Time Series Anomaly Detector Calculator
Calculate time series anomaly detector with our free tool. Get data-driven results, visualizations, and actionable recommendations.
Reviewed by Daniel Agrici, Founder & Lead Developer
Formula
Z-Score = (X - Mean) / StdDev | Anomaly if |Z| > Threshold
The Z-score measures how many standard deviations a data point X is from the mean. Points exceeding the sensitivity threshold are flagged as anomalies. The moving average method calculates Z-scores relative to a local window, and the IQR method uses quartile-based bounds (Q1 - k*IQR, Q3 + k*IQR) for non-parametric detection.
Worked Examples
Example 1: Server Response Time Monitoring
Problem:A server has response times (ms): 45, 48, 42, 47, 44, 120, 46, 43, 49, 45. Detect anomalies using Z-score with threshold of 2.
Solution:Mean = (45+48+42+47+44+120+46+43+49+45) / 10 = 52.9 ms\nStd Dev = 22.7 ms\nUpper bound = 52.9 + 2 x 22.7 = 98.3 ms\nLower bound = 52.9 - 2 x 22.7 = 7.5 ms\nZ-score of 120ms = (120 - 52.9) / 22.7 = 2.96\nAnomaly detected: 120ms (Z-score 2.96 > 2.0)
Result:1 anomaly detected out of 10 points | 120ms flagged at Z-score 2.96
Example 2: Daily Sales Pattern Analysis
Problem:Daily sales: 500, 520, 490, 510, 505, 480, 515, 200, 510, 500. Use IQR method with 1.5x multiplier to detect unusual days.
Solution:Sorted: 200, 480, 490, 500, 505, 510, 510, 515, 520\nQ1 = 490, Q3 = 515\nIQR = 515 - 490 = 25\nLower bound = 490 - 1.5 x 25 = 452.5\nUpper bound = 515 + 1.5 x 25 = 552.5\nAnomaly: 200 (below 452.5)
Result:1 anomaly detected | Day 8 sales of 200 flagged (below IQR lower bound of 452.5)
Frequently Asked Questions
What is a time series anomaly?
A time series anomaly (also called an outlier) is a data point that deviates significantly from the expected pattern or trend in sequential data. Anomalies can be point anomalies (a single unusual value), contextual anomalies (a value that is unusual given its temporal context but might be normal otherwise), or collective anomalies (a sequence of values that together form an unusual pattern). Detecting anomalies is crucial in fields like fraud detection, infrastructure monitoring, medical diagnostics, and quality control where early identification of unusual behavior can prevent costly problems.
What is the Z-score method for anomaly detection?
The Z-score method measures how many standard deviations a data point is from the mean of the dataset. A Z-score of 0 means the value equals the mean, while a Z-score of 2 means the value is 2 standard deviations above the mean. Typically, data points with Z-scores above 2 or 3 (or below -2 or -3) are flagged as anomalies. This method assumes the data follows a roughly normal distribution and works best for stationary time series. For a normal distribution, about 95.4% of values fall within 2 standard deviations, so using a threshold of 2 flags approximately the most extreme 4.6% of values.
What are the limitations of statistical anomaly detection?
Statistical methods have several limitations. They assume a specific data distribution (often normal), which may not hold for real-world data. They struggle with multimodal distributions, seasonal patterns (without preprocessing), and gradual drift where the baseline slowly changes. Point-based methods miss collective anomalies where individual values are normal but the pattern is unusual. They are also sensitive to contaminated training data: if anomalies are present in the baseline data, they inflate the standard deviation and make future anomalies harder to detect. For complex scenarios, machine learning approaches like Isolation Forests or autoencoders may be more appropriate.
References
Reviewed by Daniel Agrici, Founder & Lead Developer · Editorial policy