@Name("FeatureAnomaly")
@Tag(name="domainName", value="IoTSecurityAttacks")
insert into FeatureAnomaly
select a2.id as id, 
   current_timestamp() as timestamp, 
   a1.destIp as destIp
from pattern [((every a1 = NetworkPacket((a1.protocol = 'MQTT' or a1.protocol = 'TCP'))) -> a2 = NetworkPrediction((a2.id = a1.id and (a2.packetLengthPredict < (a1.packetLength - a2.packetLengthPredictSquaredError) or a2.packetLengthPredict > (a1.packetLength + a2.packetLengthPredictSquaredError)))))]