Skip to content
v0.1.3latest release121 skills4 categories6 sub-categories247 tested scripts397 reference docsContact us

Detector Recipes

Reference for anomaly-detection-model-builder · 90 lines

AI & Machine Learning / Classical Machine Learningv1.0.0Updated OCT 25 20263 references2 scripts

X_ref = reference (mostly normal) data, X_new = data to score; scale with a scaler fitted on X_ref.

Robust z-score and IQR

python
import numpy as np
med = np.median(X_ref, axis=0)
mad = np.median(np.abs(X_ref - med), axis=0) * 1.4826
rz = np.abs((X_new - med) / np.where(mad == 0, 1e-9, mad))
score = rz.max(axis=1)                          # flag score > 3.5 (or budget)
q1, q3 = np.percentile(X_ref, [25, 75], axis=0)
iqr_flag = ((X_new < q1 - 1.5 * (q3 - q1)) | (X_new > q3 + 1.5 * (q3 - q1))).any(axis=1)

Mahalanobis with robust covariance

python
from sklearn.covariance import MinCovDet, EllipticEnvelope
mcd = MinCovDet(random_state=0).fit(X_ref)
score = np.sqrt(mcd.mahalanobis(X_new))
env = EllipticEnvelope(contamination=0.01, random_state=0).fit(X_ref)    # thresholded version

Squared Mahalanobis distances of Gaussian data follow χ²(p): scipy.stats.chi2.ppf(0.999, p) as a cut.

k-NN distance

python
from sklearn.neighbors import NearestNeighbors
nn = NearestNeighbors(n_neighbors=5).fit(Z_ref)
dist, _ = nn.kneighbors(Z_new)                 # when scoring the reference itself use n_neighbors=k+1 and drop self
score = dist[:, -1]

Local Outlier Factor

python
from sklearn.neighbors import LocalOutlierFactor
lof = LocalOutlierFactor(n_neighbors=20, novelty=True).fit(Z_ref)   # novelty=True to score new data
score = -lof.score_samples(Z_new)                                   # higher = more anomalous

With novelty=False (default), use fit_predict / negative_outlier_factor_ on the same data only.

Isolation Forest

python
from sklearn.ensemble import IsolationForest
iso = IsolationForest(n_estimators=300, max_samples=256, contamination="auto", random_state=0).fit(X_ref)
score = -iso.score_samples(X_new)                                   # higher = more anomalous
flag = iso.predict(X_new) == -1                                     # uses the contamination threshold

No scaling needed (splits per feature); max_features < 1.0 for many noisy features.

One-class SVM

python
from sklearn.svm import OneClassSVM
oc = OneClassSVM(kernel="rbf", nu=0.01, gamma="scale").fit(Z_ref)
score = -oc.decision_function(Z_new)

Scale features; tune nu (upper bound on the outlier fraction) and gamma. SGDOneClassSVM for large data. Sensitivity is real: on the sensor fixture these settings reach PR-AUC 0.36, while MinCovDet Mahalanobis (0.98), LOF (0.96) and Isolation Forest (0.94-0.98) need no tuning. Start with the tuning-free detectors.

Reconstruction error

python
from sklearn.decomposition import PCA
pca = PCA(n_components=0.9).fit(Z_ref)
recon = pca.inverse_transform(pca.transform(Z_new))
score = ((Z_new - recon) ** 2).sum(axis=1)                          # the Q / SPE statistic

Autoencoders (PyTorch/Keras) generalise this for non-linear structure; train only on normal data.

PyOD

PyOD wraps 40+ detectors with a common API (fit, decision_function, decision_scores_), including ECOD and COPOD (fast, parameter-free), HBOS, and ensembles (SUOD).

python
from pyod.models.ecod import ECOD
clf = ECOD().fit(X_ref); score = clf.decision_function(X_new)

Ensembles

Different detectors find different anomaly types. Combine by rank (average of rank-normalised scores, as in anomaly_scores.py) or by maximum rank; normalising raw scores with z-scores is fragile because detectors' score distributions differ.

