Anomaly detection in a seasonal metric

A seasonal metric can make ordinary peaks look anomalous and real incidents look normal. Compare Tuesday with the relevant weekly expectation before applying a threshold. One simple detector subtracts the value from seven periods earlier and monitors the resulting residual.

An anomaly flag means “unusual under this reference and threshold.” It does not name a root cause, prove fraud or establish that a data point should be deleted.

Fix the rule before evaluation

The local lab generates 112 daily-like points with a seven-period cycle and three seeded positive anomalies in the later evaluation window. It calculates seasonal-naïve residuals, estimates their median and median absolute deviation (MAD) on the first 56 points, then freezes a threshold at six MADs.

from timeseries_cases import anomaly_case

result = anomaly_case()
assert result["evaluation_rows"] == 56
assert result["true_flags"] == 3
assert result["true_flags"] <= result["flagged"]
print(result["flagged"], result["authored_anomalies"], result["true_flags"])

This prints 6 3 3. Three additional flags are false positives relative to the seeded labels. Recall for the authored events is 100%, while precision is 50%. Those figures describe one deterministic teaching fixture.

Make labels and actions explicit

Production anomaly labels are rarely complete. Uninvestigated alerts are not confirmed negatives. Define what counts as a true incident, how long investigators have to label it, and whether several flagged points in one event count once or many times.

Choose the alert unit and operational response. A metric spike might open a data-quality check, page an engineer or request analyst review. Costs differ. Tune thresholds on validation incidents and capacity constraints, then report alert volume, precision, recall and detection delay where labels permit.

Guard the seasonal reference

The seven-period rule needs a complete, correctly ordered index. Holidays and known closures can create legitimate residuals. Slowly changing level can bias a fixed seasonal reference. Consider robust decomposition, rolling baselines or models with known calendar features, but preserve a simple rule as a benchmark.

Do not automatically remove flagged data before forecasting. An event can represent a real demand shift the forecast must learn. Store the raw value, flag, investigation result and any corrected value with provenance.

The Data Science course relates anomaly detection to evaluation, monitoring and accountable operational decisions.

Exercise

Test thresholds from four to eight MADs using a validation window. Plot precision, recall and alerts per week. Freeze one policy, evaluate it later, and write a triage runbook for false positives and confirmed incidents.

Continue learning

This article is part of the Forecasting and time-series analysis sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Compare direct and recursive multi-step forecasting.
• Continue with Build a forecast handover for an inventory planner.

Reference: statsmodels seasonal decomposition API.