Introduction
Fraud, sensor faults, and unusual customer behavior rarely show up as an outlier in
just one variable — it's the combination that's suspicious. ConductAnomalyDetection
answers "which rows are jointly unlikely across several numeric dimensions at once?"
by computing a combined z-score-based probability across the columns you specify and
flagging the rows that fall in the tail. Reach for it when a single-variable outlier
check would miss the pattern — a transaction that isn't extreme in amount alone, but is
extreme in amount and frequency and average size together.
The function is particularly useful for:
- Fraud detection in financial transactions
- Quality control in manufacturing processes
- Network intrusion detection and cybersecurity monitoring
- Sensor fault detection in IoT and industrial systems
- Identifying outlier behavior in customer or user data
- Medical diagnosis and health monitoring systems
- Detecting unusual patterns in time series data
Parameters
| Parameter | Type | Default | Description |
|---|---|---|---|
dataframerequired | | — | A pandas DataFrame containing the data to analyze. Should include the numeric columns specified in list_of_columns_to_analyze; rows with missing values in these columns are excluded from detection. |
list_of_columns_to_analyzerequired | | — | List of column names (numeric variables) to use for anomaly detection. Z-scores are calculated for each column and combined to identify multivariate anomalies. |
anomaly_threshold | | 0.95 | Probability threshold above which observations are flagged as anomalies (0 to 1). Higher values are more sensitive; e.g., 0.95 flags the most extreme 5% of the distribution. |
plot_detection_summary | | True | If True, generates a seaborn pairplot showing relationships between all analyzed variables, with anomalies color-coded. |
summary_plot_size | | (20, 20) | Tuple specifying the (width, height) of the summary pairplot figure in inches. Only used if plot_detection_summary=True. |
column_name_for_anomaly_prob | | 'Anomaly Probability' | Name for the new column containing the calculated anomaly probability (values closer to 0 are more anomalous). |
column_name_for_anomaly_flag | | 'Anomaly Detected' | Name for the new binary column that flags detected anomalies (True/False) based on the threshold. |
Returns
The original DataFrame with two additional columns: {column_name_for_anomaly_prob}
(float, 0-1 anomaly probability) and {column_name_for_anomaly_flag} (boolean anomaly
flag). Rows with missing values in the analyzed columns have NaN for these new columns.
If plot_detection_summary=True, a pairplot is also displayed.
Example
from analysistoolbox.data_processing import ConductAnomalyDetection
import pandas as pd
# Detect fraudulent transactions using multiple features
transactions = pd.DataFrame({
'transaction_amount': [100, 150, 120, 5000, 130, 140, 110],
'transaction_count_24h': [2, 3, 2, 15, 3, 2, 1],
'avg_transaction_size': [50, 50, 60, 333, 43, 70, 110]
})
transactions = ConductAnomalyDetection(
transactions,
list_of_columns_to_analyze=['transaction_amount', 'transaction_count_24h', 'avg_transaction_size'],
plot_detection_summary=False
)
# Likely flags the row with the $5000 transaction as anomalous