Detectors

This page lists the input that each detector takes, what it needs before the stream starts and the memory that it keeps. For the parameters, follow the link to the API reference. To choose a detector, see Choose a detector. To compare the results of the multivariate detectors, see the benchmark.

In the memory column, “fixed” means that the memory has an upper limit that does not depend on the length of the stream. A window is the most recent points, up to a fixed number.

Multivariate detectors

These detectors take points with one or more features. A feature is one measured value of a point.

Detector	Method	Needs before the stream	Memory
xStream	Half-space chains on streamhash projections [MLA18]	Nothing	Fixed: the chain counts of two windows, and the points of the first window until it is full
LODA	Histograms on sparse random projections [Pev16]	Nothing	Fixed: num_random_cuts histograms of num_bins bins
HalfSpaceTrees	Mass profiles of random half-space trees [TTL11]	The range of each feature	Fixed: num_trees full trees of depth max_depth, about 11 MB with the defaults
RobustRandomCutForest	Collusive displacement in random cut trees [GMRS16]	Nothing	Fixed: num_trees trees of tree_size points
RSForest	Density of random space trees, scored against the previous window [WZF+14]	Nothing	Fixed: num_trees full trees of depth max_depth, about 32 MB with the defaults
RSHash	Time-decayed counts of random subspace grids [SA16]	The range of each feature	Fixed: num_hash_fns hash tables of hash_range slots
MStream	Decayed count-min sketch counts of each feature and of the whole point, in the current time tick against the earlier ticks [BJL+21]	Nothing	Fixed: two counts for each of num_buckets buckets of every feature and of num_hash_fns sketch rows
MIDAS	Count-min sketch counts of each edge [source, destination] of a graph stream, in the current time tick against the earlier ticks [BHY+20]	Nothing	Fixed: two sketches of num_hash_fns rows of num_buckets counts
IForestASD	Isolation Forest on a sliding window [DF13]	Nothing (initial points optional)	Fixed: two windows of window_size points
OnlineIsolationForest	Online Isolation Forest [LCP+24]	Nothing	Fixed: num_trees trees and a sliding window of window_size points
SmartSifter	Gaussian mixture learned by sequentially discounting EM [YTWM00]	Nothing	Fixed: num_components Gaussians, quadratic in the number of features
KitNet	Ensemble of autoencoders [MDES18]	Nothing	Fixed. Learns only during its grace periods (1,100 points by default)
ExactStorm	Neighbor counts in a sliding window [AF07]	Nothing	Fixed: a window of window_size points
ApproxStorm	The neighbor counts of ExactStorm, estimated from a sample of safe inliers [AF07]	Nothing	Fixed: a window of window_size points
MCOD	The neighbor counts of ExactStorm, faster with micro-clusters [KGP+11]	Nothing	Fixed: a window of window_size points and the centers of its micro-clusters
NETS	The neighbor counts of ExactStorm, faster with a grid of cell counts [YLL19]	Nothing	Fixed: a window of window_size points and the counts of its non-empty cells
CPOD	The neighbor counts of ExactStorm, faster with core points that index the window by distance rings [TMS20]	Nothing	Fixed: a window of window_size points, its core points and the window points within 2R of each core point
D3	Negative number of window points within a radius, estimated from a kernel density over a chain sample of the window [SPP+06]	Nothing	Fixed: a window of window_size points and a sample of sample_fraction times window_size points
ThreshLEAP	The number of neighbors below k that a probe finds when it tests the window newest first and stops at k neighbors [CYW+14]	Nothing	Fixed: a window of window_size points
IncrementalLOF	Local outlier factor in a sliding window [PLL07]	Nothing	Fixed: a window of window_size points and their num_neighbors nearest neighbors
OnlineOneClassSVM	Online one-class support vector machine (NORMA) with a Gaussian kernel [KSW04]	Nothing	Fixed: the support vectors among the last window_size points
DILOF	The local outlier factor of IncrementalLOF in a window that keeps a density-preserving summary of old points [NKY18]	Nothing	Fixed: a window of at most window_size points and their num_neighbors nearest neighbors
KELOS	How much lower the kernel density at a point is than the densities at its nearest micro-cluster centers in the window (KLOME) [QCRM19]	Nothing	Fixed: a window of window_size points and the sums of its micro-clusters
AnyOut	Distance to the mean, or Gaussian density, of the closest cluster at the level of a ClusTree that the time budget depth reaches [AKBS12]	Nothing	Fixed: a tree of at most max_height levels, with at most 3 to the power max_height leaf clusters
ADeMS	Residual of each point after its projection on a Frequent Directions sketch of the normal points [HK15]	Nothing (initial points to use a threshold)	Fixed: a sketch of sketch_size columns, linear in the number of features
LocalOutlierProbability	Local outlier probability [KKSZ09], as in PyNomaly [Con18]	Initial points (initial_X)	Fixed: the initial points. Does not learn from the stream
Inqmad	Quantum measurement density estimation [GMBBG22]	The number of features, the number of random Fourier features (dim_x) and the kernel bandwidth (gamma)	Fixed: a dim_x by dim_x matrix
TEDA	Eccentricity from the recursive mean and variance [Ang14]	Nothing	Fixed: the count, the mean and the variance
EXPoSE	Expected similarity: the inner product of each point’s random Fourier features with their running or decaying mean [SER16]	Nothing	Fixed: num_random_features frequencies per feature and the mean of the features

