Skip to content
Tools · Interactive

Anomaly Detection Playground

Global z-score, rolling window, seasonal decomposition. Same series, very different alarms. Tune the threshold and compare.

Interactive · Anomaly Detection Same series, different detectors Compare global z-score, rolling-window, and seasonal-residual rules on one synthetic 90-day metric.
Day 90 Day 1
Method
Total flagged 0 Points outside the band
True positives caught 0 / 3 Injected anomalies found
False alarms 0 Flagged ordinary days
How it works

What it computes

The series is fixed and synthetic: 90 daily points from a linear trend (100 + 0.11t), a weekly cycle (10 × sin(2πt/7)), and Gaussian noise (σ = 2.4), plus three injected spikes at days 12, 45, and 74 (+42, +16, +9).

Each method builds a center line and a spread, then flags any point outside center ± threshold × spread. They differ only in how they estimate those two things:

  • z-score: one global mean and SD across all 90 points.
  • rolling: per day, the mean and SD of up to the previous 28 days. The first week falls back to the opening 28 days.
  • decompose: fit a straight trend line, average the detrended values by day of week for a seasonal profile, then band the residuals around trend + seasonal.

Assumptions

  • Residuals are roughly Gaussian and the seasonal period is exactly 7 days.
  • Anomalies are one-day spikes, not level shifts or slow drifts.

Where it breaks

  • The global z-score absorbs trend and seasonality into its SD, so its band is inflated and it misses moderate spikes. That contrast is the point of the demo.
  • None of the estimators are robust. A spike contaminates the very mean and SD used to judge it, especially the rolling window right after a spike. Production systems reach for median/MAD or a proper model.
  • Hits and false alarms can be counted here only because the anomalies were injected. Real data has no labels.