Skip to content

Models

ABERRANT ships multiple online detector families.

Isolation forest family

Imports:

from aberrant.model.iforest import (
    ASDIsolationForest,
    HalfSpaceTrees,
    MondrianForest,
    OnlineIsolationForest,
    RandomCutForest,
    StreamRandomHistogramForest,
    XStream,
)

Use these for general-purpose unsupervised streaming anomaly detection.

MondrianForest uses lambda_ as the Mondrian lifetime budget: - smaller lambda_ yields coarser partitions - larger lambda_ yields finer partitions

For evaluation on a stream, prefer scoring before learning each sample to avoid training on the point being evaluated.

Distance family

Imports:

from aberrant.model.distance import KNN, LocalOutlierFactor, SDOStream

KNN requires a similarity engine (for example FAISS):

from aberrant.model.distance import KNN
from aberrant.utils.similar.faiss_engine import FaissSimilaritySearchEngine

engine = FaissSimilaritySearchEngine(window_size=250, warm_up=50)
model = KNN(k=25, similarity_engine=engine)

SDOStream is a bounded-memory observer-based online detector:

from aberrant.model.distance import SDOStream

model = SDOStream(k=128, T=256.0, qv=0.3, x_neighbors=8, seed=42)
  • Returns a continuous non-negative anomaly score (distance-based).
  • Supports optional explicit time handling through time_key.
  • Uses fixed-size observer state (k) with exponential fading (T).

Sketch family

Imports:

from aberrant.model.sketch import MStream, RSHash

Use MStream and RSHash for bounded-memory sketch-based streaming detection.

  • Supports time_key for explicit bucketed time updates.
  • If time_key=None, it uses arrival order as the implicit time axis.
  • Returns a continuous non-negative anomaly score.

Graph family

Imports:

from aberrant.model.graph import ISCONNA, MIDAS

Use ISCONNA and MIDAS for dynamic edge streams where each sample encodes source and destination IDs (plus optional timestamp).

  • Uses bounded-memory count-min sketches.
  • Supports optional explicit timestamp handling via time_key.
  • Returns a continuous non-negative anomaly score.

SVM family

Imports:

from aberrant.model.svm import GADGETSVM, IncrementalOneClassSVMAdaptiveKernel

Use when margin-based decision boundaries are preferred.

Statistical family

Imports:

from aberrant.model.stat import (
    MovingAverage,
    MovingCorrelationCoefficient,
    MovingCovariance,
    MovingMahalanobisDistance,
)

Use for compact, interpretable change detectors.

Deep family

Imports:

from aberrant.model.deep import Autoencoder, KitNET
  • Autoencoder depends on torch (aberrant[dl]).
  • KitNET is an online ensemble of lightweight autoencoders with explicit warm-up phases (feature_map_grace, ad_grace).

Core utility models

from aberrant.model import NullModel, QuantileThreshold, RandomModel, ThresholdModel
  • ThresholdModel: static rule-based boundary detector
  • QuantileThreshold: adaptive threshold on a streaming score signal