import numpy as np
import pandas as pd
from scipy import stats

np.random.seed(42)

# Simulate sensor temperature readings (°C) — mostly normal, a few anomalies
normal_readings = np.random.normal(loc=72.0, scale=3.0, size=500)
anomalies = np.array([110.0, -15.0, 145.0, 5.0])   # clearly wrong readings
data = np.concatenate([normal_readings, anomalies])
np.random.shuffle(data)

# Z-score method
z_scores = np.abs(stats.zscore(data))
threshold = 3.0
is_anomaly_z = z_scores > threshold

print(f"Total readings:     {len(data)}")
print(f"Flagged by Z-score: {is_anomaly_z.sum()}")
print(f"Z-score > 3 values: {data[is_anomaly_z]}")

# Output:
# Total readings:     504
# Flagged by Z-score: 4
# Z-score > 3 values: [110.   -15.   145.    5.]

import numpy as np
import pandas as pd

np.random.seed(42)

# Simulate daily transaction amounts
normal_transactions = np.random.lognormal(mean=3.5, sigma=0.8, size=1000)  # log-normal
fraud_transactions = np.array([8500.0, 12000.0, 9900.0, 7800.0])
transactions = np.concatenate([normal_transactions, fraud_transactions])

def iqr_anomaly_detector(data, multiplier=1.5):
    """Returns a boolean mask: True = anomaly."""
    Q1 = np.percentile(data, 25)
    Q3 = np.percentile(data, 75)
    IQR = Q3 - Q1
    lower_fence = Q1 - multiplier * IQR
    upper_fence = Q3 + multiplier * IQR
    return (data < lower_fence) | (data > upper_fence), lower_fence, upper_fence

mask, lower, upper = iqr_anomaly_detector(transactions, multiplier=1.5)
print(f"IQR fences: [{lower:.1f}, {upper:.1f}]")
print(f"Flagged: {mask.sum()} anomalies")
print(f"Flagged values (top 10 by magnitude):")
print(sorted(transactions[mask], reverse=True)[:10])

# IQR fences: [-19.9, 129.8]
# Flagged: 28 anomalies
# Flagged values include all 4 fraud transactions

import numpy as np
import pandas as pd
from sklearn.ensemble import IsolationForest
from sklearn.datasets import make_blobs
import matplotlib.pyplot as plt

np.random.seed(42)

# Create a dataset: two clusters of normal points + some anomalies
X_normal, _ = make_blobs(n_samples=300, centers=[[2, 2], [-2, -2]],
                          cluster_std=0.5, random_state=42)
X_anomaly = np.random.uniform(low=-6, high=6, size=(15, 2))
X = np.vstack([X_normal, X_anomaly])

# Isolation Forest
# contamination = expected fraction of anomalies in the dataset
# n_estimators = number of isolation trees (100 is usually enough)
iso_forest = IsolationForest(
    n_estimators=100,
    contamination=0.05,   # expect ~5% anomalies
    max_samples='auto',   # subsample size per tree (default: min(256, n_samples))
    random_state=42
)
iso_forest.fit(X)

# fit_predict: returns 1 for normal, -1 for anomaly
labels = iso_forest.fit_predict(X)
scores = iso_forest.score_samples(X)  # lower score = more anomalous

print(f"Total points:   {len(X)}")
print(f"Flagged as anomaly: {(labels == -1).sum()}")
print(f"Score range:    [{scores.min():.3f}, {scores.max():.3f}]")
print(f"\nMost anomalous 5 scores: {sorted(scores)[:5]}")
print(f"Most normal 5 scores:   {sorted(scores)[-5:]}")

# Visualize — highlight detected anomalies
normal_pts  = X[labels == 1]
anomaly_pts = X[labels == -1]
print(f"\nNormal cluster: {len(normal_pts)} points")
print(f"Anomalies detected: {len(anomaly_pts)} points")

# Using Isolation Forest on real-world-style tabular data
import numpy as np
import pandas as pd
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler

np.random.seed(42)
n = 5000

# Simulate network traffic features
df = pd.DataFrame({
    'bytes_sent':      np.random.exponential(scale=1500, size=n),
    'bytes_received':  np.random.exponential(scale=5000, size=n),
    'duration_ms':     np.random.gamma(shape=2, scale=200, size=n),
    'packets':         np.random.poisson(lam=15, size=n),
    'failed_logins':   np.random.poisson(lam=0.2, size=n),
})

# Inject 25 anomalous sessions (large data exfiltration)
anomaly_idx = np.random.choice(n, size=25, replace=False)
df.loc[anomaly_idx, 'bytes_sent'] *= 50
df.loc[anomaly_idx, 'failed_logins'] = np.random.randint(20, 50, size=25)

