Anomaly Detection — Isolation Forest & LOF

import numpy as np
import pandas as pd
import matplotlib.pyplot as plt
from sklearn.ensemble import IsolationForest
from sklearn.neighbors import LocalOutlierFactor
from sklearn.preprocessing import StandardScaler
from sklearn.metrics import classification_report, roc_auc_score

np.random.seed(42)

# SIMULATE SENSOR DATA WITH ANOMALIES
n_normal = 500
n_anomaly = 25

# Normal operational data
normal_data = np.random.multivariate_normal([0, 0], [[1, 0.5], [0.5, 1]], n_normal)
# Anomalies: equipment failures (far from normal cluster)
anomaly_data = np.random.uniform(-5, 5, (n_anomaly, 2))
anomaly_data = anomaly_data[np.linalg.norm(anomaly_data, axis=1) > 3][:n_anomaly]

X = np.vstack([normal_data, anomaly_data[:n_anomaly]])
y_true = np.array([1] * n_normal + [-1] * n_anomaly)  # 1=normal, -1=anomaly

scaler = StandardScaler()
X_sc = scaler.fit_transform(X)

# ISOLATION FOREST
iso_forest = IsolationForest(n_estimators=200, contamination=0.05, random_state=42)
y_if = iso_forest.fit_predict(X_sc)           # 1=normal, -1=anomaly
scores_if = -iso_forest.score_samples(X_sc)   # higher = more anomalous

# LOCAL OUTLIER FACTOR
lof = LocalOutlierFactor(n_neighbors=20, contamination=0.05)
y_lof = lof.fit_predict(X_sc)                 # 1=normal, -1=anomaly
scores_lof = -lof.negative_outlier_factor_    # higher = more anomalous

# EVALUATE (we have ground truth here, but in real unsupervised -- you don't)
print("Isolation Forest:")
print(classification_report(y_true, y_if, labels=[-1, 1], target_names=["Anomaly", "Normal"]))

print("Local Outlier Factor:")
print(classification_report(y_true, y_lof, labels=[-1, 1], target_names=["Anomaly", "Normal"]))

auc_if  = roc_auc_score(y_true == -1, scores_if)
auc_lof = roc_auc_score(y_true == -1, scores_lof)
print(f"Isolation Forest AUC: {auc_if:.4f}")
print(f"LOF AUC:              {auc_lof:.4f}")

# VISUALIZE
fig, axes = plt.subplots(1, 3, figsize=(18, 5))

for ax, (preds, title) in zip(axes, [
    (y_true,  "Ground Truth"),
    (y_if,    "Isolation Forest"),
    (y_lof,   "Local Outlier Factor"),
]):
    colors = ["tomato" if p == -1 else "steelblue" for p in preds]
    ax.scatter(X[:, 0], X[:, 1], c=colors, s=30, alpha=0.7)
    ax.set_title(title)
    n_anom = (preds == -1).sum()
    ax.set_xlabel(f"{n_anom} anomalies detected")

plt.tight_layout()
plt.savefig("anomaly_detection.png", dpi=100, bbox_inches="tight")
plt.show()

# CHOOSING ALGORITHM
algo_guide = {
    "Isolation Forest":  "Best for large datasets (>10k rows); low contamination (fraud, defects)",
    "LOF":               "Better for local density anomalies; smaller datasets (<10k); no predict() with new data",
    "One-Class SVM":     "High-dimensional data; can be slow on large datasets",
    "AutoEncoder (DL)":  "Complex high-dim data (images, text); when normal patterns are intricate",
}
print("\nAnomaly Detection Algorithm Guide:")
for algo, use_case in algo_guide.items():
    print(f"  {algo:20s}: {use_case}")