ToList(); |
| | 3 | 35 | | var key = string.Join("|", seq); |
| | 3 | 36 | | sequenceCounts[key] = sequenceCounts.GetValueOrDefault(key) + 1; |
| | 3 | 37 | | } |
| | 5 | 38 | | } |
| | | 39 | | |
| | 2 | 40 | | return sequenceCounts |
| | 2 | 41 | | .Where(kv => kv.Value >= 1) |
| | 2 | 42 | | .Select(kv => new BehaviorPattern( |
| | 2 | 43 | | kv.Key.Split('|').ToList(), |
| | 2 | 44 | | kv.Value)) |
| | 2 | 45 | | .OrderByDescending(p => p.Count) |
| | 2 | 46 | | .ToList(); |
| | 2 | 47 | | } |
| | | 48 | | |
| | | 49 | | /// <inheritdoc /> |
| | | 50 | | public async Task<IReadOnlyList<PatternAnomalyReport>> GetPatternAnomaliesAsync( |
| | | 51 | | DateTimeOffset start, |
| | | 52 | | DateTimeOffset end, |
| | | 53 | | TimeSpan bucketSize, |
| | | 54 | | double frequencyMultiplierThreshold = 10.0, |
| | | 55 | | CancellationToken cancellationToken = default) |
| | 2 | 56 | | { |
| | 2 | 57 | | var records = await _historyRepository.GetByTimeWindowAsync(start, end, cancellationToken); |
| | 2 | 58 | | var reports = new List<PatternAnomalyReport>(); |
| | | 59 | | |
| | 2 | 60 | | if (records.Count == 0) |
| | 1 | 61 | | return reports; |
| | | 62 | | |
| | 27 | 63 | | var globalIntentCounts = records.GroupBy(r => r.IntentName).ToDictionary(g => g.Key, g => g.Count()); |
| | 1 | 64 | | var total = records.Count; |
| | 23 | 65 | | var buckets = records.GroupBy(r => TruncateToBucket(r.RecordedAt, bucketSize)).ToList(); |
| | | 66 | | |
| | 7 | 67 | | foreach (var bucket in buckets) |
| | 2 | 68 | | { |
| | 2 | 69 | | var bucketStart = bucket.Key; |
| | 2 | 70 | | var bucketEnd = bucketStart + bucketSize; |
| | 2 | 71 | | var bucketRecords = bucket.ToList(); |
| | 2 | 72 | | var bucketTotal = bucketRecords.Count; |
| | 28 | 73 | | var bucketIntentCounts = bucketRecords.GroupBy(r => r.IntentName).ToDictionary(g => g.Key, g => g.Count()); |
| | | 74 | | |
| | 10 | 75 | | foreach (var (intentName, bucketCount) in bucketIntentCounts) |
| | 2 | 76 | | { |
| | 2 | 77 | | var globalCount = globalIntentCounts.GetValueOrDefault(intentName, 0); |
| | 2 | 78 | | var expectedInBucket = (globalCount / (double)total) * bucketTotal; |
| | 2 | 79 | | if (expectedInBucket <= 0) continue; |
| | 2 | 80 | | var ratio = bucketCount / expectedInBucket; |
| | 2 | 81 | | if (ratio >= frequencyMultiplierThreshold) |
| | 1 | 82 | | { |
| | 1 | 83 | | reports.Add(new PatternAnomalyReport( |
| | 1 | 84 | | "FrequencySpike", |
| | 1 | 85 | | $"Intent '{intentName}' {ratio:F1}x more frequent in bucket than baseline.", |
| | 1 | 86 | | bucketStart, |
| | 1 | 87 | | bucketStart, |
| | 1 | 88 | | bucketEnd, |
| | 1 | 89 | | Math.Min(1, ratio / 20), |
| | 1 | 90 | | new Dictionary<string, object> |
| | 1 | 91 | | { |
| | 1 | 92 | | ["IntentName"] = intentName, |
| | 1 | 93 | | ["BucketCount"] = bucketCount, |
| | 1 | 94 | | ["ExpectedInBucket"] = expectedInBucket, |
| | 1 | 95 | | ["Ratio"] = ratio |
| | 1 | 96 | | })); |
| | 1 | 97 | | } |
| | 2 | 98 | | } |
| | 2 | 99 | | } |
| | | 100 | | |
| | 1 | 101 | | return reports.OrderByDescending(r => r.Severity).ToList(); |
| | 2 | 102 | | } |
| | | 103 | | |
| | | 104 | | /// <inheritdoc /> |
| | | 105 | | public IReadOnlyList<TemplateMatch> MatchTemplates( |
| | | 106 | | IReadOnlyList<BehaviorPattern> patterns, |
| | | 107 | | IReadOnlyList<IntentTemplate> templates) |
| | 3 | 108 | | { |
| | 3 | 109 | | var matches = new List<TemplateMatch>(); |
| | 13 | 110 | | foreach (var template in templates) |
| | 2 | 111 | | { |
| | 2 | 112 | | var bestScore = 0.0; |
| | 2 | 113 | | var bestMatched = new List<string>(); |
| | 2 | 114 | | var expected = template.ExpectedIntentNames; |
| | 15 | 115 | | foreach (var seq in patterns.Select(p => p.Sequence)) |
| | 3 | 116 | | { |
| | 26 | 117 | | var overlap = seq.Count(s => expected.Any(e => string.Equals(e, s, StringComparison.OrdinalIgnoreCase))) |
| | 3 | 118 | | var score = expected.Count > 0 ? overlap / (double)expected.Count : 0; |
| | 3 | 119 | | if (score > bestScore) |
| | 1 | 120 | | { |
| | 1 | 121 | | bestScore = score; |
| | 10 | 122 | | bestMatched = seq.Where(s => expected.Any(e => string.Equals(e, s, StringComparison.OrdinalIgnoreCas |
| | 1 | 123 | | } |
| | 3 | 124 | | } |
| | 2 | 125 | | if (bestScore > 0) |
| | 1 | 126 | | matches.Add(new TemplateMatch(template.Name, bestScore, bestMatched)); |
| | 2 | 127 | | } |
| | 3 | 128 | | return matches.OrderByDescending(m => m.Score).ToList(); |
| | 3 | 129 | | } |
| | | 130 | | |
| | | 131 | | private static DateTimeOffset TruncateToBucket(DateTimeOffset value, TimeSpan bucketSize) |
| | 22 | 132 | | { |
| | 22 | 133 | | var ticks = value.UtcTicks - (value.UtcTicks % bucketSize.Ticks); |
| | 22 | 134 | | return new DateTimeOffset(ticks, TimeSpan.Zero); |
| | 22 | 135 | | } |
| | | 136 | | } |