Detecting anomalies and outliers in a series
Today let's look at a real series of daily counts and find exactly where it went wrong, in three different ways that each need their own kind of check.
A city runs a bike-share program. Every day for 120 days, somebody counted how many rides were completed that day. Here is the whole series.
Look closely at the chart. Something is off in three separate stretches of it, each in a different way.
Three different questions people call anomaly detection
People use the word "anomaly" (also called an outlier) for a lot of different things. But "a part of the series that does not behave the way the rest of it does" can mean three genuinely different situations, and a check built for one of them can walk right past the other two.
A point anomaly is a single observation that sits far from its own neighbours, obvious just by looking at the points right next to it. Day 46, a Thursday, had 1500 rides, while day 45 had 787 and day 47 had 811. 1500 is nowhere near either neighbour, so this one jumps out on sight alone.
A contextual anomaly is an observation that looks completely ordinary next to its neighbours, but is wrong once you bring in the context it should actually be judged against. Day 50, a Monday, had 545 rides. Its neighbours, day 49 and day 51, had 547 and 858. 545 sits right next to 547, so a check that only compares neighbours would wave it straight through. But Mondays on this program normally run far higher than 545, so judged against what a Monday looks like, it is wrong.
A collective anomaly is a stretch where no single day is extreme by itself, but the stretch as a whole breaks the pattern. Days 99 to 103, a Monday through Friday, ran 605, 605, 621, 610 and 620 rides. Each of those days sits close to its own neighbours, so none of them look like a point anomaly on that test alone. But compare this five-day stretch to any other working week on the chart above: every other week runs noticeably higher, and here all five days dropped together.
The chart below marks all three on the same series.
One single rule will not catch all three, because each one is wrong in a different way: alone, against its own context, or as a group.