Time Series Anomaly Detector

All three methods here answer the same question - how far is this point from where the others sit - but they disagree about how to measure the centre and the spread. The global z-score divides the deviation from the mean by the standard deviation, so under a normal distribution a threshold of 2 flags about 4.6 percent of points, 2.5 flags 1.2 percent, and 3 flags 0.27 percent. The moving-window variant recomputes mean and spread from neighbouring points only, excluding the point under test, which lets it track a trending or seasonal baseline that a global mean would misrepresent. The interquartile method takes Tukey fences at Q1 minus k times IQR and Q3 plus k times IQR; the classical setting of k equal to 1.5 flags roughly 0.7 percent of normal data, and this tool reuses the sensitivity input as k, so a sensitivity of 2 gives wider fences than the textbook default. The sharpest limitation is arithmetic. Because the mean and standard deviation are computed from the full series including the suspect point, a single extreme value inflates both, a phenomenon called masking. With n points the largest possible absolute z-score is (n-1) divided by the square root of n, so with 10 observations no point can ever exceed 2.85 and a threshold of 3 can never fire at all. Series shorter than about 20 points are therefore poorly served by z-scores, and the quartile route is safer. Beyond that, none of these methods decompose seasonality or trend, so a normal Monday peak in weekly data will be flagged repeatedly; consecutive anomalies contaminate the moving window and hide each other; and quartiles here are taken by index position rather than interpolation.

Deciding when to discard a discordant observation is one of the oldest arguments in statistics, and it began in astronomy where a single bad transit reading could distort an orbit. Benjamin Peirce published a formal rejection criterion in 1852, and William Chauvenet offered a simpler rule in his 1863 Manual of Spherical and Practical Astronomy, still taught as Chauvenet's criterion. Both were controversial from the start, since critics including Airy argued that discarding inconvenient data on statistical grounds alone invited self-deception. Frank Grubbs gave the problem its modern hypothesis-testing form in 1950 with a test for a single outlier, later extended by Bernard Rosner in 1983 into the generalized extreme studentized deviate procedure that handles several outliers at once. Continuous monitoring came from manufacturing rather than astronomy. Walter Shewhart, working at Bell Telephone Laboratories, sketched the control chart in a one-page memorandum in 1924 and developed it fully in Economic Control of Quality of Manufactured Product in 1931, choosing three-sigma limits as an economic compromise between missed defects and needless investigation. E. S. Page added the cumulative sum chart in 1954 and S. W. Roberts the exponentially weighted moving average in 1959, both designed to catch gradual drift that a point-by-point rule misses. John Tukey's Exploratory Data Analysis in 1977 introduced the box plot and the 1.5 IQR fences used here, deliberately built on quartiles so that the rule would not be distorted by the very outliers it was meant to find. Machine learning approaches such as Isolation Forest, published by Liu, Ting, and Zhou in 2008, extended detection to high-dimensional data where distance-based rules break down.