Anomaly Algorithm Comparison
Compare Z-score, Isolation Forest, and DBSCAN on labeled IoT teaching streams.
Anomaly algorithm comparison workbench
Run the same labeled IoT stream through three detector families. Watch which samples each method flags, then compare the operational trade-off: catching true anomalies without flooding operators with false alarms.
Different anomaly types change which algorithm is sensible.
The cursor shows the stream position and live detector scores.
Green catches, amber false alarms, and open red misses expose the trade-off.
Use precision, recall, latency, and compute budget before choosing a model.
Controls
Generate a labeled teaching stream, tune sensitivity, and move through the detector decisions.
Z-score baseline
Scores how many standard deviations a reading is from the reference mean: z = |x - mu| / sigma.
- Best first check for stable, roughly Gaussian point anomalies.
- Very cheap at the edge and easy to explain to operators.
- Can miss contextual or collective patterns and can be pulled by outliers.
Isolation Forest
Builds many random partition trees; samples isolated in fewer splits receive higher anomaly scores.
- Useful when anomaly evidence spans multiple features.
- Does not need labeled anomaly examples for first deployment.
- Threshold and contamination assumptions still need operational tuning.
DBSCAN noise lens
Finds dense groups and labels points outside density-connected clusters as noise candidates.
- Good when normal behavior forms compact clusters of similar density.
- Can identify separated bursts without setting the number of clusters.
- Sensitive to feature scaling,
eps, and changing densities.
| Question | Z-score | Isolation Forest | DBSCAN |
|---|---|---|---|
| Question: Data shape | Z-score: Stable numeric stream with point outliers. | Isolation Forest: Multi-feature points that are few and different. | DBSCAN: Dense normal clusters with sparse or separated noise. |
| Question: Operational strength | Z-score: Low latency and transparent thresholds. | Isolation Forest: Captures non-linear feature combinations. | DBSCAN: Does not require a preselected number of clusters. |
| Question: Common failure mode | Z-score: False alarms under drift or missed collective patterns. | Isolation Forest: Threshold can over-alert if contamination is wrong. | DBSCAN: Weak when densities vary or scaling is not controlled. |
| Question: Edge fit | Z-score: Microcontroller-friendly. | Isolation Forest: Gateway or capable edge node. | DBSCAN: Usually batch/window processing, not a one-sample streaming rule. |
Technical accuracy notes
The detectors here are teaching-scale versions so learners can inspect decisions in the browser. The isolation forest uses random split trees over value, delta, and contextual features; DBSCAN clusters the same scaled feature space and treats label -1 as a noise candidate.
- Precision =
TP / (TP + FP); recall =TP / (TP + FN). - A higher sensitivity setting lowers thresholds and usually increases both recall and false positives.
- No detector is globally best; the useful answer depends on data distribution, labels, compute, latency, and alert cost.
Decision guide
- Start with Z-score or IQR when data is stable and the cost of explainability is high.
- Use Isolation Forest when normal behavior is multi-dimensional and labels are scarce.
- Use DBSCAN when the window contains density-separated clusters and batch scoring is acceptable.
- Add drift handling, seasonality, and model monitoring before treating any method as production-ready.
Quick reference sources
This workbench is aligned with the course anomaly chapters and primary algorithm references.
Practice prompts
- Set the pattern to cluster burst. Which detector balances false positives and false negatives best?
- Increase sensitivity to 5. What improves, and what becomes operationally expensive?
- Switch to smart-meter load with contextual shift. Why is a pure point detector not enough?
- Explain which method you would run on a battery sensor versus an edge gateway.