Anomaly Score

How anomaly scores work

Anomaly scores measure the degree of deviation from normal patterns using statistical or machine learning methods. The higher the score, the more likely a data point represents an anomaly. These scores typically account for multiple factors:

• Historical patterns and seasonality
• Statistical distributions
• Multiple dimensions or metrics
• Context-specific thresholds

# Simplified example of Z-score based anomaly scoring
def calculate_anomaly_score(value, mean, std_dev):
    return abs((value - mean) / std_dev)

Common scoring methods

Statistical approaches

Statistical methods calculate anomaly scores based on probability distributions and statistical measures:

1. Z-score: Measures deviation in standard deviations from the mean
2. Modified Z-score: More robust version using median absolute deviation
3. Interquartile range (IQR) based scoring

Machine learning-based scoring

Modern anomaly detection systems often use more sophisticated scoring methods:

• Isolation Forest scores
• Local Outlier Factor (LOF)
• Autoencoder reconstruction error
• Density-based scores

Applications in time-series data

Anomaly scores are particularly valuable in time-series analysis, where they help identify:

Industrial systems monitoring

In industrial settings, anomaly scores help detect:

• Equipment failures
• Process deviations
• Quality control issues
• Safety-critical events

Financial market surveillance

For financial data, anomaly scores can identify:

• Unusual trading patterns
• Market manipulation attempts
• Risk events
• System issues

Here's an example using QuestDB to calculate simple anomaly scores:

WITH baseline AS (
    SELECT avg(price) AS mean_price,
           stddev(price) AS std_price
    FROM trades
    WHERE timestamp > dateadd('d', -1, now())
)
SELECT timestamp,
       price,
       abs((price - mean_price) / std_price) AS anomaly_score
FROM trades
CROSS JOIN baseline
WHERE timestamp > dateadd('h', -1, now())
ORDER BY anomaly_score DESC
LIMIT 10;

Setting thresholds

Converting anomaly scores into actionable insights requires careful threshold setting:

1. Static thresholds

   • Fixed score cutoffs
   • Simple but may not adapt to changing conditions

2. Dynamic thresholds

   • Adapt to temporal patterns
   • Account for seasonality and trends
   • More complex but more accurate

3. Multiple threshold levels

   • Warning levels
   • Critical levels
   • Emergency response triggers

Best practices

When implementing anomaly scoring systems:

1. Choose appropriate scoring methods based on:

   • Data characteristics
   • Performance requirements
   • Detection sensitivity needs

2. Validate scoring effectiveness:

   • Use labeled datasets when possible
   • Monitor false positive/negative rates
   • Adjust parameters based on feedback

3. Consider computational efficiency:

   • Score calculation overhead
   • Real-time requirements
   • Resource constraints

4. Maintain interpretability:

   • Document scoring methodology
   • Provide context for scores
   • Enable root cause analysis

Anomaly scores are fundamental to modern anomaly detection systems, providing a quantitative foundation for identifying and responding to unusual events in time-series data.