Z-score, IQR и Isolation Forest против ground truth. IF — лучший F1 (50,4%), ловит аномалии суммы, ночных часов и частоты; Z-score точен, но осторожен.
Volta — Поиск аномалий
Ситуация
Фрод/аномалии — задача с сильным дисбалансом классов: нужно сравнить детекторы честно, против ground truth.
Задача
Мне нужно было сравнить детекторы аномалий в условиях сильного дисбаланса классов. От меня требовалось построить честное сравнение против ground truth.
Действия
Признаки: сумма, час, частота.
Z-score, IQR, Isolation Forest; precision/recall/F1 против truth.
Результат
Isolation Forest — лучший F1 (50,4% , 401 детекция).Z-score точен, но осторожен: precision 80,5% при recall 24,7% (123 детекции).IQR — компромисс, но уступает IF.
Рекомендации
IF — для широкого скрининга, Z-score — для высокоточных алертов.
Мониторить кластеры «ночные часы × крупная сумма».
Калибровать порог под допустимый уровень ложных срабатываний.
Документация
Аналитика Данные: github.com/NikitaBoyarkin/volta-banking — 22 projects; figures recomputed from the repo's own datasets (data/*.csv) via its analysis scripts. Funnel counts from data/volta_funnel_data.csv (10,000 users); A/B, retention, segmentation, churn, RFM, CLV, attribution, anomalies, spend, support, NPS, JTBD, unit economics, premium, KYC deep-dive, referral, assisted CAC, FX sourcing, premium offers, anchor CAC and dormant win-back follow the published project narrative (README + part pages).
Детекторы аномалий: precision / recall / F1 Сравнение трёх детекторов по метрикам против ground truth: Z-score, IQR и Isolation Forest. IF — лучший F1.
0 50 100 Z-score — Precision: 80.5 80.5 IQR — Precision: 50.7 50.7 Isolation Forest — Precision: 50.4 50.4 Z-score — Recall: 24.7 24.7 IQR — Recall: 28.7 28.7 Isolation Forest — Recall: 50.4 50.4 Z-score — F1: 37.8 37.8 IQR — F1: 36.6 36.6 Isolation Forest — F1: 50.4 50.4 Z-score IQR Isolation Forest Метод Метрика, % Precision Recall F1 Выводы Isolation Forest — лучший F1 (50.4%): ловит аномалии суммы, ночных часов и частоты (401 детекция). Z-score точен, но осторожен: precision 80.5% при recall 24.7% (123 детекции). Аномалии: час × сумма 380 транзакций (260 нормальных + 120 аномальных по ground truth) в координатах «час суток × сумма (log10 €)».
-1.68 8.32 18.32 0.33 1.33 2.33 3.33 Normal x=14, y=2.18 Normal x=18, y=0.87 Normal x=8, y=1.73 Normal x=20, y=1.81 Normal x=8, y=1.56 Normal x=15, y=2.52 Normal x=17, y=1.26 Normal x=12, y=2.18 Normal x=13, y=1.93 Normal x=17, y=1.5 Normal x=15, y=1.45 Normal x=9, y=1.38 Normal x=11, y=1.84 Normal x=14, y=1.34 Normal x=8, y=1.69 Normal x=20, y=1.11 Normal x=12, y=1.66 Normal x=16, y=2.44 Normal x=18, y=1 Normal x=13, y=1.71 Normal x=15, y=1.7 Normal x=18, y=1.39 Normal x=17, y=1.15 Normal x=20, y=0.99 Normal x=14, y=1.3 Normal x=13, y=1.72 Normal x=11, y=1.8 Normal x=10, y=2.42 Normal x=10, y=1.92 Normal x=12, y=2.43 Normal x=19, y=1.79 Normal