Real-Time Anomaly Detection

Live sensor stream scored observation by observation. Tracks precision, recall, and F1 against ground truth in real time.

Disconnected
Phase A
building baseline 0 observations

Event counts, current cycle

0
0
0

Detection metrics vs ground truth, current cycle

0.00

alerts that were real

0.00

anomalies caught

0.00

harmonic mean P&R

Sensor readings, last 200 observations

Temperature Pressure Vibration Alert (score > threshold) Drift event

Anomaly score, last 200 observations

Mahalanobis distance from the Phase A baseline, scaled to [0, 1). Red dashed line = detection threshold (0.60). Yellow lines = ADWIN drift events.

How it works ▼

Each observation is scored exactly once as it arrives. No batching, no retraining.

Mahalanobis distance (anomaly scorer)

During Phase A, the detector fits a multivariate Gaussian to the sensor readings. After Phase A, that baseline is frozen. Every new observation is scored as its Mahalanobis distance from the Phase A mean, using the full covariance matrix. This catches both large single-sensor spikes and unusual sensor combinations, like high temperature paired with low pressure when the two normally move together.

ADWIN (drift detector)

Watches a normalized average of all three sensor readings. When the distribution of that signal shifts in Phase B, ADWIN fires. The anomaly baseline is not reset since it was calibrated on the pre-drift data. Drift events are logged and shown as yellow markers on the charts.

Stream phases

  • Phase A (300 obs): Correlated Gaussian noise across three sensors, shared latent factor (weight 0.7). The detector fits the baseline here. Scores are 0 during this phase.
  • Phase B (200 obs): All sensor means shift linearly. ADWIN fires when it detects the sustained shift.
  • Phase C (300 obs): Anomalies are injected at ~8% rate. Two types: point anomalies (3-5σ spikes in one or more sensors) and contextual anomalies (high temp + low pressure, unusual given the positive correlation in normal data). Precision, recall, and F1 are measured here against ground truth labels.

The /stats and /metrics endpoints expose all counters as JSON and Prometheus text respectively.