Anomaly detector (rolling z-score)
Paste a time series and pick a window length and a threshold. Each point is compared with the mean and standard deviation (or median and MAD) of the w points before it; points beyond the threshold are flagged, in a band chart and in a table.
One column, or date + value (the first row may be a header). You can copy from Excel or upload a CSV file; decimal comma and point are detected automatically. If values are missing, delete the row or fill it in.
The data is read and calculated in your browser; it is not sent anywhere.
The number of preceding points each point is compared with (3–500). A short window adapts quickly to change but is noisy.
A point is flagged when |z| exceeds this value. 3 is common for classic z, 3.5 for robust z.
Let us set up together a monitoring and alerting scheme that catches abnormal behaviour in your data in real time.
Request a call01
How to use
A
Paste the time series or upload a CSV (one column or date + value); you can also try the sample data.
B
Choose the window length and the threshold; tick the robust (MAD) z method for a result that resists outliers.
C
Inspect the flagged points in the band chart and the table, together with the expected number of false alarms; read the warnings.
02
How does the rolling z-score work?
For each point the w points before it form a reference window: the mean m and standard deviation s are calculated, and z = (x − m) / s says how many standard deviations the point lies from the window. If |z| exceeds the threshold k the point is flagged. The point does not enter its own window, so an extreme value cannot inflate its own mean and std and hide itself.
The first w points have no window and are not calculated. A short window adapts quickly to change but its mean and std are noisy; a long one is stable but adapts slowly.
03
Classic z or robust (MAD) z?
Classic z relies on the mean and standard deviation, and both are sensitive to outliers. If the window contains an earlier anomaly the std inflates and later anomalies can stay under the threshold (masking). Robust z uses the median and MAD (median absolute deviation), which are almost unaffected by outliers. The factor 0.6745 brings the MAD to the scale of the standard deviation under a normal distribution.
A threshold of 3.5 for robust z is the common value recommended by Iglewicz and Hoaglin. If the window values are all identical the MAD is 0; every point deviating from the centre is then flagged.
04
False alarms and limitations
Even if the data is pure normal noise, some points will exceed the threshold k: at k = 3 the probability is about 0.27%, i.e. on average 2.7 false alarms per 1,000 points. The tool shows this as an expected count; if the actual count is far higher there are real anomalies. With a small window the rate is higher still.
The biggest limitation is trend and seasonality: in a sensor series with a daily cycle every morning and evening peak looks like an "anomaly". For such series remove the trend and the seasonal component first and look at the residual.
FAQ
- How should I choose the window length?
- Long enough to cover several cycles of normal behaviour, short enough to adapt to trend and level changes. 24–168 for hourly data and 14–60 for daily data are common starting points; at least 20–30 points keep the mean and std stable.
- Threshold 3 or 3.5?
- 3 for classic z and 3.5 for robust z are common starting points. Raising the threshold reduces false alarms but may miss real anomalies. Tune it by looking at the expected number of false alarms and thinking about the business cost.
- My series has a trend or seasonality; can I still use it?
- The results become unreliable. With a trend the window mean always lags behind and produces a constant offset; with seasonality the cycle peaks count as anomalies. Remove trend and seasonality first and feed the residual to this tool.
- Why does the window not include the point itself?
- An extreme value inflates the mean and std of its own window and makes itself look normal. Looking only at earlier points also mimics real-time use: a new value is judged against the past.
- Why are several consecutive anomalies sometimes missed?
- The first anomaly enters the windows of later points and inflates the mean or std (masking). Robust z reduces this effect; still, a long level shift becomes normal after a while.
- Is a flagged point a definite fault?
- No. It means statistically unusual; the cause may be a real event, a measurement error or just a rare normal value. Verify with domain knowledge and neighbouring data.
Catch the anomaly before the failure
Let us design together a monitoring scheme with few false alarms that catches abnormal behaviour in your sensor, SCADA or production data in real time.