Anomaly Detection Tutorials

Learn time-series anomaly detection from z-scores to state-of-the-art deep models: runnable notebooks, honest evaluation, real-world case studies.

Why this repo

Toolboxes for anomaly detection exist. What is missing is a path: a sequence of tutorials that starts from methods you can compute by hand, builds up to the deep models used in production, and is honest about the part most material skips, which is how to evaluate a detector without fooling yourself.

Every notebook in this repo:

• runs top to bottom on CPU in minutes, seeded and reproducible,
• pairs every method with its failure modes, not just its wins,
• measures results with ground-truth labels where they exist, and says so clearly where they do not,
• uses one consistent, colorblind-safe visual language.

The curriculum

#	Notebook	Status
01	Foundations: z-scores, moving statistics, STL residuals	available
02	Classic ML: Isolation Forest, One-Class SVM, LOF	available
03	Autoencoders: reconstruction error as an anomaly signal	available
04	USAD: adversarially trained autoencoders (KDD 2020), measured honestly	available
05	Matrix Profile: anomaly detection without training	available
06	Forecasting-based detection: predict, then be surprised	available
07	Probabilistic reconstruction: VAEs, Donut, and what the likelihood buys	available
08	TadGAN: turning a GAN into a detector, and what the critic can and cannot see	available
09	Graph neural networks: learning which sensors watch each other	available
10	Transformers: when reconstruction learns to cheat	available
11	Self-supervised representations: detecting without reconstructing	available
12	Streaming detection: the Robust Random Cut Forest	available
13	Foundation models: zero-shot detection (Chronos/MOMENT, with a runnable stand-in)	available
14	Evaluation done right: the point-adjust trap and what to use instead	available
15	Case study: detecting silent regressions in LLM telemetry	planned

The numbering is the recommended reading order; each notebook still stands on its own.

Quick start

git clone https://github.com/JulienAu/anomaly-detection-tutorials.git
cd anomaly-detection-tutorials
uv venv && uv pip install -e ".[dev]"
uv run jupyter lab

Or open any notebook directly in Colab with the badge in the table above; the first cell installs what it needs.

The adtuto package in src/ holds what the notebooks share (plotting theme, datasets, windowing helpers) so each notebook stays focused on its method.

History

This repo started in 2016 as one of the early autoencoder anomaly detection tutorials and reached 190 stars in its first life. In 2026 it was rebuilt from scratch: same mission, ten years of hindsight, and a much higher bar for evaluation rigor.

License

MIT. If a notebook helps you, a star helps others find it.