The leader track π€ Β· for PMs, product & business leaders Β· 6 x 45 min Β· no code, ever
Thinking mode: what an anomaly really is, the kinds you will meet, the ladder of methods and when each fits, who on the team does what, and why measuring detection is a trap for the unwary - each session ends with the questions to ask your team.
Why detect anomalies
Where detection pays off - fraud, outages, quality, security - and the real trade-off: the cost of a miss versus the cost of a false alarm.
π Leader 2 Β· easyTypes of anomalies
Point, contextual, and collective - the three shapes an anomaly takes, and why the type decides which detector can even see it, with a visual for each.
πͺ Leader 3 Β· mediumThe methods, without math
The ladder in plain English: statistical to machine learning to deep - and the supervised-versus-unsupervised choice that shapes everything.
π₯ Leader 4 Β· mediumThe team + the pipeline (R&R)
Who does what: the analyst labelling and baselining, the data scientist building, engineering streaming it, on-call responding, and monitoring the detector.
π― Leader 5 Β· decidingMeasuring detection
Precision and recall, why accuracy lies on rare events, and the real enemy: alert fatigue, the reason most detection systems get muted.
π§ Leader 6 Β· decidingStrategy & pitfalls
Setting thresholds, concept drift, keeping a human in the loop, and the big one: when NOT to auto-flag at all.
The builder track π οΈ Β· for analysts, data scientists & engineers Β· 10 x 45 min Β· Python + a notebook
One running series, Lumen's daily web sessions with four hidden anomalies, threaded through the demos: you implement each family of detector in real Python and follow one detection from the analyst's first plot to a monitored, alerting production system.
Anomaly foundations
The labelled Lumen series, the three anomaly types, the base-rate problem that makes accuracy lie, and the z-score baseline every detector must beat.
π Builder 2 Β· easyStatistical detectors
Z-score and the three-sigma rule, IQR and Tukey fences, and robust MAD - and why the robust versions survive their own outliers.
γ°οΈ Builder 3 Β· mediumRolling & seasonal detectors
Rolling mean and std, EWMA, and the STL-residual detector that finally catches the contextual anomaly - plus a live detector you drive.
πΈοΈ Builder 4 Β· mediumDistance & density
kNN distance to nearest neighbours, and the Local Outlier Factor - flagging points that sit in a sparser neighbourhood than their peers.
π² Builder 5 Β· hands-onIsolation Forest
Anomalies are few and different, so random splits isolate them fast - the elegant tree-based detector (Liu, Ting & Zhou 2008) in scikit-learn.
β Builder 6 Β· hands-onOne-class & covariance
Learn the shape of "normal" and flag departures: One-Class SVM and the Elliptic Envelope - the semi-supervised, normal-only approach.
π Builder 7 Β· hands-onTime-series anomalies
Change-point detection, CUSUM, and forecast-residual anomalies - detecting when the series shifts, tying straight back to the forecasting course.
π€ Builder 8 Β· hardestDeep anomaly detection
Autoencoder reconstruction error and LSTM autoencoders - where deep methods help and where they do not, surveyed and cited (Pang et al. 2021).
π Builder 9 Β· mediumEvaluation
Precision, recall, F1, and PR-AUC, point-adjustment for time series, threshold tuning, and handling brutal class imbalance - the honest scoreboard.
π¨ Builder 10 Β· hardestProductionizing & alerting
Streaming detection, alert routing and deduplication, the feedback loop from on-call, and monitoring the detector so it never quietly rots.
Choose your path πΊοΈ
Two doors, one course. Leaders get the concepts and the pipeline; builders implement every detector in Python - and both meet at the live detector.
The knowledge map π§
Both tracks at a glance - hover a session to spotlight its concepts, click any node to jump in.