Skip to content

Sketch Models API

These classes use bounded streaming adaptations. Their method names do not claim procedure- or score-parity with the corresponding batch/window papers.

MStream

Python
MStream(rows: int = 2, buckets: int = 1024, alpha: float = 0.6, time_key: str | None = None, categorical_features: tuple[str, ...] = (), warm_up_buckets: int = 0, seed: int | None = None)

Bases: BaseModel

Bounded multi-aspect stream anomaly detector.

Numeric attributes use log10(1 + x) and online min-max normalization. Names in categorical_features must contain integer-like values. Scoring previews rollover, normalization, and insertion without mutating state.

Parameters:

Name Type Description Default
rows int

Number of independent hash rows for categorical attributes and complete-record counts.

 2
buckets int

Number of counters per numeric histogram or hash row.

 1024
alpha float

Factor in (0, 1] applied once to current-bucket counts when an observed time bucket advances.

 0.6
time_key str | None

Input field containing a non-decreasing integer-like time bucket. None assigns a new one-based bucket to every learned arrival. The field is excluded from modeled features.

 None
categorical_features tuple[str, ...]

Feature names treated as integer-like categorical identifiers. Every other feature is numeric and must be greater than -1 for the logarithmic transform.

 ()
warm_up_buckets int

Required integer bucket-index distance from the first learned bucket before scoring begins. With explicit time, skipped bucket numbers contribute to this distance.

 0
seed int | None

Seed for model-local categorical and record hash generation.

 None
References

Bhatia, S., Jain, A., Li, P., Kumar, R., & Hooi, B. (2021). MStream: Fast Anomaly Detection in Multi-Aspect Streams. https://doi.org/10.1145/3442381.3450023

n_samples_seen property

Python
n_samples_seen: int

Number of observed samples processed via learn_one.

reset

Python
reset() -> None

Reset learned state while keeping hyperparameters.

learn_one

Python
learn_one(x: dict[str, float]) -> None

Update model state with a single sample.

score_one

Python
score_one(x: dict[str, float]) -> float

Compute the candidate-inclusive anomaly score without mutation.

StreamingLODA

Python
StreamingLODA(n_projections: int = 100, n_bins: int = 32, sparsity: float | None = None, warm_up_samples: int = 256, decay: float = 1.0, time_key: str | None = None, pseudocount: float = 1.0, predict_threshold: float = 0.5, seed: int | None = None, eps: float = 1e-12)

Bases: BaseModel

Bounded streaming adaptation of LODA.

LODA projects each sample to multiple random one-dimensional views and maintains per-view streaming histograms. The anomaly score is the mean negative log-density across projections. It uses a fixed number of projections and fixed warm-up bin edges, so it is a bounded streaming adaptation rather than an exact reproduction of the paper's model-selection procedure.

Notes: - Scores are continuous and non-negative. - Scores are 0.0 until warm-up is complete. - Memory is bounded by fixed-size projection and histogram state. - Feature schema is fixed after the first learn_one call.

Parameters:

Name Type Description Default
n_projections int

Number of random one-dimensional projections and histograms.

 100
n_bins int

Fixed number of equal-width bins fitted per projection.

 32
sparsity float | None

Fraction of input features active in each projection, in (0, 1]. None uses min(1, 1 / sqrt(n_features)).

 None
warm_up_samples int

Number of projected learned samples used to fit the fixed histogram edges and initial counts.

 256
decay float

Factor in (0, 1] applied to all histogram counts before each post-warm-up learned insertion.

 1.0
time_key str | None

Event-time field to exclude from the feature vector. None uses one-based arrival order; explicit times must be finite and non-decreasing. Time deltas do not alter decay.

 None
pseudocount float

Positive additive smoothing count for each bin.

 1.0
predict_threshold float

Non-negative score boundary used by predict_one.

 0.5
seed int | None

Seed for model-local sparse projection generation.

 None
eps float

Positive numerical floor for bin widths and log-density scoring.

 1e-12
References

Pevny, T. (2016). Loda: Lightweight on-line detector of anomalies. Machine Learning, 102, 275-304. https://doi.org/10.1007/s10994-015-5521-0

n_samples_seen property

Python
n_samples_seen: int

Number of samples processed with learn_one.

reset

Python
reset() -> None

Reset learned state while keeping hyperparameters.

learn_one

Python
learn_one(x: dict[str, float]) -> None

Update detector state with one sample.

score_one

Python
score_one(x: dict[str, float]) -> float

Compute anomaly score for one sample.

predict_one

Python
predict_one(x: dict[str, float]) -> int

Return binary anomaly prediction using predict_threshold.

StreamingRSHash

Python
StreamingRSHash(components_num: int = 24, hash_num: int = 4, bins: int = 256, subspace_size: int | None = None, bin_width: float = 1.0, decay: float = 0.01, warm_up_samples: int = 64, time_key: str | None = None, seed: int | None = None)

Bases: BaseModel

Bounded-memory streaming adaptation of RS-Hash.

RS-Hash keeps an ensemble of randomized feature subspaces and hashes each sample into fixed-size count tables with exponential fading. Low hashed occupancy indicates potentially anomalous behavior. Online z-score normalization and exponential fading are streaming adaptations in this implementation and do not reproduce the paper's exact window procedure.

Notes: - Scores are continuous, non-negative, and bounded in [0, 1]. - Memory usage is bounded by components_num * hash_num * bins. - Feature schema is fixed after the first learn_one call.

Parameters:

Name Type Description Default
components_num int

Number of independently sampled feature subspaces.

 24
hash_num int

Number of independent hash tables per subspace.

 4
bins int

Number of counters in every hash table.

 256
subspace_size int | None

Features sampled without replacement per component. None uses ceil(sqrt(n_features)); an explicit value cannot exceed the established feature count.

 None
bin_width float

Positive quantization width in online-standardized feature coordinates.

 1.0
decay float

Non-negative exponential fading rate. Counts are scaled by exp(-decay * elapsed_time).

 0.01
warm_up_samples int

Number of learned samples required before scoring.

 64
time_key str | None

Event-time field to exclude from the feature vector. None uses one-based arrival order; explicit times must be finite and non-decreasing.

 None
seed int | None

Seed for model-local subspace, shift, and hash generation.

 None
References

Sathe, S., & Aggarwal, C. C. (2016). Subspace Outlier Detection in Linear Time with Randomized Hashing. IEEE ICDM. https://www.charuaggarwal.net/linearout.pdf

n_samples_seen property

Python
n_samples_seen: int

Number of samples processed with learn_one.

reset

Python
reset() -> None

Reset learned state while keeping hyperparameters.

learn_one

Python
learn_one(x: dict[str, float]) -> None

Update detector state with one sample.

score_one

Python
score_one(x: dict[str, float]) -> float

Compute anomaly score for one sample.