Use case · Anomaly detection
Autonomous AI anomaly detection, with thresholds you can trust.
Drop your sensor, transaction, log, or network data. OctOpus moves between forecast-residual, isolation, and reconstruction-error approaches — and validates the threshold on real holdout windows so you don't ship a detector that alerts on everything.
TL;DR. The hard part of anomaly detection isn't building the detector — it's setting the threshold. OctOpus picks the method per data shape (time-series → forecast-residual; tabular → unsupervised anomaly detectors; sparse labels → PU learning) and validates the operating threshold on a holdout slice with realistic anomaly density.
What OctOpus detects well
- Sensor and IoT — temperature, vibration, pressure, energy. Forecast-residual on the time series.
- Transactions — payments, claims, transfers. Isolation forest or supervised when fraud labels are present.
- Logs and metrics — error spikes, latency outliers, throughput drops.
- Network — connection patterns, traffic anomalies, intrusion candidates.
- Manufacturing — quality control, line monitoring, defect detection.
Methods the agent rotates through
| Data shape | Method | Threshold strategy |
|---|---|---|
| Time series, no labels | Forecast (tree-based lags · deep forecasting · foundation models) → residual z-score | Quantile of historical residuals on holdout window. |
| Tabular, no labels | Unsupervised anomaly detectors and reconstruction error | Quantile-based, validated against synthetic injection if needed. |
| Few labels | PU learning · weakly-supervised gradient boosting | Threshold tuned on the labeled positives via PR curve. |
| Many labels | Standard supervised classification (escalates to classification) | F-beta optimization on holdout. |
What you get back
- Anomaly score per row or per timestep.
- Recommended operating threshold with sensitivity/specificity at that point.
- Top contributing features per anomaly (when supervised).
- Distribution plot of normal vs anomalous scores so you can sanity-check the threshold.
- The training code the agent wrote, fully inspectable.
- A deployed scoring endpoint.