Anomaly Detection

Aeon provides anomaly detection methods for identifying unusual patterns in time series at both series and collection levels.

Collection Anomaly Detectors

Detect anomalous time series within a collection:

• ClassificationAdapter - Adapts classifiers for anomaly detection
• Train on normal data, flag outliers during prediction

• Use when: Have labeled normal data, want classification-based approach

• OutlierDetectionAdapter - Wraps sklearn outlier detectors

• Works with IsolationForest, LOF, OneClassSVM
• Use when: Want to use sklearn anomaly detectors on collections

Series Anomaly Detectors

Detect anomalous points or subsequences within a single time series.

Distance-Based Methods

Use similarity metrics to identify anomalies:

• CBLOF - Cluster-Based Local Outlier Factor
• Clusters data, identifies outliers based on cluster properties

• Use when: Anomalies form sparse clusters

• KMeansAD - K-means based anomaly detection

• Distance to nearest cluster center indicates anomaly

• Use when: Normal patterns cluster well

• LeftSTAMPi - Left STAMP incremental

• Matrix profile for online anomaly detection

• Use when: Streaming data, need online detection

• STOMP - Scalable Time series Ordered-search Matrix Profile

• Computes matrix profile for subsequence anomalies

• Use when: Discord discovery, motif detection

• MERLIN - Matrix profile-based method

• Efficient matrix profile computation

• Use when: Large time series, need scalability

• LOF - Local Outlier Factor adapted for time series

• Density-based outlier detection

• Use when: Anomalies in low-density regions

• ROCKAD - ROCKET-based semi-supervised detection

• Uses ROCKET features for anomaly identification
• Use when: Have some labeled data, want feature-based approach

Distribution-Based Methods

Analyze statistical distributions:

• COPOD - Copula-Based Outlier Detection
• Models marginal and joint distributions

• Use when: Multi-dimensional time series, complex dependencies

• DWT_MLEAD - Discrete Wavelet Transform Multi-Level Anomaly Detection

• Decomposes series into frequency bands
• Use when: Anomalies at specific frequencies

Isolation-Based Methods

Use isolation principles:

• IsolationForest - Random forest-based isolation
• Anomalies easier to isolate than normal points

• Use when: High-dimensional data, no assumptions about distribution

• OneClassSVM - Support vector machine for novelty detection

• Learns boundary around normal data

• Use when: Well-defined normal region, need robust boundary

• STRAY - Streaming Robust Anomaly Detection

• Robust to data distribution changes
• Use when: Streaming data, distribution shifts

External Library Integration

• PyODAdapter - Bridges PyOD library to aeon
• Access 40+ PyOD anomaly detectors
• Use when: Need specific PyOD algorithm

Quick Start

from aeon.anomaly_detection import STOMP
import numpy as np

# Create time series with anomaly
y = np.concatenate([
    np.sin(np.linspace(0, 10, 100)),
    [5.0],  # Anomaly spike
    np.sin(np.linspace(10, 20, 100))
])

# Detect anomalies
detector = STOMP(window_size=10)
anomaly_scores = detector.fit_predict(y)

# Higher scores indicate more anomalous points
threshold = np.percentile(anomaly_scores, 95)
anomalies = anomaly_scores > threshold

Point vs Subsequence Anomalies

• Point anomalies: Single unusual values

• Use: COPOD, DWT_MLEAD, IsolationForest

• Subsequence anomalies (discords): Unusual patterns

• Use: STOMP, LeftSTAMPi, MERLIN

• Collective anomalies: Groups of points forming unusual pattern

• Use: Matrix profile methods, clustering-based

Evaluation Metrics

Specialized metrics for anomaly detection:

from aeon.benchmarking.metrics.anomaly_detection import (
    range_precision,
    range_recall,
    range_f_score,
    roc_auc_score
)

# Range-based metrics account for window detection
precision = range_precision(y_true, y_pred, alpha=0.5)
recall = range_recall(y_true, y_pred, alpha=0.5)
f1 = range_f_score(y_true, y_pred, alpha=0.5)

Algorithm Selection

• Speed priority: KMeansAD, IsolationForest
• Accuracy priority: STOMP, COPOD
• Streaming data: LeftSTAMPi, STRAY
• Discord discovery: STOMP, MERLIN
• Multi-dimensional: COPOD, PyODAdapter
• Semi-supervised: ROCKAD, OneClassSVM
• No training data: IsolationForest, STOMP

Best Practices

1. Normalize data: Many methods sensitive to scale
2. Choose window size: For matrix profile methods, window size critical
3. Set threshold: Use percentile-based or domain-specific thresholds
4. Validate results: Visualize detections to verify meaningfulness
5. Handle seasonality: Detrend/deseasonalize before detection