Sentinel — adaptive streaming anomaly detection
Utkrishta 2026 · Challenge 2 (Sentinel). Sentinel learns each series' normal behaviour from the stream itself, scores every new point with five cheap experts, calibrates each expert's tail with online extreme-value theory (with small-sample shape shrinkage), re-learns its baseline when the normal itself changes, and raises sparse, explained alarms. Every flag carries an anomaly score, a NORMAL/ANOMALOUS label and plain-English evidence.
| Event-F1 | Precision | Recall | False alarms | Latency (p50) |
|---|
| Sentinel | 0.594 | 0.632 | 0.560 | 39 | 61 µs / point |
| Temporal clustering (k-means) | 0.316 | 0.224 | 0.534 | 249 | 6 µs |
| Ensemble of all 6 baselines (mean) | 0.280 | 0.178 | 0.647 | 419 | 221 µs |
| Autoencoder (16-8-4-8-16) | 0.272 | 0.176 | 0.603 | 390 | 140 µs |
| Local Outlier Factor | 0.260 | 0.165 | 0.621 | 457 | 13 µs |
| Isolation Forest | 0.249 | 0.177 | 0.422 | 261 | 54 µs |
| One-Class SVM | 0.235 | 0.142 | 0.681 | 594 | 8 µs |
| Rolling z-score | 0.226 | 0.148 | 0.474 | 351 | 0.5 µs |
All 58 NAB series, 116 labelled windows. The baselines cover every model family in the problem statement (python scripts/run_baselines.py): each learns from the first 300 values of every series and was given its best global threshold (oracle-tuned); the ensemble combines the six standardised scores (mean beat max, so mean is reported); Sentinel uses one global configuration, chosen under a 15-run experiment budget (7 runs used, see docs/02). Sentinel is the best of all 8 methods: 1.9× the runner-up (temporal clustering) and 2.3× the best of the four standard methods. The leave-one-category-out score over the budgeted runs is also 0.594, because the same run wins for every held-out category; since the hypotheses were designed after seeing all labels, expect the hidden-test score to be somewhat lower (in phase 1 the gap was about 0.02).
Plain-language notes on the data, the EDA, every experiment and the two improvements are in docs/.
Submission at a glance
Team if/elif/else: Aarohi Gattewar, Phalak Mehta, Harshit Singh.
Quick start
pip install -r requirements.txt # Python 3.12
python predict.py # run on data/nab -> predictions/
streamlit run app.py # Python demo at http://localhost:8501
python -m http.server 8080 --directory web # web deck at http://localhost:8080, live demo at /demo/
Run on any other folder of CSVs (timestamp,value columns, any nesting):
python predict.py --data path/to/csvs --labels windows.json --out predictions
python predict.py --data path/to/csvs --no-labels # no ground truth
--labels takes NAB's combined_windows.json format: {"<relative csv path>": [[start, end], ...]}.
Outputs (predictions/)
| File | Contents |
|---|
predictions.csv | One row per point: series, timestamp, value, anomaly_score (0–1, >0.5 means past the threshold), score (−log₁₀ p), threshold, label (NORMAL/ANOMALOUS), expert, event_id, explanation |
events.json | One record per alarm: timestamp, value, score, threshold, the expert that fired, every expert's z-score and tail probability, and a sentence such as "The last 8 points form a pattern not seen before: the closest past match (1451 steps ago) differs by 4.95 per point." |
metrics.json | Event-F1, precision, recall and detection delay, overall and per category |
runtime.json | Per-point streaming latency (p50 / p99 / mean) and throughput |
How it works
value x_t ──► 5 streaming experts ──► EVT tail model per expert ──► fusion ──► CUSUM ──► alarm logic ──► label + evidence
(O(1) state each) p_e = P(score ≥ s) min p·E evidence cooldown,
accumulation hysteresis
- Warm-up (300 points): learn a robust baseline (median / MAD) for each expert. No alarms are raised. The warm-up is a fixed number of points, so it never needs to know the series length.
- Experts. Each one scores the new point before learning from it, so the system is strictly causal:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
