StreamAD Detector#

Univariate Anomaly Detector#

KNNDetector#

class streamad.model.KNNDetector(window_len=10, init_len=150, k_neighbor=3)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=10, init_len=150, k_neighbor=3)[source]#

Univariate KNN-CAD model with mahalanobis distance [Burnaev and Ishimtsev, 2016].

Parameters
  • window_len (int, optional) – The length of window. Defaults to 10.

  • init_len (int, optional) – The length of references. Defaults to 150.

  • k_neighbor (int, optional) – The number of neighbors to cumulate distances. Defaults to 3.

fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#

Fit one observation and calculate its anomaly score.

Parameters
  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.


SpotDetector#

class streamad.model.SpotDetector(prob=0.0001, window_len=10, init_len=150)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(prob=0.0001, window_len=10, init_len=150)[source]#

Univariate Spot model [Siffer et al., 2017].

Parameters
  • prob (float, optional) – Threshold for probability, a small float value. Defaults to 1e-4.

  • window_len (int, optional) – A window for reference. Defaults to 10.

  • init_len (int, optional) – Data length for initialization. Recommended > 150. Defaults to 150.

fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#

Fit one observation and calculate its anomaly score.

Parameters
  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.


RrcfDetector#

class streamad.model.RrcfDetector(window_len=10, num_trees=40, tree_size=256)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=10, num_trees=40, tree_size=256)[source]#

Rrcf detector [Guha et al., 2016].

Parameters
  • window_len (int, optional) – Length of sliding window. Defaults to 10.

  • num_trees (int, optional) – Number of trees. Defaults to 40.

  • tree_size (int, optional) – Size of each tree. Defaults to 256.

fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#

Fit one observation and calculate its anomaly score.

Parameters
  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.


SRDetector#

class streamad.model.SRDetector(window_len=100, extend_len=5, ahead_len=10, mag_num=5)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, extend_len=5, ahead_len=10, mag_num=5)[source]#

Spectral Residual Detector [Ren et al., 2019].

Parameters
  • window_len (int, optional) – Length of sliding window. Defaults to 100.

  • extend_len (int, optional) – Length to be extended, for FFT transforme. Defaults to 5.

  • ahead_len (int, optional) – Length to look ahead for references. Defaults to 10.

  • mag_num (int, optional) – Number of FFT magnitude. Defaults to 5.

fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#

Fit one observation and calculate its anomaly score.

Parameters
  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.


ZScoreDetector#

class streamad.model.ZScoreDetector[source]#

Bases: streamad.base.detector.BaseDetector

fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#

Fit one observation and calculate its anomaly score.

Parameters
  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.


Multivariate Anomaly Detector#

Note that these methods are compatible with univariate time series.

xStreamDetector#

class streamad.model.xStreamDetector(n_components=50, n_chains=50, depth=25, window_len=25)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(n_components=50, n_chains=50, depth=25, window_len=25)[source]#

Multivariate xStreamDetector [Manzoor et al., 2018].

Parameters
  • n_components (int, optional) – Number of streamhash projection, similar to feature numbers. Defaults to 50.

  • n_chains (int, optional) – Number of half-space chains. Defaults to 100.

  • depth (int, optional) – Maximum depth for each chain. Defaults to 25.

  • window_len (int, optional) – Size of reference window. Defaults to 25.

fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#

Fit one observation and calculate its anomaly score.

Parameters
  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.


RShashDetector#

class streamad.model.RShashDetector(init_len=150, decay=0.015, components_num=100, hash_num=10)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(init_len=150, decay=0.015, components_num=100, hash_num=10)[source]#

Multivariate RSHashDetector [Sathe and Aggarwal, 2016].

Parameters
  • init_len (int, optional) – Length of data to burn in/init. Defaults to 150.

  • decay (float, optional) – Decay ratio. Defaults to 0.015.

  • components_num (int, optional) – Number of components. Defaults to 100.

  • hash_num (int, optional) – Number of hash functions. Defaults to 10.

fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#

Fit one observation and calculate its anomaly score.

Parameters
  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.


HSTreeDetector#

class streamad.model.HSTreeDetector(window_len=100, tree_height=10, tree_num=100)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, tree_height=10, tree_num=100)[source]#

Half space tree detectors. [Tan et al., 2011].

Parameters
  • window_len (int, optional) – The length of reference window. Defaults to 100.

  • tree_height (int, optional) – Height of a half space tree. Defaults to 10.

  • tree_num (int, optional) – Totla number of the trees. Defaults to 100.

fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#

Fit one observation and calculate its anomaly score.

Parameters
  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.


RandomDetector#

class streamad.model.RandomDetector[source]#

Bases: streamad.base.detector.BaseDetector

Return random anomaly score. A minimum score for benchmark.

fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#

Fit one observation and calculate its anomaly score.

Parameters
  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.