Most real-world time series, sales figures, server load, sensor readings, follow a regular seasonal or cyclical rhythm layered with ordinary noise. Anomaly detection asks a narrower question than plain forecasting: which points deviate from that expected rhythm enough to actually warrant attention, as distinct from the normal ups and downs the series already shows?
Rolling statistics: a simple, adaptive approach
A common technique computes a rolling mean and standard deviation over a recent window of past observations, then flags the current point if it falls more than a set number of standard deviations from that rolling mean. Because the window constantly updates, this approach naturally adapts to slow trends and seasonal cycles instead of comparing every point against one fixed, stale baseline.
The two knobs that matter
Window size and sensitivity threshold control opposite failure modes. A wider window smooths out short-term noise but reacts more slowly to genuine changes in the underlying pattern, potentially missing anomalies that resolve before the window catches up. A lower sensitivity threshold catches more true anomalies but also more false alarms triggered by ordinary variation that was never actually anomalous.
Why fixed thresholds fail on seasonal data
Comparing every point against a single fixed average, ignoring seasonality entirely, causes normal cyclical peaks to be flagged constantly as false anomalies. A rolling, adaptive baseline avoids this by only comparing each point against what was recently normal for that part of the cycle.
Try it yourself
The Time Series Anomaly Detection Lab lets you tune window size and sensitivity against a synthetic seasonal series with injected anomalies, and see exactly how many true anomalies get caught versus how many false alarms get triggered.
🧪 Try it yourself: the Time Series Anomaly Detection Lab simulation lets you experiment with everything described above directly in your browser.