Skip to content

Models

ABERRANT ships multiple online detector families.

Isolation forest family

Imports:

Python
from aberrant.model.iforest import (
    ASDIsolationForest,
    HalfSpaceTrees,
    MondrianForest,
    OnlineIsolationForest,
    RandomCutForest,
    StreamRandomHistogramForest,
    XStream,
)

Use these for general-purpose unsupervised streaming anomaly detection.

MondrianForest uses lambda_ as the Mondrian lifetime budget: - smaller lambda_ yields coarser partitions - larger lambda_ yields finer partitions

For evaluation on a stream, prefer scoring before learning each sample to avoid training on the point being evaluated.

Distance family

Imports:

Python
from aberrant.model.distance import KNN, LocalOutlierFactor, NETS, SDOStream, STARE

KNN requires a similarity engine (for example FAISS):

Python
from aberrant.model.distance import KNN
from aberrant.utils.similar.faiss_engine import FaissSimilaritySearchEngine

engine = FaissSimilaritySearchEngine(window_size=250, warm_up=50)
model = KNN(k=25, similarity_engine=engine)

LocalOutlierFactor is a bounded sliding-window local-density detector:

Python
from aberrant.model.distance import LocalOutlierFactor

model = LocalOutlierFactor(k=10, window_size=1000, distance="euclidean")
  • Returns a continuous LOF score, where values above 1 are more outlier-like.
  • Uses bounded-memory window state (window_size).

NETS is a bounded streaming detector using cell-level net-effect pruning:

Python
from aberrant.model.distance import NETS

model = NETS(
    k=30,
    radius=1.5,
    window_size=2048,
    slide_size=128,
    subspace_dim=3,
    seed=42,
)
  • Returns bounded scores in [0, 1].
  • Supports optional explicit time handling through time_key.
  • Uses bounded-memory full/subspace cell state over a sliding window.

SDOStream is a bounded-memory observer-based online detector:

Python
from aberrant.model.distance import SDOStream

model = SDOStream(k=128, T=256.0, qv=0.3, x_neighbors=8, seed=42)
  • Returns a continuous non-negative anomaly score (distance-based).
  • Supports optional explicit time handling through time_key.
  • Uses fixed-size observer state (k) with exponential fading (T).

STARE is a bounded sliding-window local outlier detector:

Python
from aberrant.model.distance import STARE

model = STARE(
    k=40,
    radius=1.5,
    window_size=2048,
    slide_size=128,
    skip_threshold=0.1,
)
  • Returns bounded scores in [0, 1].
  • Supports optional explicit time handling through time_key.
  • Uses bounded-memory sliding window state (window_size).

Sketch family

Imports:

Python
from aberrant.model.sketch import LODA, MStream, RSHash

Use LODA, MStream, and RSHash for bounded-memory sketch-based streaming detection.

LODA is a random-projection histogram detector:

Python
from aberrant.model.sketch import LODA

model = LODA(
    n_projections=64,
    n_bins=24,
    sparsity=0.3,
    warm_up_samples=256,
    decay=1.0,
    seed=42,
)
  • Sketch models support optional explicit time handling via time_key.
  • If time_key=None, it uses arrival order as the implicit time axis.
  • Returns a continuous non-negative anomaly score.

Graph family

Imports:

Python
from aberrant.model.graph import AnoEdgeL, ISCONNA, MIDAS, StreamSpot

Use AnoEdgeL, ISCONNA, MIDAS, and StreamSpot for dynamic edge streams where each sample encodes source and destination IDs (plus optional timestamp).

  • AnoEdgeL, ISCONNA, and MIDAS use bounded-memory sketch state.
  • Supports optional explicit timestamp handling via time_key.
  • Returns a continuous non-negative anomaly score.

AnoEdgeL scores edge novelty using local sketch-density context:

Python
from aberrant.model.graph import AnoEdgeL

model = AnoEdgeL(
    source_key="src",
    destination_key="dst",
    count_min_rows=128,
    count_min_cols=128,
    num_hashes=4,
    local_radius=1,
)

StreamSpot models graph-level structural change with bounded per-graph shingle sketches and online cluster summaries:

Python
from aberrant.model.graph import StreamSpot

model = StreamSpot(
    graph_key="graph",
    source_key="src",
    destination_key="dst",
    edge_type_key="etype",
    sketch_dim=256,
    shingle_size=2,
    num_clusters=8,
    max_graphs=256,
)

SVM family

Imports:

Python
from aberrant.model.svm import GADGETSVM, IncrementalOneClassSVMAdaptiveKernel

Use when margin-based decision boundaries are preferred.

Statistical family

Imports:

Python
from aberrant.model.stat import (
    MovingAverage,
    MovingCorrelationCoefficient,
    MovingCovariance,
    MovingMahalanobisDistance,
)

Use for compact, interpretable change detectors.

Deep family

Imports:

Python
from aberrant.model.deep import Autoencoder, KitNET
  • Autoencoder depends on torch (aberrant[dl]).
  • KitNET is an online ensemble of lightweight autoencoders with explicit warm-up phases (feature_map_grace, ad_grace).

Core utility models

Python
from aberrant.model import NullModel, QuantileThreshold, RandomModel, ThresholdModel
  • ThresholdModel: static rule-based boundary detector
  • QuantileThreshold: adaptive threshold on a streaming score signal