Anomaly Detection Skill
Guide for training and using anomaly detection models in LlamaFarm.
When to Load
Load this skill when the user:
- Wants to detect anomalies or outliers in data
- Asks about anomaly detection backends or algorithms
- Needs to train an anomaly model
- Wants to score data for anomalies
- Asks about contamination rates or thresholds
- Needs to manage anomaly detection models
API Overview
| Endpoint |
Method |
Description |
/v1/ml/anomaly/fit |
POST |
Train a model on data |
/v1/ml/anomaly/score |
POST |
Score data points (anomaly likelihood) |
/v1/ml/anomaly/detect |
POST |
Detect anomalies (binary labels + scores) |
/v1/ml/anomaly/save |
POST |
Save a trained model |
/v1/ml/anomaly/load |
POST |
Load a previously saved model |
/v1/ml/anomaly/models |
GET |
List available trained models |
/v1/ml/anomaly/backends |
GET |
List available detection backends |
Backend Quick Reference
| Backend |
Speed |
Accuracy |
Best For |
iforest |
Fast |
High |
General purpose, tabular data |
ecod |
Very Fast |
Good |
High-dimensional data, streaming |
lof |
Medium |
High |
Cluster-based anomalies |
knn |
Medium |
High |
Local density anomalies |
ocsvm |
Medium |
High |
Well-separated anomalies |
copod |
Very Fast |
Good |
Multivariate data, fast screening |
hbos |
Very Fast |
Moderate |
Histogram-based, fast baseline |
loda |
Very Fast |
Moderate |
Lightweight, streaming-friendly |
cblof |
Medium |
High |
Cluster-based with labels |
mcd |
Medium |
High |
Gaussian-distributed data |
pca |
Fast |
Good |
Dimensionality reduction |
autoencoder |
Slow |
Very High |
Complex patterns, deep learning |
Decision Tree: Choosing a Backend
- Need speed above all? ->
ecod or hbos
- General tabular data? ->
iforest (best default)
- High-dimensional data? ->
ecod or pca
- Cluster-shaped anomalies? ->
lof or cblof
- Complex non-linear patterns? ->
autoencoder
- Need interpretability? ->
ecod or copod
- Streaming use case? ->
ecod, hbos, or loda
Quick Start
Train a model
curl -X POST http://localhost:14345/v1/ml/anomaly/fit \
-H "Content-Type: application/json" \
-d '{
"data": [[1.0, 2.0], [1.1, 2.1], [1.2, 1.9], [10.0, 10.0]],
"backend": "iforest",
"contamination": 0.1,
"normalization": "standardize"
}'
Detect anomalies
curl -X POST http://localhost:14345/v1/ml/anomaly/detect \
-H "Content-Type: application/json" \
-d '{
"model_name": "my_model",
"data": [[1.0, 2.0], [50.0, 50.0]]
}'
List models
curl http://localhost:14345/v1/ml/anomaly/models
Normalization Methods
| Method |
When to Use |
standardize |
Default -- centers data, works for most cases |
zscore |
When you need strict z-score scaling |
raw |
When data is already normalized or normalization would distort it |
Progressive Disclosure
For detailed guidance:
- backends.md - Per-backend algorithm details, parameters, and examples
- data-preparation.md - Normalization, encoding, handling mixed data types
- model-lifecycle.md - Saving, loading, versioning, managing models
- tuning.md - Contamination rates, thresholds, validation, A/B testing
1---2name: anomaly-detection3description: Batch anomaly detection with 12+ backends. Train models, score data, detect outliers using isolation forests, autoencoders, and more.4---56# Anomaly Detection Skill78Guide for training and using anomaly detection models in LlamaFarm.910## When to Load1112Load this skill when the user:13- Wants to detect anomalies or outliers in data14- Asks about anomaly detection backends or algorithms15- Needs to train an anomaly model16- Wants to score data for anomalies17- Asks about contamination rates or thresholds18- Needs to manage anomaly detection models1920## API Overview2122| Endpoint | Method | Description |23|----------|--------|-------------|24| `/v1/ml/anomaly/fit` | POST | Train a model on data |25| `/v1/ml/anomaly/score` | POST | Score data points (anomaly likelihood) |26| `/v1/ml/anomaly/detect` | POST | Detect anomalies (binary labels + scores) |27| `/v1/ml/anomaly/save` | POST | Save a trained model |28| `/v1/ml/anomaly/load` | POST | Load a previously saved model |29| `/v1/ml/anomaly/models` | GET | List available trained models |30| `/v1/ml/anomaly/backends` | GET | List available detection backends |3132## Backend Quick Reference3334| Backend | Speed | Accuracy | Best For |35|---------|-------|----------|----------|36| `iforest` | Fast | High | General purpose, tabular data |37| `ecod` | Very Fast | Good | High-dimensional data, streaming |38| `lof` | Medium | High | Cluster-based anomalies |39| `knn` | Medium | High | Local density anomalies |40| `ocsvm` | Medium | High | Well-separated anomalies |41| `copod` | Very Fast | Good | Multivariate data, fast screening |42| `hbos` | Very Fast | Moderate | Histogram-based, fast baseline |43| `loda` | Very Fast | Moderate | Lightweight, streaming-friendly |44| `cblof` | Medium | High | Cluster-based with labels |45| `mcd` | Medium | High | Gaussian-distributed data |46| `pca` | Fast | Good | Dimensionality reduction |47| `autoencoder` | Slow | Very High | Complex patterns, deep learning |4849## Decision Tree: Choosing a Backend50511. **Need speed above all?** -> `ecod` or `hbos`522. **General tabular data?** -> `iforest` (best default)533. **High-dimensional data?** -> `ecod` or `pca`544. **Cluster-shaped anomalies?** -> `lof` or `cblof`555. **Complex non-linear patterns?** -> `autoencoder`566. **Need interpretability?** -> `ecod` or `copod`577. **Streaming use case?** -> `ecod`, `hbos`, or `loda`5859## Quick Start6061### Train a model6263```bash64curl -X POST http://localhost:14345/v1/ml/anomaly/fit \65 -H "Content-Type: application/json" \66 -d '{67 "data": [[1.0, 2.0], [1.1, 2.1], [1.2, 1.9], [10.0, 10.0]],68 "backend": "iforest",69 "contamination": 0.1,70 "normalization": "standardize"71 }'72```7374### Detect anomalies7576```bash77curl -X POST http://localhost:14345/v1/ml/anomaly/detect \78 -H "Content-Type: application/json" \79 -d '{80 "model_name": "my_model",81 "data": [[1.0, 2.0], [50.0, 50.0]]82 }'83```8485### List models8687```bash88curl http://localhost:14345/v1/ml/anomaly/models89```9091## Normalization Methods9293| Method | When to Use |94|--------|------------|95| `standardize` | Default -- centers data, works for most cases |96| `zscore` | When you need strict z-score scaling |97| `raw` | When data is already normalized or normalization would distort it |9899## Progressive Disclosure100101For detailed guidance:102- **backends.md** - Per-backend algorithm details, parameters, and examples103- **data-preparation.md** - Normalization, encoding, handling mixed data types104- **model-lifecycle.md** - Saving, loading, versioning, managing models105- **tuning.md** - Contamination rates, thresholds, validation, A/B testing