More in Classical Machine Learning

catboost-model-builder

Build CatBoost models that use its strengths correctly: raw categorical columns as cat_features (ordered target statistics, no manual encoding), text_features, Pool construction with NaN-safe categories, ordered boosting and has_time for temporal data, symmetric (oblivious) trees, overfitting detector with eval_set and use_best_model, losses for classification, regression (Quantile, Poisson, Tweedie) and ranking (YetiRank), class weights, monotone constraints, feature importance (PredictionValuesChange, LossFunctionChange) and SHAP values, GPU training and model export. Plans cat/text/numeric columns from a CSV and generates a runnable training script, and checks parameter sets for the conflicts CatBoost rejects (iterations vs n_estimators, Bayesian bootstrap with subsample, multiple class-weight options, depth > 16, use_best_model without eval_set).

categorical-encoding-selector

Choose and implement the right encoding for every categorical column given the model family and the data: one-hot (with infrequent-level grouping and handle_unknown), ordinal with an explicit order, cross-fitted target encoding (scikit-learn TargetEncoder, CatBoost ordered statistics, category_encoders inside CV), frequency/count encoding, feature hashing, native categorical support in LightGBM, HistGradientBoosting, XGBoost and CatBoost, prefix levels for codes (zip3, NAICS-2), and embeddings. Measures cardinality, rare-level share, unseen-level rate on a time-ordered holdout and target signal per column, emits the ColumnTransformer, and quantifies target-encoding leakage (in-sample vs out-of-fold vs holdout AUC).

classification-model-selector

Choose the right classification algorithm for tabular, text or mixed data and prove the choice with a fair bake-off: logistic regression (L2, L1, elastic net), linear SVM, naive Bayes, k-NN, RBF SVM, decision trees, random forest, extra trees, HistGradientBoosting, LightGBM, XGBoost, CatBoost, explainable boosting machines (EBM/GAM), points scorecards and MLPs, matched to data size, width, categorical and high-cardinality share, missingness, class imbalance, text, and constraints such as interpretability, monotonic constraints, calibrated probabilities, latency budgets and tiny deployable models. Ranks candidates with starting hyperparameters and cautions, then generates a bake-off script running every candidate on identical CV folds with per-fold metrics, fit time and prediction latency.

clustering-algorithm-selector

Choose the right clustering algorithm and check that clustering makes sense at all: cluster tendency (Hopkins statistic with a correlated-features caveat, nearest-neighbour isolation), then k-means / MiniBatchKMeans, Gaussian mixtures with BIC, agglomerative (Ward, average, complete, single) with dendrograms, DBSCAN, HDBSCAN, OPTICS, spectral clustering, BIRCH, mean shift, k-prototypes and k-modes for mixed or categorical data, and Gower distance, matched to data size, expected shapes, noise, varying density, known k, soft memberships, hierarchy and streaming. Covers preprocessing (scaling, encoding, dimensionality, distance metrics), validation (internal indices, bootstrap stability, external labels, business profiling) and assigning new points.

collaborative-filtering-implementer

Implement collaborative filtering recommenders that beat popularity: item-based kNN with cosine, Jaccard or asymmetric similarity, shrinkage, neighbourhood size, positive-only or mean-centred rating signals and 'because you liked X' explanations; implicit ALS with confidence weighting, BPR pairwise ranking and the closed-form EASE model in plain NumPy, tuned on a temporal validation split by recall@k and NDCG@k and refit on all data; plus user-kNN, explicit matrix factorisation, the implicit/LightFM libraries, hyperparameter ranges, cold-start fallbacks, scaling with sparse matrices and approximate nearest neighbours. Produces top-k lists in the format of the recommendation evaluator.

counterfactual-explanation-generator

Generate counterfactual explanations and algorithmic recourse: the smallest realistic change to a row's features that changes the model's decision. Solves exact minimal-cost recourse for linear and logistic models (MAD-scaled L1 cost, immutable features, increase/decrease directions, bounds, integer and binary features, diverse alternatives, features every counterfactual must change, and a no-recourse finding when immutable features decide), generates DiCE counterfactuals for any scikit-learn model with constraints turned into permitted ranges and every result re-predicted, and validates counterfactuals from any method for constraint violations, implausible values, off-manifold rows, broken derived-feature relations and failure to flip the prediction.