Pick a series and two methods, set an alert budget, and watch which alerts each method raises on the same data. Some series are household power readings with injected incidents; others are server metrics whose anomalies were labelled by people. Every alert can be checked against a known label.
Independent study on public data. This page is an explorer: the counts show what happens on one sample at the settings you choose, not benchmark results. It runs entirely in your browser from precomputed scores and makes no claim about any other system or deployment.
Fewer alertsMore alerts
Alert on any flagged pointWait for more in a row
Left
Right
Labelled incident
Alert that overlaps an incident (true alert)
Alert with no incident (false alert)
Incidents in this window
Incident
When
Left
Right
How it works
Data. Two public sources. Household electricity readings (hourly, 120-day windows) with incidents injected by a seeded generator: spikes, level shifts, drifts, stuck values and bursts of missing values. And server metrics from the Server Machine Dataset (five-minute averages) whose anomaly intervals were labelled by operations experts. The first part of each series is used to fit and calibrate; only the later test window is shown here.
Scores. Each point gets an anomaly score from Python code in this repository, using only past data. Methods include a global z-score (the baseline), rolling median and MAD, a seasonal residual, an EWMA control chart, a robust STL residual, Isolation Forest, local outlier factor, a one-class SVM, PCA reconstruction error, a small autoencoder and a voting ensemble. For server data the score is computed across all metrics of the machine, while the chart shows one of them.
Alert budget. The slider sets how many alerts per day you are willing to receive. For each method the threshold is the lowest one that keeps the alert rate on the calibration window within that budget, so both panels are compared at the same alert load on history, and no labels are used.
Persistence. With a value above 1, an alert is raised only after that many consecutive flagged points. This removes isolated blips, but it delays alerts and can miss short incidents such as spikes.
Data-quality rules. Optional checks for missing values, values outside the usual range and values stuck at the same reading. They are added to each method's flags and their alerts count against the budget. A threshold that cannot meet the budget because of the rules alone makes the method silent.
Reading the numbers. An alert is a run of flagged points. It is a true alert if it overlaps a labelled incident and a false alert otherwise. An incident counts as caught if at least one alert falls inside it, and the delay is the time from the start of the incident to the first flagged point. Natural events that nobody labelled count as false alerts.
Evaluated results across many series and seeds, with methods and limitations, are in the repository README, including the cases where no detector beats a plain z-score. This study makes no claim about any other system or deployment.