# Scale features before fitting
scaler = StandardScaler()
X_scaled = scaler.fit_transform(df)

iso = IsolationForest(n_estimators=100, contamination=0.005, random_state=42)
preds = iso.fit_predict(X_scaled)

flagged = df[preds == -1].copy()
print(f"Anomalies detected: {(preds == -1).sum()}")
print(f"\nFlagged sessions (avg stats):")
print(flagged[['bytes_sent', 'failed_logins']].describe().round(1))

import numpy as np
from sklearn.neighbors import LocalOutlierFactor
from sklearn.datasets import make_blobs

np.random.seed(42)

# Two clusters of very different densities — challenging for Isolation Forest
dense_cluster   = np.random.normal(loc=[0, 0], scale=0.3, size=(200, 2))
sparse_cluster  = np.random.normal(loc=[5, 5], scale=1.5, size=(100, 2))
# Anomalies: points far from both clusters
outliers = np.array([[10, 10], [-4, -4], [2, 7], [-1, 6], [8, 2]])

X = np.vstack([dense_cluster, sparse_cluster, outliers])

# LOF for anomaly detection in fit mode
lof = LocalOutlierFactor(
    n_neighbors=20,          # k: number of neighbors to use
    contamination=0.05,      # expected fraction of outliers
    metric='euclidean'
)
labels = lof.fit_predict(X)
scores = lof.negative_outlier_factor_   # more negative = more anomalous

print(f"Total points:      {len(X)}")
print(f"Flagged anomalies: {(labels == -1).sum()}")
print(f"\nLOF scores for injected outliers (lower = more anomalous):")
for i, pt in enumerate(outliers):
    idx = len(dense_cluster) + len(sparse_cluster) + i
    print(f"  Point {pt}: LOF score = {scores[idx]:.3f}")

# For predicting on NEW data (not seen during fit), use novelty=True
lof_novelty = LocalOutlierFactor(n_neighbors=20, novelty=True)
lof_novelty.fit(np.vstack([dense_cluster, sparse_cluster]))

# Now predict on unseen test points
new_points = np.array([[0.1, 0.2], [5, 5.1], [15, 15]])  # normal, normal, anomaly
new_labels = lof_novelty.predict(new_points)
new_scores = lof_novelty.score_samples(new_points)
for pt, lbl, sc in zip(new_points, new_labels, new_scores):
    status = "ANOMALY" if lbl == -1 else "normal"
    print(f"  {pt} → {status} (score: {sc:.3f})")

import numpy as np
from sklearn.svm import OneClassSVM
from sklearn.preprocessing import StandardScaler

np.random.seed(42)

# One-class SVM works best on small datasets — create a focused example
# Simulate normal operating parameters for a CNC machine
normal_data = np.random.multivariate_normal(
    mean=[100, 0.5, 60],          # spindle_speed, vibration_rms, temperature
    cov=[[100, 0, 0], [0, 0.01, 0], [0, 0, 25]],
    size=500
)

# Fault states — abnormal operating conditions
fault_data = np.array([
    [180, 2.1, 95],   # overspeed + high vibration + overheating
    [45, 1.8, 88],    # underspeed + vibration
    [110, 0.6, 105],  # normal speed, slightly elevated vibration, very hot
    [95, 3.5, 70],    # near-normal speed, extreme vibration
])

# Scale features (important for SVM!)
scaler = StandardScaler()
X_normal_scaled = scaler.fit_transform(normal_data)
X_fault_scaled  = scaler.transform(fault_data)

# One-Class SVM
# nu: upper bound on fraction of training errors AND
#     lower bound on fraction of support vectors
#     Think of it as approximately the expected anomaly fraction
# kernel='rbf': standard choice; gamma controls boundary tightness
ocsvm = OneClassSVM(kernel='rbf', nu=0.05, gamma='scale')
ocsvm.fit(X_normal_scaled)

# Predict on held-out normal data + faults
y_normal_pred = ocsvm.predict(X_normal_scaled[-50:])  # should be mostly +1
y_fault_pred  = ocsvm.predict(X_fault_scaled)         # should be -1

print(f"Normal data flagged as anomaly: {(y_normal_pred == -1).sum()}/50")
print(f"Fault data correctly flagged:   {(y_fault_pred == -1).sum()}/{len(fault_data)}")

# Decision scores: more negative = more anomalous
normal_scores = ocsvm.score_samples(X_normal_scaled)
fault_scores  = ocsvm.score_samples(X_fault_scaled)
print(f"\nNormal score range: [{normal_scores.min():.3f}, {normal_scores.max():.3f}]")
print(f"Fault score range:  [{fault_scores.min():.3f}, {fault_scores.max():.3f}]")

import numpy as np
from sklearn.covariance import EllipticEnvelope
from sklearn.preprocessing import StandardScaler

np.random.seed(42)

# Elliptic Envelope works well when data is roughly multivariate Gaussian
# Example: financial KPIs that tend to be jointly normally distributed
n_companies = 300
revenue_growth   = np.random.normal(loc=0.08, scale=0.05, size=n_companies)
profit_margin    = np.random.normal(loc=0.12, scale=0.04, size=n_companies)
# Inject correlation: high growth tends to come with some compression in margin
profit_margin += -0.3 * revenue_growth + np.random.normal(0, 0.01, size=n_companies)

