Analytics & ML · Study deck

Time-Series Anomalies: Evaluation and Types

A detector may catch nine faults and still waste the operator's day with false alarms.

Data Dora is your guide for this deck.

anomalytimeseries

Data Dora, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: Point anomalies are unusual single values, contextual anomalies are unusual only under specific conditions, and collective anomalies are unusual patterns across windows or groups.
Explain: In: Collective Anomaly, Sensor 1 through Sensor 4 are individually plausible while the labelled: Pattern: Increasing variance is abnormal only as a group.
Explain: Sensor faults should remain a separate boundary so operations teams do not confuse measurement failure with process failure.
Explain: A detector may catch nine faults and still waste the operator's day with false alarms.

Major section

Start With the Decision · Anomaly Detector Evaluation

A detector may catch nine faults and still waste the operator's day with false alarms.

Confusion counts and anomaly type show whether the model is useful.
A detector is a model that flags a reading as a possible fault.
Anomaly type names what kind of unusual pattern the model must find.

Evaluation is a threshold decision, not a single score: precision, recall, F1, confusion matrix evidence, and operating cost all feed threshold selection.

Major section

Point, Contextual, Collective Anomalies

That may be a bad point.

Yet the same value may be normal while the door is open for loading.
A slow rise across many readings may matter even when no single value crosses a limit.
The alert should show why this evidence set was used.
A wide group can reveal drift, but it may react late.

Anomaly type defines the evidence boundary: one extreme value, one value interpreted in context, or a group pattern that is only abnormal when read together.

Major section

Point, Contextual, Collective Anomalies (continued)

A tight rule can catch a clear fault fast, but it may raise false alarms.

This first pass does not choose a maths method or prove the cause.
In: Collective Anomaly, Sensor 1 through Sensor 4 are individually plausible while the labelled: Pattern: Increasing variance is abnormal only as a group.
Anomaly type is an engineering decision.

Major section

Point, Contextual, Collective Anomalies (continued)

Point anomalies are unusual single values, contextual anomalies are unusual only under specific conditions, and collective anomalies are unusual patterns across windows or groups.

Sensor faults should remain a separate boundary so operations teams do not confuse measurement failure with process failure.
Classify the anomaly type first, then select the detector, evidence record, deployment tier, and retest trigger.
Statistical MethodsUse simple statistical scores for point anomalies and edge-friendly candidate alerts.

Deck summary

Key takeaways

A detector may catch nine faults and still waste the operator's day with false alarms.

That may be a bad point.
A tight rule can catch a clear fault fast, but it may raise false alarms.
Point anomalies are unusual single values, contextual anomalies are unusual only under specific conditions, and collective anomalies are unusual patterns across windows or groups.

Retrieval practice

Recall check 1 of 6

Data Dora says: answer from memory, then check your reasoning.

Q1Why can ordinary accuracy mislead an IoT anomaly-detection review?

ABecause normal windows usually dominate

BBecause accuracy needs probability scores.

CBecause false alarms outweigh missed incidents.

DBecause precision and recall do not require labels.

Show answer

Answer: A Class imbalance can make accuracy look strong even when anomaly detection is operationally weak.

Retrieval practice

Recall check 2 of 6

Data Dora says: answer from memory, then check your reasoning.

Q2A validation set has 10,000 event windows, each containing at most one incident; 20 windows contain real incidents. The detector raises 30 alerts: 12 true positives and 18 false positives. What does precision measure?

A12 / 20 = 0.60, meaning 60% of real incidents were caught.

B12 / 30 = 0.40, meaning 40% of alerts were real reviewed incidents.

C18 / 9,980 = about 0.18%, meaning normal-window false positive rate.

D9,962 / 10,000 = about 99.62%, meaning the detector is operationally strong.

Show answer

Answer: B Precision is TP divided by all alerts, while recall is TP divided by all real incidents.

Retrieval practice

Recall check 3 of 6

Data Dora says: answer from memory, then check your reasoning.

Q3Why should an anomaly-metrics pipeline define event matching and duplicate suppression before computing precision and recall?

ABecause repeated alerts should be matched to separate operator visits, so an incident that needs more review contributes more true positives to the recall calculation.

BBecause event matching should replace operator labels by assigning each alert to a detector threshold, even when maintenance evidence is missing.

CBecause precision and recall should be calculated only from true negatives once alerts have been grouped into site-level operating windows.

DBecause one incident can create many samples or alerts, and counting each duplicate as a separate event distorts both alert quality and missed-event counts.

Show answer

Answer: D IoT anomalies often span windows and repeated alerts, so metrics need an explicit mapping from alerts to incidents.

Retrieval practice

Recall check 4 of 6

Data Dora says: answer from memory, then check your reasoning.

Q4Twelve conveyor-speed sensors all stay inside their normal individual bands, but every sensor drifts upward together over two hours. Which anomaly type best describes the evidence?

AA point anomaly, because each single sample crosses its own normal speed band.

BA contextual anomaly, because only the time of day changes the expected speed.

CA collective anomaly, because the sensors drift together despite normal individual bands.

DNo anomaly, because passing separate limit checks rules out a shared drift.

Show answer

Answer: C Anomaly type follows the evidence: single value, context-conditioned value, or group pattern.

Retrieval practice

Recall check 5 of 6

Data Dora says: answer from memory, then check your reasoning.

Q5Why is a plain point threshold a poor first choice for a contextual anomaly problem?

AThe same reading can be normal or abnormal under different modes, loads, or nearby signals.

BA point threshold reacts too slowly, so the first change should be to increase the sampling rate.

CContext needs a deep learning model, so threshold review should wait until that model has been trained.

DSensor-health evidence should be ignored once a contextual score is available.

Show answer

Answer: A Detector choice follows the type of evidence required by the anomaly.

Retrieval practice

Recall check 6 of 6

Data Dora says: answer from memory, then check your reasoning.

Q6Why should the anomaly type be stored with the alert record in a production IoT system?

ABecause a type label replaces the stored values, scores, windows, and context.

BBecause every anomaly type then shares one baseline and one detection metric.

CBecause the record must state the evidence evaluated and how that alert is retested.

DBecause attaching the type label automatically prevents later concept drift.

Show answer

Answer: C A production alert needs reviewable evidence, and anomaly type defines the evidence boundary.

Print reference

Answers 1 of 2

Answer key.

A · Class imbalance can make accuracy look strong even when anomaly detection is operationally weak.
B · Precision is TP divided by all alerts, while recall is TP divided by all real incidents.
D · IoT anomalies often span windows and repeated alerts, so metrics need an explicit mapping from alerts to incidents.
C · Anomaly type follows the evidence: single value, context-conditioned value, or group pattern.
A · Detector choice follows the type of evidence required by the anomaly.

Print reference

Answers 2 of 2

Answer key.

C · A production alert needs reviewable evidence, and anomaly type defines the evidence boundary.