StreamAD Detector
Contents
StreamAD Detector#
Univariate Anomaly Detector#
KNNDetector#
- class streamad.model.KNNDetector(window_len=10, init_len=150, k_neighbor=3)[source]#
Bases:
streamad.base.detector.BaseDetector
- __init__(window_len=10, init_len=150, k_neighbor=3)[source]#
Univariate KNN-CAD model with mahalanobis distance [Burnaev and Ishimtsev, 2016].
- Parameters
window_len (int, optional) – The length of window. Defaults to 10.
init_len (int, optional) – The length of references. Defaults to 150.
k_neighbor (int, optional) – The number of neighbors to cumulate distances. Defaults to 3.
- fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#
Fit one observation and calculate its anomaly score.
- Parameters
X (np.ndarray) – Data of current observation.
normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.
normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.
normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.
- Return type
float
- Returns
float – Anomaly score. A high score indicates a high degree of anomaly.
SpotDetector#
- class streamad.model.SpotDetector(prob=0.0001, window_len=10, init_len=150)[source]#
Bases:
streamad.base.detector.BaseDetector
- __init__(prob=0.0001, window_len=10, init_len=150)[source]#
Univariate Spot model [Siffer et al., 2017].
- Parameters
prob (float, optional) – Threshold for probability, a small float value. Defaults to 1e-4.
window_len (int, optional) – A window for reference. Defaults to 10.
init_len (int, optional) – Data length for initialization. Recommended > 150. Defaults to 150.
- fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#
Fit one observation and calculate its anomaly score.
- Parameters
X (np.ndarray) – Data of current observation.
normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.
normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.
normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.
- Return type
float
- Returns
float – Anomaly score. A high score indicates a high degree of anomaly.
RrcfDetector#
- class streamad.model.RrcfDetector(window_len=10, num_trees=40, tree_size=256)[source]#
Bases:
streamad.base.detector.BaseDetector
- __init__(window_len=10, num_trees=40, tree_size=256)[source]#
Rrcf detector [Guha et al., 2016].
- Parameters
window_len (int, optional) – Length of sliding window. Defaults to 10.
num_trees (int, optional) – Number of trees. Defaults to 40.
tree_size (int, optional) – Size of each tree. Defaults to 256.
- fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#
Fit one observation and calculate its anomaly score.
- Parameters
X (np.ndarray) – Data of current observation.
normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.
normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.
normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.
- Return type
float
- Returns
float – Anomaly score. A high score indicates a high degree of anomaly.
SRDetector#
- class streamad.model.SRDetector(window_len=100, extend_len=5, ahead_len=10, mag_num=5)[source]#
Bases:
streamad.base.detector.BaseDetector
- __init__(window_len=100, extend_len=5, ahead_len=10, mag_num=5)[source]#
Spectral Residual Detector [Ren et al., 2019].
- Parameters
window_len (int, optional) – Length of sliding window. Defaults to 100.
extend_len (int, optional) – Length to be extended, for FFT transforme. Defaults to 5.
ahead_len (int, optional) – Length to look ahead for references. Defaults to 10.
mag_num (int, optional) – Number of FFT magnitude. Defaults to 5.
- fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#
Fit one observation and calculate its anomaly score.
- Parameters
X (np.ndarray) – Data of current observation.
normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.
normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.
normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.
- Return type
float
- Returns
float – Anomaly score. A high score indicates a high degree of anomaly.
ZScoreDetector#
- class streamad.model.ZScoreDetector[source]#
Bases:
streamad.base.detector.BaseDetector
- fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#
Fit one observation and calculate its anomaly score.
- Parameters
X (np.ndarray) – Data of current observation.
normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.
normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.
normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.
- Return type
float
- Returns
float – Anomaly score. A high score indicates a high degree of anomaly.
Multivariate Anomaly Detector#
Note that these methods are compatible with univariate time series.
xStreamDetector#
- class streamad.model.xStreamDetector(n_components=50, n_chains=50, depth=25, window_len=25)[source]#
Bases:
streamad.base.detector.BaseDetector
- __init__(n_components=50, n_chains=50, depth=25, window_len=25)[source]#
Multivariate xStreamDetector [Manzoor et al., 2018].
- Parameters
n_components (int, optional) – Number of streamhash projection, similar to feature numbers. Defaults to 50.
n_chains (int, optional) – Number of half-space chains. Defaults to 100.
depth (int, optional) – Maximum depth for each chain. Defaults to 25.
window_len (int, optional) – Size of reference window. Defaults to 25.
- fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#
Fit one observation and calculate its anomaly score.
- Parameters
X (np.ndarray) – Data of current observation.
normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.
normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.
normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.
- Return type
float
- Returns
float – Anomaly score. A high score indicates a high degree of anomaly.
RShashDetector#
- class streamad.model.RShashDetector(init_len=150, decay=0.015, components_num=100, hash_num=10)[source]#
Bases:
streamad.base.detector.BaseDetector
- __init__(init_len=150, decay=0.015, components_num=100, hash_num=10)[source]#
Multivariate RSHashDetector [Sathe and Aggarwal, 2016].
- Parameters
init_len (int, optional) – Length of data to burn in/init. Defaults to 150.
decay (float, optional) – Decay ratio. Defaults to 0.015.
components_num (int, optional) – Number of components. Defaults to 100.
hash_num (int, optional) – Number of hash functions. Defaults to 10.
- fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#
Fit one observation and calculate its anomaly score.
- Parameters
X (np.ndarray) – Data of current observation.
normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.
normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.
normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.
- Return type
float
- Returns
float – Anomaly score. A high score indicates a high degree of anomaly.
HSTreeDetector#
- class streamad.model.HSTreeDetector(window_len=100, tree_height=10, tree_num=100)[source]#
Bases:
streamad.base.detector.BaseDetector
- __init__(window_len=100, tree_height=10, tree_num=100)[source]#
Half space tree detectors. [Tan et al., 2011].
- Parameters
window_len (int, optional) – The length of reference window. Defaults to 100.
tree_height (int, optional) – Height of a half space tree. Defaults to 10.
tree_num (int, optional) – Totla number of the trees. Defaults to 100.
- fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#
Fit one observation and calculate its anomaly score.
- Parameters
X (np.ndarray) – Data of current observation.
normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.
normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.
normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.
- Return type
float
- Returns
float – Anomaly score. A high score indicates a high degree of anomaly.
RandomDetector#
- class streamad.model.RandomDetector[source]#
Bases:
streamad.base.detector.BaseDetector
Return random anomaly score. A minimum score for benchmark.
- fit_score(X, normalized=True, normalized_sigma=3, normalized_global=True)#
Fit one observation and calculate its anomaly score.
- Parameters
X (np.ndarray) – Data of current observation.
normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.
normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.
normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.
- Return type
float
- Returns
float – Anomaly score. A high score indicates a high degree of anomaly.