X_financial = np.column_stack([revenue_growth, profit_margin])

# Inject 10 anomalous companies (implausible financials)
outlier_companies = np.array([
    [0.85, 0.60],  # insane growth + crazy margin (fraud?)
    [-0.50, 0.55], # massive revenue decline but huge margin (accounting manipulation?)
    [0.90, -0.30], # hypergrowth but deeply loss-making
])
X_all = np.vstack([X_financial, outlier_companies])

# Elliptic Envelope
envelope = EllipticEnvelope(
    contamination=0.03,    # expect ~3% outliers
    support_fraction=None, # auto-compute MCD support
    random_state=42
)
envelope.fit(X_all)
labels = envelope.predict(X_all)    # 1 = normal, -1 = anomaly
scores = envelope.score_samples(X_all)  # Mahalanobis distance-based score

print(f"Total companies: {len(X_all)}")
print(f"Flagged anomalies: {(labels == -1).sum()}")
print(f"\nInjected outlier predictions: {labels[-3:]}")   # Should all be -1
print(f"Outlier scores: {scores[-3:].round(3)}")

import numpy as np
from sklearn.ensemble import IsolationForest
from sklearn.metrics import (precision_score, recall_score, f1_score,
                              roc_auc_score, classification_report,
                              average_precision_score)
from sklearn.datasets import make_classification

np.random.seed(42)

# Simulate a labeled anomaly dataset (rare anomalies)
X, y_true = make_classification(
    n_samples=5000, n_features=15, n_informative=8,
    weights=[0.98, 0.02],   # 98% normal, 2% anomalous
    flip_y=0.01, random_state=42
)
# y_true: 0 = normal, 1 = anomaly
# Convert to sklearn anomaly convention: +1 = normal, -1 = anomaly
y_anomaly = np.where(y_true == 1, -1, 1)

# Fit Isolation Forest
iso = IsolationForest(
    n_estimators=100,
    contamination=0.02,  # match true contamination rate
    random_state=42
)
y_pred = iso.fit_predict(X)
scores = iso.score_samples(X)

# Convert back to binary for sklearn metrics (1 = anomaly class)
y_pred_binary = (y_pred == -1).astype(int)
y_true_binary = y_true   # 1 = anomaly

print("=== Anomaly Detector Evaluation ===")
print(classification_report(y_true_binary, y_pred_binary,
                             target_names=['Normal', 'Anomaly']))
print(f"AUC-ROC:              {roc_auc_score(y_true_binary, -scores):.4f}")
print(f"Average Precision:    {average_precision_score(y_true_binary, -scores):.4f}")
print()

# IMPORTANT: accuracy is meaningless — a dummy classifier predicting
# all-normal achieves 98% accuracy on this dataset!
from sklearn.dummy import DummyClassifier
dummy = DummyClassifier(strategy='most_frequent')
dummy.fit(X, y_true_binary)
print(f"Dummy (all-normal) accuracy: {dummy.score(X, y_true_binary):.4f}")
print(f"Isolation Forest accuracy:   {(y_pred_binary == y_true_binary).mean():.4f}")
print("← These are almost identical! Accuracy is useless here.")

import numpy as np
from sklearn.ensemble import IsolationForest
from sklearn.neighbors import LocalOutlierFactor
from sklearn.svm import OneClassSVM
from sklearn.covariance import EllipticEnvelope
from sklearn.preprocessing import StandardScaler
from sklearn.metrics import roc_auc_score

np.random.seed(42)

# Quick comparison of all four methods on the same dataset
X_normal = np.random.multivariate_normal([0, 0], [[1, 0.5], [0.5, 1]], size=400)
X_outlier = np.random.uniform(-4, 4, size=(20, 2))
X = np.vstack([X_normal, X_outlier])
y_true = np.concatenate([np.zeros(400), np.ones(20)])  # 1 = anomaly

scaler = StandardScaler()
X_scaled = scaler.fit_transform(X)

methods = {
    'Isolation Forest': IsolationForest(contamination=0.05, random_state=42),
    'LOF':              LocalOutlierFactor(n_neighbors=20, contamination=0.05),
    'One-Class SVM':    OneClassSVM(nu=0.05, kernel='rbf', gamma='scale'),
    'Elliptic Envelope': EllipticEnvelope(contamination=0.05, random_state=42),
}

print(f"{'Method':20s}  {'Flagged':>8}  {'AUC-ROC':>8}")
print("-" * 45)
for name, model in methods.items():
    if name == 'LOF':
        preds = model.fit_predict(X_scaled)
        scores = -model.negative_outlier_factor_
    else:
        model.fit(X_scaled)
        preds = model.predict(X_scaled)
        scores = -model.score_samples(X_scaled)
    flagged = (preds == -1).sum()
    auc = roc_auc_score(y_true, scores)
    print(f"{name:20s}  {flagged:>8}  {auc:>8.4f}")