x=16, y=1.18 Normal x=21, y=1.91 Normal x=17, y=1.29 Normal x=16, y=1.38 Normal x=11, y=1.99 Normal x=18, y=1.9 Normal x=20, y=1.35 Normal x=20, y=1.61 Normal x=15, y=1.54 Normal x=15, y=1.25 Normal x=15, y=1.54 Normal x=18, y=1.65 Normal x=9, y=1.63 Normal x=15, y=1.42 Normal x=19, y=1.19 Normal x=21, y=1.62 Normal x=11, y=1.56 Normal x=12, y=1.46 Normal x=10, y=1.14 Normal x=14, y=0.84 Normal x=20, y=1.58 Normal x=10, y=1.09 Normal x=17, y=1.42 Normal x=11, y=1.26 Normal x=21, y=1.78 Normal x=18, y=1.18 Normal x=16, y=1.63 Normal x=20, y=2.04 Normal x=13, y=2.09 Normal x=20, y=2.05 Normal x=17, y=1.67 Normal x=8, y=1.03 Normal x=16, y=1.97 Normal x=15, y=1.66 Normal x=19, y=1.53 Normal x=17, y=1.91 Normal x=18, y=1.67 Normal x=12, y=1.64 Normal x=17, y=1.39 Normal x=21, y=1.96 Normal x=20, y=1.22 Normal x=10, y=2.08 Normal x=18, y=1.61 Normal x=20, y=1.74 Normal x=9, y=1.91 Normal x=21, y=1.9 Normal x=17, y=1.29 Normal x=15, y=1.31 Normal x=14, y=1.6 Normal x=19, y=1.35 Normal x=21, y=1.52 Normal x=19, y=1.28 Normal x=13, y=1.34 Normal x=19, y=2.14 Normal x=19, y=1.62 Normal x=21, y=1.88 Normal x=15, y=1.1 Normal x=10, y=2.44 Normal x=13, y=1.91 Normal x=9, y=1.88 Normal x=16, y=1.24 Normal x=13, y=1.56 Normal x=21, y=1.75 Normal x=13, y=1.1 Normal x=8, y=1.73 Normal x=16, y=1.74 Normal x=17, y=1.35 Normal x=14, y=0.77 Normal x=15, y=1.76 Normal x=9, y=1.44 Normal x=13, y=1.56 Normal x=9, y=1.28 Normal x=18, y=2.19 Normal x=8, y=1.48 Normal x=13, y=1.48 Normal x=11, y=1.39 Normal x=19, y=2.03 Normal x=12, y=1.57 Normal x=20, y=1.57 Normal x=13, y=1.62 Normal x=16, y=1.26 Normal x=11, y=1.88 Normal x=16, y=1.74 Normal x=20, y=1.62 Normal x=21, y=1.24 Normal x=11, y=1.29 Normal x=16, y=1.51 Normal x=19, y=1.1 Normal x=21, y=1.41 Normal x=15, y=1.41 Normal x=12, y=2.28 Normal x=8, y=1.74 Normal x=9, y=1.51 Normal x=18, y=1.43 Normal x=9, y=1.29 Normal x=13, y=1.76 Normal x=13, y=1.2 Normal x=20, y=1.35 Normal x=13, y=0.96 Normal x=18, y=2.03 Normal x=11, y=1.72 Normal x=10, y=0.73 Normal x=19, y=1.59 Normal x=17, y=1.64 Normal x=13, y=2.14 Normal x=14, y=1.86 Normal x=8, y=1.83 Normal x=15, y=1.7 Normal x=17, y=0.94 Normal x=9, y=1.63 Normal x=16, y=1.24 Normal x=17, y=1.33 Normal x=8, y=1.52 Normal x=8, y=1.31 Normal x=18, y=2.2 Normal x=17, y=1.72 Normal x=12, y=1.18 Normal x=14, y=1.83 Normal x=21, y=1.36 Normal x=20, y=1.23 Normal x=19, y=1.91 Normal x=8, y=0.72 Normal x=11, y=1.61 Normal x=9, y=0.94 Normal x=8, y=1.75 Normal x=18, y=1.87 Normal x=11, y=1.25 Normal x=9, y=0.69 Normal x=21, y=1.59 Normal x=8, y=1.33 Normal x=11, y=1.47 Normal x=20, y=1.6 Normal x=20, y=2.28 Normal x=9, y=1.79 Normal x=21, y=1.76 Normal x=20, y=1.99 Normal x=19, y=1.98 Normal x=16, y=1.66 Normal x=9, y=1.03 Normal x=12, y=1.58 Normal x=12, y=1.97 Normal x=18, y=1.59 Normal x=10, y=1.62 Normal x=16, y=1.35 Normal x=16, y=0.98 Normal x=18, y=1.13 Normal x=9, y=1.78 