Detectors

PySAD has 16 streaming detectors. This page lists the input that each detector takes, what it needs before the stream starts and the memory that it keeps. For the parameters, follow the link to the API reference. To choose a detector, see Choose a detector. To compare the results of the multivariate detectors, see the benchmark.

In the memory column, “fixed” means that the memory has an upper limit that does not depend on the length of the stream. A window is the most recent points, up to a fixed number.

Multivariate detectors

These detectors take points with one or more features. A feature is one measured value of a point.

Detector	Method	Needs before the stream	Memory
xStream	Half-space chains on streamhash projections [MLA18]	Nothing	Fixed: the chain counts of two windows, and the points of the first window until it is full
LODA	Histograms on sparse random projections [Pev16]	Nothing	Fixed: num_random_cuts histograms of num_bins bins
HalfSpaceTrees	Mass profiles of random half-space trees [TTL11]	The range of each feature	Fixed: num_trees full trees of depth max_depth, about 11 MB with the defaults
RobustRandomCutForest	Collusive displacement in random cut trees [GMRS16]	Nothing	Fixed: num_trees trees of tree_size points
RSHash	Time-decayed counts of random subspace grids [SA16]	The range of each feature	Fixed: num_hash_fns hash tables of hash_range slots
IForestASD	Isolation Forest on a sliding window [DF13]	Nothing (initial points optional)	Fixed: two windows of window_size points
KitNet	Ensemble of autoencoders [MDES18]	Nothing	Fixed. Learns only during its grace periods (1,100 points by default)
ExactStorm	Neighbor counts in a sliding window [AF07]	Nothing	Fixed: a window of window_size points
LocalOutlierProbability	Local outlier probability [KKSZ09], as in PyNomaly [Con18]	Initial points (initial_X)	Fixed: the initial points. Does not learn from the stream
Inqmad	Quantum measurement density estimation [GMBBG22]	The number of features, the number of random Fourier features (dim_x) and the kernel bandwidth (gamma)	Fixed: a dim_x by dim_x matrix

Univariate detectors

These detectors take points with exactly one feature. Give each value as an array of shape (1,).

Detector	Method	Needs before the stream	Memory
SeasonalHybridESD	STL (seasonal-trend decomposition) residuals and a robust generalized ESD (extreme Studentized deviate) test [HVK17]	The period and the window size	Fixed: a window of window_size values
SeasonalESD	STL residuals and a generalized ESD test [HVK17]	The period and the window size	Fixed: a window of window_size values
MedianAbsoluteDeviation	Distance from the median of the last window_size values, in scaled median absolute deviations of those values (1.4826 × MAD) [HVK17]	Nothing	Fixed: a window of window_size values
StandardAbsoluteDeviation	Distance from the running mean in standard deviations [HVK17]	Nothing	Fixed with the default mean. Grows with subtracted_statistic="median"
KNNCAD	Conformalized k-nearest neighbors [BI16]	A probationary period: at least 48 values that it learns from before it scores	Fixed: the last 19 values and about 2 × probationary_period training and calibration windows of 19 values
RelativeEntropy	Relative entropy of windowed histograms [WVC+11]	The range of the values	Grows slowly: a window and one histogram for each distinct state of the stream

PyOD integrations

These wrappers run a batch detector from PyOD on a stream. A batch detector trains on a complete dataset. For instructions, see Run a PyOD model on a stream.

Wrapper	Behavior
ReferenceWindowModel	Trains the detector on a window of recent points and trains it again every sliding_size points [MLA18].
OneFitModel	Trains the detector once on initial points and then only scores.

Baselines for testing

These models do not detect anomalies. Use them to test a pipeline or as a reference in an evaluation.

Model	Score
NullModel	Always 0.5.
RandomModel	A random value between 0 and 1.
PerfectModel	The label of the point (the known answer: anomaly or normal). It gives the best possible result for a metric.