StreamAD Detector#

Univariate Anomaly Detector#

If you want to detect multivarite time series with these models, you need to apply them on each feature separately.

KNNDetector#

class streamad.model.KNNDetector(k_neighbor=5, **kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(k_neighbor=5, **kwargs)[source]#

Univariate KNN-CAD model with mahalanobis distance [Burnaev and Ishimtsev, 2016].

Parameters

k_neighbor (int, optional) – The number of neighbors to cumulate distances. Defaults to 5.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

SpotDetector#

class streamad.model.SpotDetector(prob=0.0001, back_mean_len=20, num_threshold_up=20, num_threshold_down=20, deviance_ratio=0.01, global_memory=True, **kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(prob=0.0001, back_mean_len=20, num_threshold_up=20, num_threshold_down=20, deviance_ratio=0.01, global_memory=True, **kwargs)[source]#

Univariate Spot model [Siffer et al., 2017].

Parameters

  • prob (float, optional) – Threshold for the probability of anomalies, a small float value. Defaults to 1e-4.. Defaults to 1e-4.

  • back_mean_len (int, optional) – The length of backward window to calculate the first-order difference. Defaults to 20.

  • num_threshold_up (int, optional) – Number of peaks over upper threshold to estimate distribution. Defaults to 20.

  • num_threshold_down (int, optional) – Number of peaks over lower threshold to estimate distribution. Defaults to 20.

  • deviance_ratio (float, optional) – Deviance ratio aginest the absolute value of data, which is useful when the value is very large and deviances are small. Defaults to 0.01.

  • window_len (int, optional) – Length of the window for reference. Defaults to 200.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

RrcfDetector#

class streamad.model.RrcfDetector(num_trees=10, tree_size=12, **kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(num_trees=10, tree_size=12, **kwargs)[source]#

Rrcf detector [Guha et al., 2016].

Parameters

  • window_len (int, optional) – Length of sliding window. Defaults to 50.

  • num_trees (int, optional) – Number of trees. Defaults to 10.

  • tree_size (int, optional) – Size of each tree. Defaults to 12.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

SRDetector#

class streamad.model.SRDetector(extend_len=5, ahead_len=10, mag_num=5, **kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(extend_len=5, ahead_len=10, mag_num=5, **kwargs)[source]#

Spectral Residual Detector [Ren et al., 2019].

Parameters

  • window_len (int, optional) – Length of sliding window. Defaults to 50.

  • extend_len (int, optional) – Length to be extended, for FFT transforme. Defaults to 5.

  • ahead_len (int, optional) – Length to look ahead for references. Defaults to 10.

  • mag_num (int, optional) – Number of FFT magnitude. Defaults to 5.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

ZScoreDetector#

class streamad.model.ZScoreDetector(is_global=False, **kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(is_global=False, **kwargs)[source]#

Univariate Z-Score Detecto [Wikipedia contributors, 2022]

Parameters

  • window_len (int, optional) – Length of the window for reference. Defaults to 50.

  • is_global (bool, optional) – Whether to detect anomalies from a global view. Defaults to False.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

Multivariate Anomaly Detector#

These models are compatible with univariate time series.

xStreamDetector#

class streamad.model.xStreamDetector(n_components=8, n_chains=8, depth=8, **kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(n_components=8, n_chains=8, depth=8, **kwargs)[source]#

Multivariate xStreamDetector [Manzoor et al., 2018].

Parameters

  • n_components (int, optional) – Number of streamhash projection, similar to feature numbers. Defaults to 50.

  • n_chains (int, optional) – Number of half-space chains. Defaults to 8.

  • depth (int, optional) – Maximum depth for each chain. Defaults to 8.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

RShashDetector#

class streamad.model.RShashDetector(decay=0.015, components_num=10, hash_num=10, **kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(decay=0.015, components_num=10, hash_num=10, **kwargs)[source]#

Multivariate RSHashDetector [Sathe and Aggarwal, 2016].

Parameters

  • window_len (int, optional) – Length of data to burn in/init. Defaults to 50.

  • decay (float, optional) – Decay ratio. Defaults to 0.015.

  • components_num (int, optional) – Number of components. Defaults to 10.

  • hash_num (int, optional) – Number of hash functions. Defaults to 10.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

HSTreeDetector#

class streamad.model.HSTreeDetector(tree_height=10, tree_num=20, **kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(tree_height=10, tree_num=20, **kwargs)[source]#

Half space tree detectors. [Tan et al., 2011].

Parameters

  • tree_height (int, optional) – Height of a half space tree. Defaults to 10.

  • tree_num (int, optional) – Totla number of the trees. Defaults to 20.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

LodaDetector#

class streamad.model.LodaDetector(random_cuts_num=10, **kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(random_cuts_num=10, **kwargs)[source]#

Multivariate LODA Detector [Pevný, 2016].

Parameters

  • window_len (int, optional) – The length of window. Defaults to 50.

  • random_cuts_num (int, optional) – The number of random experiments. Defaults to 10.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

RandomDetector#

class streamad.model.RandomDetector(**kwargs)[source]#

Bases: streamad.base.detector.BaseDetector

Return random anomaly score. A minimum score for benchmark.

fit_score(X, timestamp=None)#

Fit one observation and calculate its anomaly score.

Parameters

X (np.ndarray) – Data of current observation.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.