StreamAD Detector#

Univariate Anomaly Detector#

If you want to detect multivarite time series with these models, you need to apply them on each feature separately.

KNNDetector#

class streamad.model.KNNDetector(window_len=100, k_neighbor=5)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, k_neighbor=5)[source]#

Univariate KNN-CAD model with mahalanobis distance [Burnaev and Ishimtsev, 2016].

Parameters

  • window_len (int, optional) – The length of window. Defaults to 100.

  • k_neighbor (int, optional) – The number of neighbors to cumulate distances. Defaults to 5.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

SpotDetector#

class streamad.model.SpotDetector(window_len=200, prob=0.0001)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=200, prob=0.0001)[source]#

Univariate Spot model [Siffer et al., 2017].

Parameters

  • window_len (int, optional) – Length of the window for reference. Defaults to 200.

  • prob (float, optional) – Threshold for probability, a small float value. Defaults to 1e-4.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

RrcfDetector#

class streamad.model.RrcfDetector(window_len=100, num_trees=40, tree_size=256)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, num_trees=40, tree_size=256)[source]#

Rrcf detector [Guha et al., 2016].

Parameters

  • window_len (int, optional) – Length of sliding window. Defaults to 100.

  • num_trees (int, optional) – Number of trees. Defaults to 40.

  • tree_size (int, optional) – Size of each tree. Defaults to 256.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

SRDetector#

class streamad.model.SRDetector(window_len=100, extend_len=5, ahead_len=10, mag_num=5)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, extend_len=5, ahead_len=10, mag_num=5)[source]#

Spectral Residual Detector [Ren et al., 2019].

Parameters

  • window_len (int, optional) – Length of sliding window. Defaults to 100.

  • extend_len (int, optional) – Length to be extended, for FFT transforme. Defaults to 5.

  • ahead_len (int, optional) – Length to look ahead for references. Defaults to 10.

  • mag_num (int, optional) – Number of FFT magnitude. Defaults to 5.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

ZScoreDetector#

class streamad.model.ZScoreDetector(window_len=100, is_global=False)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, is_global=False)[source]#

Univariate Z-Score Detecto [Wikipedia contributors, 2022]

Parameters

  • window_len (int, optional) – Length of the window for reference. Defaults to 100.

  • is_global (bool, optional) – Whether to detect anomalies from a global view. Defaults to False.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

Multivariate Anomaly Detector#

These models are compatible with univariate time series.

xStreamDetector#

class streamad.model.xStreamDetector(window_len=100, n_components=50, n_chains=50, depth=25)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, n_components=50, n_chains=50, depth=25)[source]#

Multivariate xStreamDetector [Manzoor et al., 2018].

Parameters

  • window_len (int, optional) – Size of reference window. Defaults to 100.

  • n_components (int, optional) – Number of streamhash projection, similar to feature numbers. Defaults to 50.

  • n_chains (int, optional) – Number of half-space chains. Defaults to 100.

  • depth (int, optional) – Maximum depth for each chain. Defaults to 25.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

RShashDetector#

class streamad.model.RShashDetector(window_len=100, decay=0.015, components_num=100, hash_num=10)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, decay=0.015, components_num=100, hash_num=10)[source]#

Multivariate RSHashDetector [Sathe and Aggarwal, 2016].

Parameters

  • window_len (int, optional) – Length of data to burn in/init. Defaults to 150.

  • decay (float, optional) – Decay ratio. Defaults to 0.015.

  • components_num (int, optional) – Number of components. Defaults to 100.

  • hash_num (int, optional) – Number of hash functions. Defaults to 10.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

HSTreeDetector#

class streamad.model.HSTreeDetector(window_len=100, tree_height=10, tree_num=100)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, tree_height=10, tree_num=100)[source]#

Half space tree detectors. [Tan et al., 2011].

Parameters

  • window_len (int, optional) – The length of reference window. Defaults to 100.

  • tree_height (int, optional) – Height of a half space tree. Defaults to 10.

  • tree_num (int, optional) – Totla number of the trees. Defaults to 100.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

LodaDetector#

class streamad.model.LodaDetector(window_len=100, random_cuts_num=100)[source]#

Bases: streamad.base.detector.BaseDetector

__init__(window_len=100, random_cuts_num=100)[source]#

Multivariate LODA Detector [Pevný, 2016].

Parameters

  • window_len (int, optional) – The length of window. Defaults to 100.

  • random_cuts_num (int, optional) – The number of random experiments. Defaults to 100.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.

RandomDetector#

class streamad.model.RandomDetector[source]#

Bases: streamad.base.detector.BaseDetector

Return random anomaly score. A minimum score for benchmark.

fit_score(X)#

Fit one observation and calculate its anomaly score.

Parameters

  • X (np.ndarray) – Data of current observation.

  • normalized (bool, optional) – Whether to normalize the score into a range of [0, 1]. Defaults to True.

  • normalized_sigma (int, optional) – We use k-sigma/z-score to report the anomalies, A large sigma inicates few anomalies. Defaults to 3.

  • normalized_global (bool, optional) – True for normalizing the score globally, with all history. Flase for normalizing the score within the window, with forgeting long histories. Defaults to True.

Return type

float

Returns

float – Anomaly score. A high score indicates a high degree of anomaly.