You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/stream-analytics/stream-analytics-real-time-fraud-detection.md
+59-51Lines changed: 59 additions & 51 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.author: mamccrea
6
6
ms.reviewer: mamccrea
7
7
ms.service: stream-analytics
8
8
ms.topic: conceptual
9
-
ms.date: 12/07/2018
9
+
ms.date: 03/24/2020
10
10
ms.custom: seodec18
11
11
---
12
12
# Get started using Azure Stream Analytics: Real-time fraud detection
@@ -63,7 +63,7 @@ In this procedure, you first create an event hub namespace, and then you add an
63
63
64
64
5. Select a subscription and create or choose a resource group, then click **Create**.
65
65
66
-
<imgsrc="./media/stream-analytics-real-time-fraud-detection/stream-analytics-create-eventhub-namespace-new-portal.png"alt="Create event hub namespace in Azure portal"width="300px"/>
66
+
<br/><imgsrc="./media/stream-analytics-real-time-fraud-detection/stream-analytics-create-eventhub-namespace-new-portal.png"alt="Create event hub namespace in Azure portal"width="300px"/>
67
67
68
68
6. When the namespace has finished deploying, find the event hub namespace in your list of Azure resources.
69
69
@@ -73,41 +73,42 @@ In this procedure, you first create an event hub namespace, and then you add an
73
73
74
74
8. Name the new event hub `asa-eh-frauddetection-demo`. You can use a different name. If you do, make a note of it, because you need the name later. You don't need to set any other options for the event hub right now.
75
75
76
-
<imgsrc="./media/stream-analytics-real-time-fraud-detection/stream-analytics-create-eventhub-new-portal.png"alt="Name event hub in Azure portal"width="400px"/>
76
+
<br/><imgsrc="./media/stream-analytics-real-time-fraud-detection/stream-analytics-create-eventhub-new-portal.png"alt="Name event hub in Azure portal"width="400px"/>
77
77
78
78
9. Click **Create**.
79
79
80
80
### Grant access to the event hub and get a connection string
81
81
82
82
Before a process can send data to an event hub, the event hub must have a policy that allows appropriate access. The access policy produces a connection string that includes authorization information.
83
83
84
-
1.In the event namespace pane, click **Event Hubs** and then click the name of your new event hub.
84
+
1.In the event namespace pane, click **Event Hubs** and then click the name of your new event hub.
85
85
86
-
2.In the event hub pane, click **Shared access policies** and then click **+ Add**.
86
+
2.In the event hub pane, click **Shared access policies** and then click **+ Add**.
87
87
88
-
>[!NOTE]
89
-
>Make sure you're working with the event hub, not the event hub namespace.
88
+
>[!NOTE]
89
+
>Make sure you're working with the event hub, not the event hub namespace.
90
90
91
-
3.Add a policy named `asa-policy-manage-demo` and for **Claim**, select **Manage**.
91
+
3.Add a policy named `asa-policy-manage-demo` and for **Claim**, select **Manage**.
92
92
93
-
<img src="./media/stream-analytics-real-time-fraud-detection/stream-analytics-create-shared-access-policy-manage-new-portal.png" alt="Create shared access policy for Stream Analytics" width="300px"/>
93
+
<br/><imgsrc="./media/stream-analytics-real-time-fraud-detection/stream-analytics-create-shared-access-policy-manage-new-portal.png"alt="Create shared access policy for Stream Analytics"width="300px"/>
94
94
95
-
4.Click **Create**.
95
+
4.Click **Create**.
96
96
97
-
5.After the policy has been deployed, click it in the list of shared access policies.
97
+
5.After the policy has been deployed, click it in the list of shared access policies.
98
98
99
-
6.Find the box labeled **CONNECTION STRING-PRIMARY KEY** and click the copy button next to the connection string.
99
+
6.Find the box labeled **CONNECTION STRING-PRIMARY KEY** and click the copy button next to the connection string.
Notice that the connection string contains multiple key-value pairs, separated with semicolons: `Endpoint`, `SharedAccessKeyName`, `SharedAccessKey`, and `EntityPath`.
110
110
111
+
111
112
## Configure and start the event generator application
112
113
113
114
Before you start the TelcoGenerator app, you must configure it so that it will send call records to the event hub you created.
@@ -123,20 +124,27 @@ Before you start the TelcoGenerator app, you must configure it so that it will s
123
124
* Set the value of the `EventHubName` key to the event hub name (that is, to the value of the entity path).
124
125
* Set the value of the `Microsoft.ServiceBus.ConnectionString` key to the connection string.
125
126
126
-
The `<appSettings>` section will look like the following example. (For clarity, the lines are wrapped and some characters have been removed from the authorization token.)
127
+
The `<appSettings>` section will look like the following example:
127
128
128
-

129
+
```xml
130
+
<appSettings>
131
+
<!-- Service Bus specific app setings for messaging connections -->
1. Open a command window and change to the folder where the TelcoGenerator app is unzipped.
134
140
135
-
2. Enter the following command:
141
+
1. Open a command window and change to the folder where the TelcoGenerator app is unzipped.
136
142
137
-
```cmd
138
-
telcodatagen.exe 1000 0.2 2
139
-
```
143
+
2. Enter the following command:
144
+
145
+
```console
146
+
telcodatagen.exe 1000 0.2 2
147
+
```
140
148
141
149
The parameters are:
142
150
@@ -170,7 +178,7 @@ Now that you have a stream of call events, you can set up a Stream Analytics job
170
178
171
179
It's a good idea to place the job and the event hub in the same region for best performance and so that you don't pay to transfer data between regions.
