Assemble a chronological dataset
Ensure stable timestamps, align multiple variables to the same clock, and handle missing values explicitly before feature creation.
Detect multivariate anomalies. Decide which points are anomalous.
Multivariate anomaly detection seeks behaviour that deviates from normal patterns across several related time series or features. Important practical issues include feature engineering (lags, rolling statistics, calendar effects), robust handling of missing values, walk-forward validation and alert thresholds calibrated to operational costs.
Learning concept · Not a validated service
Multivariate anomaly detection seeks behaviour that deviates from normal patterns across several related time series or features. Important practical issues include feature engineering (lags, rolling statistics, calendar effects), robust handling of missing values, walk-forward validation and alert thresholds calibrated to operational costs.
A proposed application: monitor multiple sensor streams (temperature, vibration, current) and raise human-review alerts when a combined anomaly score exceeds a threshold. The supplied starter does not implement anomaly scoring or alerting.
Ensure stable timestamps, align multiple variables to the same clock, and handle missing values explicitly before feature creation.
Add lags, rolling means, and calendar indicators so the model can learn normal temporal patterns and correlations across variables.
Train a reproducible baseline (for example a regression ensemble) and obtain residuals or prediction intervals to derive anomaly scores.
Use walk-forward validation, compute precision/recall for labelled anomalies if available, and inspect false positives to adjust thresholds.
The supplied starter creates a single synthetic univariate time series with trend, seasonality and noise, engineers lag and rolling features, fits a RandomForestRegressor to forecast future values, and prints MAE and a small forecast table. It does not compute anomaly scores, thresholds, nor detect or label anomalies, and it uses a single generated series rather than multiple correlated variables.
for lag in [1, 7, 14]:
series[f"lag_{lag}"] = series["value"].shift(lag)
series["rolling_7"] = series["value"].shift(1).rolling(7).mean()
series = series.dropna()
feature_cols = ["lag_1", "lag_7", "lag_14", "rolling_7"]
train = series.iloc[:-30]
test = series.iloc[-30:]
model = RandomForestRegressor(n_estimators=300, random_state=42)
model.fit(train[feature_cols], train["value"])
forecast = model.predict(test[feature_cols])The code is a forecasting baseline on one synthetic series and lacks any anomaly-detection component: there are no anomaly labels, no multivariate sensor streams, no residual or density-based anomaly scoring and no alert threshold or evaluation of detection performance.
Proposed extension: replace the synthetic series with two or more real sensors, compute model residuals or use an autoencoder/density estimator on multivariate features, and convert large residuals into alerts that are reviewed by an operator.
This is a potential application pathway, not a delivered product. The supplied starter does not implement this service or validate it with real users.
Networkers Home runs this topic inside its AI Engineer Course, with placement support and hands-on labs.