Skip to content


Threshold anomaly filter.


  • anomaly_detector

    An anomaly detector.

  • q (float)

    The quantile level above which to classify an anomaly score as anomalous.

  • protect_anomaly_detector – defaults to True

    Indicates whether or not the anomaly detector should be updated when the anomaly score is anomalous. If the data contains sporadic anomalies, then the anomaly detector should likely not be updated. Indeed, if it learns the anomaly score, then it will slowly start to consider anomalous anomaly scores as normal. This might be desirable, for instance in the case of drift.


  • q


>>> from river import anomaly
>>> from river import compose
>>> from river import datasets
>>> from river import metrics
>>> from river import preprocessing

>>> model = compose.Pipeline(
...     preprocessing.MinMaxScaler(),
...     anomaly.QuantileFilter(
...         anomaly.HalfSpaceTrees(seed=42),
...         q=0.95
...     )
... )

>>> report = metrics.ClassificationReport()

>>> for x, y in datasets.CreditCard().take(8000):
...     score = model.score_one(x)
...     is_anomaly = model['QuantileFilter'].classify(score)
...     model = model.learn_one(x)
...     report = report.update(y, is_anomaly)

>>> report
               Precision   Recall   F1       Support
       0      99.91%   97.78%   98.83%      7975
       1       9.23%   72.00%   16.36%        25
   Macro      54.57%   84.89%   57.60%
   Micro      97.70%   97.70%   97.70%
Weighted      99.63%   97.70%   98.58%
                 97.70% accuracy



Classify an anomaly score as anomalous or not.


  • score (float)


bool: A boolean value indicating whether the anomaly score is anomalous or not.


Return a fresh estimator with the same parameters.

The clone has the same parameters but has not been updated with any data. This works by looking at the parameters from the class signature. Each parameter is either - recursively cloned if it's a River classes. - deep-copied via copy.deepcopy if not. If the calling object is stochastic (i.e. it accepts a seed parameter) and has not been seeded, then the clone will not be idempotent. Indeed, this method's purpose if simply to return a new instance with the same input parameters.


Update the anomaly filter and the underlying anomaly detector.


  • args




Return an outlier score.

A high score is indicative of an anomaly. A low score corresponds to a normal observation.


  • args


An anomaly score. A high score is indicative of an anomaly. A low score corresponds a