172
180
173
-
<imgsrc="./media/stream-analytics-real-time-fraud-detection/stream-analytics-create-sa-job-new-portal.png"alt="Create Stream Analytics job in portal"width="300px"/>
181
+
<br/><imgsrc="./media/stream-analytics-real-time-fraud-detection/stream-analytics-create-sa-job-new-portal.png"alt="Create Stream Analytics job in portal"width="300px"/>
174
182
175
183
3. Click **Create**.
176
184
@@ -187,7 +195,7 @@ Now that you have a stream of call events, you can set up a Stream Analytics job
@@ -281,13 +289,13 @@ For this transformation, you want a sequence of temporal windows that don't over
281
289
282
290
1. Change the query in the code editor to the following:
283
291
284
-
```SQL
285
-
SELECT
286
-
System.Timestamp as WindowEnd, SwitchNum, COUNT(*) as CallCount
287
-
FROM
288
-
CallStream TIMESTAMP BY CallRecTime
289
-
GROUP BY TUMBLINGWINDOW(s, 5), SwitchNum
290
-
```
292
+
```SQL
293
+
SELECT
294
+
System.Timestamp as WindowEnd, SwitchNum, COUNT(*) as CallCount
295
+
FROM
296
+
CallStream TIMESTAMP BY CallRecTime
297
+
GROUP BY TUMBLINGWINDOW(s, 5), SwitchNum
298
+
```
291
299
292
300
This query uses the `Timestamp By` keyword in the `FROM` clause to specify which timestamp field in the input stream to use to define the Tumbling window. In this case, the window divides the data into segments by the `CallRecTime` field in each record. (If no field is specified, the windowing operation uses the time that each event arrives at the event hub. See "Arrival Time Vs Application Time" in [Stream Analytics Query Language Reference](https://docs.microsoft.com/stream-analytics-query/stream-analytics-query-language-reference).
293
301
@@ -309,19 +317,19 @@ When you use a join with streaming data, the join must provide some limits on ho
309
317
310
318
1. Change the query in the code editor to the following:
311
319
312
-
```SQL
313
-
SELECT System.Timestamp as Time,
314
-
CS1.CallingIMSI,
315
-
CS1.CallingNum as CallingNum1,
316
-
CS2.CallingNum as CallingNum2,
317
-
CS1.SwitchNum as Switch1,
318
-
CS2.SwitchNum as Switch2
319
-
FROM CallStream CS1 TIMESTAMP BY CallRecTime
320
-
JOIN CallStream CS2 TIMESTAMP BY CallRecTime
321
-
ON CS1.CallingIMSI = CS2.CallingIMSI
322
-
AND DATEDIFF(ss, CS1, CS2) BETWEEN 1 AND 5
323
-
WHERE CS1.SwitchNum != CS2.SwitchNum
324
-
```
320
+
```SQL
321
+
SELECT System.Timestamp as Time,
322
+
CS1.CallingIMSI,
323
+
CS1.CallingNum as CallingNum1,
324
+
CS2.CallingNum as CallingNum2,
325
+
CS1.SwitchNum as Switch1,
326
+
CS2.SwitchNum as Switch2
327
+
FROM CallStream CS1 TIMESTAMP BY CallRecTime
328
+
JOIN CallStream CS2 TIMESTAMP BY CallRecTime
329
+
ON CS1.CallingIMSI = CS2.CallingIMSI
330
+
AND DATEDIFF(ss, CS1, CS2) BETWEEN 1 AND 5
331
+
WHERE CS1.SwitchNum != CS2.SwitchNum
332
+
```
325
333
326
334
This query is like any SQL join except for the `DATEDIFF` function in the join. This version of `DATEDIFF` is specific to Streaming Analytics, and it must appear in the `ON...BETWEEN` clause. The parameters are a time unit (seconds in this example) and the aliases of the two sources for the join. This is different from the standard SQL `DATEDIFF` function.
327
335
@@ -333,7 +341,7 @@ When you use a join with streaming data, the join must provide some limits on ho
333
341
334
342
3. Click **Save** to save the self-join query as part of the Streaming Analytics job. (It doesn't save the sample data.)
335
343
336
-
<imgsrc="./media/stream-analytics-real-time-fraud-detection/stream-analytics-query-editor-save-button-new-portal.png"alt="Save Stream Analytics query in portal"width="300px"/>
344
+
<br/><img src="./media/stream-analytics-real-time-fraud-detection/stream-analytics-query-editor-save-button-new-portal.png" alt="Save Stream Analytics query in portal" width="300px"/>
337
345
338
346
## Create an output sink to store transformed data
339
347
@@ -357,7 +365,7 @@ If you have an existing blob storage account, you can use that. For this tutoria
|Output alias | CallStream-FraudulentCalls | Enter a name to identify the job’s output. |
368
+
|Output alias | CallStream-FraudulentCalls | Enter a name to identify the job's output. |
361
369
|Subscription | \<Your subscription\> | Select the Azure subscription that has the storage account you created. The storage account can be in the same or in a different subscription. This example assumes that you have created storage account in the same subscription. |
362
370
|Storage account | asaehstorage | Enter the name of the storage account you created. |
363
371
|Container | asa-fraudulentcalls-demo | Choose Create new and enter a container name. |
0 commit comments