AnomalyDetection

AnomalyDetection

Twitter's anomaly detection for time series.

Installation

# From GitHub (not on CRAN)
devtools::install_github("twitter/AnomalyDetection")
library(AnomalyDetection)

Basic Usage

# Detect anomalies in time series
result <- AnomalyDetectionTs(df, max_anoms = 0.02, direction = "both")

# View anomalies
result$anoms

# Plot
result$plot

Parameters

result <- AnomalyDetectionTs(
  df,                    # Data frame with timestamp and value columns
  max_anoms = 0.02,      # Max proportion of anomalies (0-0.49)
  direction = "both",    # "pos", "neg", or "both"
  alpha = 0.05,          # Significance level
  only_last = NULL,      # "day" or "hr" for recent anomalies only
  threshold = "None",    # "med_max", "p95", "p99" for filtering
  e_value = FALSE,       # Return expected value
  longterm = FALSE,      # Use piecewise median for long series
  piecewise_median_period_weeks = 2,
  plot = TRUE,           # Generate plot
  y_log = FALSE,         # Log scale
  xlabel = "",
  ylabel = "count"
)

Vector Input

# For raw vectors (no timestamps)
result <- AnomalyDetectionVec(
  x,                     # Numeric vector
  max_anoms = 0.02,
  direction = "both",
  alpha = 0.05,
  period = NULL,         # Seasonality period
  only_last = FALSE,
  threshold = "None",
  e_value = FALSE,
  longterm_period = NULL,
  plot = TRUE
)

Direction Options

# Positive anomalies only (spikes)
result <- AnomalyDetectionTs(df, direction = "pos")

# Negative anomalies only (dips)
result <- AnomalyDetectionTs(df, direction = "neg")

# Both directions
result <- AnomalyDetectionTs(df, direction = "both")

Threshold Filtering

# Only report anomalies above median max
result <- AnomalyDetectionTs(df, threshold = "med_max")

# Only report anomalies above 95th percentile
result <- AnomalyDetectionTs(df, threshold = "p95")

# Only report anomalies above 99th percentile
result <- AnomalyDetectionTs(df, threshold = "p99")