r-ml-anomaly

R Anomaly Detection

Outlier and anomaly detection.

AnomalyDetection (Twitter)

library(AnomalyDetection)

# Time series anomaly detection
result <- AnomalyDetectionTs(
  df,  # data.frame with timestamp and count columns
  max_anoms = 0.02,
  direction = "both",  # "pos", "neg", or "both"
  alpha = 0.05,
  only_last = "day",  # "day", "hr", or NULL
  plot = TRUE
)

# Results
result$anoms  # Anomalies
result$plot   # Plot

# Vector anomaly detection (no timestamps)
result <- AnomalyDetectionVec(
  values,
  max_anoms = 0.02,
  direction = "both",
  period = 24,  # Seasonality period
  plot = TRUE
)

anomalize (Tidy)

library(anomalize)
library(tibbletime)

# Prepare data
df_ts <- df %>%
  as_tbl_time(index = date)

# Detect anomalies
result <- df_ts %>%
  time_decompose(value, method = "stl") %>%
  anomalize(remainder, method = "iqr") %>%
  time_recompose()

# Plot
result %>% plot_anomalies()
result %>% plot_anomaly_decomposition()

# Get anomalies
anomalies <- result %>%
  filter(anomaly == "Yes")

# Methods
# Decomposition: "stl", "twitter"
# Anomaly detection: "iqr", "gesd"

BreakoutDetection (Twitter)

library(BreakoutDetection)

# Detect breakouts (mean shifts)
result <- breakout(
  df$value,
  min.size = 24,
  method = "multi",
  beta = 0.001,
  degree = 1,
  plot = TRUE
)

# Results
result$loc  # Breakpoint locations
result$plot

changepoint

library(changepoint)

# Mean change
cpt_mean <- cpt.mean(values, method = "PELT")
plot(cpt_mean)
cpts(cpt_mean)  # Changepoint locations

# Variance change
cpt_var <- cpt.var(values, method = "PELT")

# Mean and variance
cpt_meanvar <- cpt.meanvar(values, method = "PELT")

# Multiple changepoints
cpt_multi <- cpt.mean(values, method = "BinSeg", Q = 5)

Isolation Forest

library(isotree)

# Fit isolation forest
model <- isolation.forest(df, ntrees = 100)

# Anomaly scores (higher = more anomalous)
scores <- predict(model, df)

# Threshold
threshold <- quantile(scores, 0.95)
anomalies <- df[scores > threshold, ]