QuantileFilter

Threshold anomaly filter.

Parameters

• anomaly_detector

  An anomaly detector.

• q (float)

  The quantile level above which to classify an anomaly score as anomalous.

• protect_anomaly_detector – defaults to True

  Indicates whether or not the anomaly detector should be updated when the anomaly score is anomalous. If the data contains sporadic anomalies, then the anomaly detector should likely not be updated. Indeed, if it learns the anomaly score, then it will slowly start to consider anomalous anomaly scores as normal. This might be desirable, for instance in the case of drift.

Attributes

• q

Examples

>>> from river import anomaly
>>> from river import compose
>>> from river import datasets
>>> from river import metrics
>>> from river import preprocessing

>>> model = compose.Pipeline(
...     preprocessing.MinMaxScaler(),
...     anomaly.QuantileFilter(
...         anomaly.HalfSpaceTrees(seed=42),
...         q=0.95
...     )
... )

>>> report = metrics.ClassificationReport()

>>> for x, y in datasets.CreditCard().take(8000):
...     score = model.score_one(x)
...     is_anomaly = model['QuantileFilter'].classify(score)
...     model = model.learn_one(x)
...     report = report.update(y, is_anomaly)

>>> report
               Precision   Recall   F1       Support
<BLANKLINE>
       0      99.91%   97.78%   98.83%      7975
       1       9.23%   72.00%   16.36%        25
<BLANKLINE>
   Macro      54.57%   84.89%   57.60%
   Micro      97.70%   97.70%   97.70%
Weighted      99.63%   97.70%   98.58%
<BLANKLINE>
                 97.70% accuracy

Methods

classify

Classify an anomaly score as anomalous or not.

Parameters

• score (float)

Returns

bool: A boolean value indicating whether the anomaly score is anomalous or not.

clone

Return a fresh estimator with the same parameters.

The clone has the same parameters but has not been updated with any data. This works by looking at the parameters from the class signature. Each parameter is either - recursively cloned if it's a River classes. - deep-copied via copy.deepcopy if not. If the calling object is stochastic (i.e. it accepts a seed parameter) and has not been seeded, then the clone will not be idempotent. Indeed, this method's purpose if simply to return a new instance with the same input parameters.

learn_one

Update the anomaly filter and the underlying anomaly detector.

Parameters

• args

Returns

self

score_one

Return an outlier score.

A high score is indicative of an anomaly. A low score corresponds to a normal observation.

Parameters

• args

Returns

An anomaly score. A high score is indicative of an anomaly. A low score corresponds a