Detecting anomalies in time series data (server metrics, sensor readings, financial transactions over time) genuinely requires accounting for trends and seasonality — a naive fixed threshold alone misses an enormous amount of genuinely meaningful signal.
from statsmodels.tsa.seasonal import seasonal_decompose
import numpy as np
# Decompose a time series into trend, seasonal pattern, and residual noise
decomposition = seasonal_decompose(time_series_data, model='additive', period=24) # hourly seasonality
residuals = decomposition.resid.dropna()
threshold = 3 * residuals.std() # flag points that deviate significantly
# from the EXPECTED seasonal pattern,
# not just from a flat, static average
anomalies = residuals[np.abs(residuals) > threshold]
Why Naive Thresholds Genuinely Fail Here
Server traffic naturally, predictably rises during business hours and falls overnight — a fixed threshold calibrated during business hours would flag genuinely completely normal overnight traffic as a false anomaly. Decomposing the time series into trend, seasonality, and residual noise first lets you correctly flag deviations from the expected pattern at that specific point in time, rather than deviations from some meaningless, context-free flat average across the whole dataset.
Modern Deep Learning Approaches
LSTM-based and Transformer-based models can learn genuinely more complex temporal patterns than classical statistical decomposition alone — including multiple overlapping seasonalities (daily, weekly, and yearly patterns operating simultaneously) and genuinely subtle, gradual trend shifts — at the real cost of needing meaningfully more training data and being noticeably harder to interpret and debug than a comparatively simple statistical approach.