Univariate detectors

These detectors take points with exactly one feature. Give each value as an array of shape (1,). HTM also takes the time of each value: give each point as the array [timestamp, value].

Detector	Method	Needs before the stream	Memory
SeasonalHybridESD	STL (seasonal-trend decomposition) residuals and a robust generalized ESD (extreme Studentized deviate) test [HVK17]	The period and the window size	Fixed: a window of window_size values
SeasonalESD	STL residuals and a generalized ESD test [HVK17]	The period and the window size	Fixed: a window of window_size values
MedianAbsoluteDeviation	Distance from the median of the last window_size values, in scaled median absolute deviations of those values (1.4826 × MAD) [HVK17]	Nothing	Fixed: a window of window_size values
StandardAbsoluteDeviation	Distance from the running mean or recent median in standard deviations [HVK17]	window_size when using subtracted_statistic="median"	Fixed; median mode retains only the last window_size values while variance remains an all-history running statistic
HoltWinters	Violations of a confidence band of seasonal deviations around a Holt-Winters forecast, counted in a moving window [Bru00]	The period	Fixed: a seasonal coefficient and a deviation for each of the period points of the cycle, and the last window_size violations
ChangeFinder	Logarithmic loss under an autoregressive model that sequentially discounting learning fits, and a second such model on the smoothed losses for change points [TY06]	Nothing	Fixed: order values and window_size scores
HTM	The fraction of active columns that the temporal memory of Hierarchical Temporal Memory did not predict, turned into an anomaly likelihood [ALPA17]	The range of the values (min_val and max_val), and a timestamp in seconds since the Unix epoch with each value	Grows slowly: at most 128 segments of 32 synapses for each of the 65,536 cells, and a window of 8,640 scores
KNNCAD	Conformalized k-nearest neighbors [BI16]	A probationary period: at least 48 values that it learns from before it scores	Fixed: the last 19 values and about 2 × probationary_period training and calibration windows of 19 values
MatrixProfile	Distance from the newest subsequence to its nearest earlier subsequence, the matrix profile of STAMPI [YZU+16]	The subsequence length (window_length)	Fixed: the last history_size values
DAMP	Approximate distance from the newest subsequence to its nearest earlier subsequence, exact for each new left-discord, with a backward search that stops early [LWM+22]	The subsequence length (window_length)	Fixed: the last history_size + window_length - 1 values
SpectralResidual	Saliency of the newest value in the spectral residual of a sliding window, with estimated values after it [RXW+19]	The window size	Fixed: a window of window_size values
RelativeEntropy	Relative entropy of windowed histograms [WVC+11]	The range of the values	Grows slowly: a window and one histogram for each distinct state of the stream
SAND	Distance of the latest subsequence to weighted k-Shape clusters of past subsequences [BPPF21]	The subsequence length	Grows slowly: a batch of batch_size values and one centroid_length by centroid_length matrix per cluster, with at most num_clusters new clusters per batch

Integrations

These wrappers run a batch detector from PyOD on a stream. A batch detector trains on a complete dataset. For instructions, see Run a PyOD model on a stream.

Wrapper	Behavior
ReferenceWindowModel	Trains the detector on a window of recent points and trains it again every sliding_size points [MLA18].
OneFitModel	Trains the detector once on initial points and then only scores.

PredictiveAnomalyDetector scores each value of a univariate stream by its deviation from the one-step forecast of a River forecaster, the plug-in method of EGADS [LAF15]. The forecaster learns each value after the model scores it.

Baselines for testing

These models do not detect anomalies. Use them to test a pipeline or as a reference in an evaluation.

Model	Score
NullModel	Always 0.5.
RandomModel	A random value between 0 and 1.
PerfectModel	The label of the point (the known answer: anomaly or normal). It gives the best possible result for a metric.