If you've read this far in our five-part series, congratulations! You've been introduced to each SAS Visual Scenario Designer 6.3 M1 window type, and have seen how each one analyzes raw or detail detail.
Before you choose a particular window type, it’s helpful to understand three primary, real-world considerations that influence your choice of window selection:
Consider whether there are any time-based requirements for the aggregation. For the variables being used in the rules, you should decide whether to use all of the data, or to only use the most recent X days in your aggregate. In most cases, including a time element is very useful for keeping the analytics consistent. For example, if an aggregation window is used, the result is based on the entire table of data. This means that the result of the aggregation is dependent on the amount of data that is loaded to SAS LASR Analytic Server, rather than being defined as part of the window configuration. If you want to know the average ATM deposit amount for a customer, a better design approach might be to use a date-based aggregation window. Doing so makes the amount of data considered consistent regardless of the amount of history in SAS LASR Analytic Server.
Consider the level of output for the alert. For example, to generate an alert on an account, an aggregation window might be suitable. To generate an alert on individual transactions, a transaction window is needed.
Consider what you are trying to measure when you retrieve the results from SAS Visual Scenario Designer. If you are trying to answer what would generate an alert on a given date, then a date-based aggregation window works well. However, if you are trying to answer what would have generated alerts over the last X months, then a transaction window is probably required.
The following example shows how you would obtain different results using the same raw data, based on the type of window that you use:
You create a building profile in order to determine when the entry time of an employee in a particular building differs by more than a minute from the average entry time. If you use an aggregation window, then you generate one average entry time that you associate with all the rows in your original data table:
The average entry time of all five records in Figure 1 is 9:02:00. But if you run the records at the end of the day on January 1, then the average would actually be 9:00:30. Having one average and applying it to all of the records would lead to an inconsistency in the alerts being generated.
For example, the entry time of 9:00:00 for Employee ID 1 would not generate an alert if you ran the data on January 1, when the average entry time was 9:00:30. However, if you ran SAS Visual Scenario Designer on January 2, then you would find that the Employee ID 1 record triggers an alert because the average entry time is now 9:02. This results in an inconsistency between what you have in SAS Visual Scenario Designer and what you would obtain in a real production system with nightly batches.
Instead, if you used a transaction window, then you would generate an average for every single record in the data:
In this case, you would obtain an accurate average for every record. The run date of January 1 or January 2 has no impact on the result. Only past records influence the average, as shown by how the average entry time for each Employee ID adjusts to reflect the influence of earlier entry times for Employee IDs 1 through 3.
Understanding what you want to measure, the alert level that you want to generate, and the rule that you want to write enables you to determine which SAS Visual Scenario Window type to use.
When you have used a SAS Visual Scenario Designer window to explore, filter, and aggregate your data, you are ready to use this refined data set in a scenario that you create in SAS Visual Scenario Designer. You later deploy these scenarios to produce alerts or detect patterns of interest.
This is article #5 in a five-part series. See the links below for the previous articles:
Part 1: Overview and Transformation Window
Part 2: Aggregation Window
Part 3: Date-based Aggregation Window
Part 4: Transaction Window