Normal x=20, y=1.35 Normal x=13, y=1.77 Normal x=16, y=1.15 Normal x=20, y=1.2 Normal x=18, y=0.73 Normal x=11, y=2.04 Normal x=8, y=0.96 Normal x=8, y=1.26 Normal x=11, y=1.5 Normal x=8, y=2.09 Normal x=14, y=1.18 Normal x=13, y=1.58 Normal x=14, y=1.78 Normal x=12, y=1.55 Normal x=8, y=1.71 Normal x=10, y=1.04 Normal x=16, y=1.37 Normal x=12, y=1.92 Normal x=8, y=1.58 Normal x=11, y=0.68 Normal x=17, y=0.93 Normal x=18, y=2.32 Normal x=13, y=1.84 Normal x=8, y=2.62 Normal x=12, y=1.74 Normal x=13, y=1.85 Normal x=16, y=2.26 Normal x=12, y=0.86 Normal x=17, y=1.19 Normal x=14, y=1.71 Normal x=16, y=1.6 Normal x=13, y=1.63 Normal x=13, y=0.96 Normal x=17, y=1.98 Normal x=8, y=1.48 Normal x=8, y=1.32 Normal x=14, y=1.26 Normal x=14, y=1.46 Normal x=16, y=1.53 Normal x=20, y=1.54 Normal x=8, y=1.15 Normal x=13, y=1.98 Normal x=10, y=1.75 Normal x=8, y=1.69 Normal x=15, y=1.34 Normal x=9, y=1.28 Normal x=13, y=1.35 Normal x=17, y=1.23 Normal x=14, y=1.56 Normal x=15, y=1.56 Normal x=14, y=1.06 Normal x=18, y=0.72 Normal x=10, y=2.03 Normal x=15, y=1.63 Normal x=13, y=1.47 Normal x=13, y=1.85 Normal x=11, y=1.11 Normal x=19, y=1.82 Normal x=10, y=1.32 Normal x=15, y=1.7 Normal x=12, y=1.66 Normal x=8, y=1.57 Normal x=17, y=1.46 Normal x=16, y=1 Normal x=15, y=1.32 Normal x=8, y=1.84 Normal x=21, y=0.63 Normal x=14, y=1.59 Normal x=18, y=1.19 Normal x=12, y=1.54 Normal x=12, y=1.51 Normal x=12, y=2.12 Normal x=13, y=1.22 Normal x=14, y=1.68 Normal x=14, y=0.83 Normal x=8, y=1.82 Normal x=8, y=1.86 Normal x=12, y=1.54 Normal x=13, y=1.61 Normal x=14, y=1.11 Normal x=12, y=1.36 Normal x=11, y=1.73 Anomaly x=11, y=1.1 Anomaly x=0, y=1.81 Anomaly x=2, y=1.93 Anomaly x=1, y=1.82 Anomaly x=2, y=1.08 Anomaly x=0, y=1.39 Anomaly x=14, y=2.56 Anomaly x=3, y=1.33 Anomaly x=12, y=2.7 Anomaly x=0, y=1.79 Anomaly x=14, y=2.41 Anomaly x=0, y=1.21 Anomaly x=10, y=2.18 Anomaly x=21, y=1.41 Anomaly x=9, y=1.22 Anomaly x=0, y=2.09 Anomaly x=13, y=2.72 Anomaly x=18, y=3.05 Anomaly x=11, y=2.12 Anomaly x=16, y=1.32 Anomaly x=3, y=1.47 Anomaly x=3, y=1.65 Anomaly x=11, y=1.8 Anomaly x=15, y=0.84 Anomaly x=0, y=1.59 Anomaly x=2, y=1.9 Anomaly x=11, y=2.82 Anomaly x=18, y=2.37 Anomaly x=12, y=1.39 Anomaly x=3, y=0.87 Anomaly x=16, y=1.38 Anomaly x=11, y=1.19 Anomaly x=2, y=1.2 Anomaly x=19, y=1.78 Anomaly x=13, y=1.58 Anomaly x=0, y=1.89 Anomaly x=1, y=1.48 Anomaly x=18, y=3.51 Anomaly x=12, y=2.69 Anomaly x=13, y=1.69 Anomaly x=8, y=1.48 Anomaly x=2, y=1.36 Anomaly x=3, y=1.64 Anomaly x=0, y=0.79 Anomaly x=0, y=1.37 Anomaly x=17, y=3.23 Anomaly x=21, y=2.28 Anomaly x=10, y=1.56 Anomaly x=14, y=1.36 Anomaly x=2, y=1.34 Anomaly x=11, y=1.97 Anomaly x=15, y=2.93 Anomaly x=18, y=1.88 Anomaly x=18, y=2.59 Anomaly x=3, y=1.73 Anomaly x=13, y=1.78 Anomaly x=15, y=2.73 Anomaly x=11, y=3.5 Anomaly x=18, y=2.36 Anomaly x=8, y=2.87 Anomaly x=11, y=1.47 Anomaly x=0, y=1.34 Anomaly x=19, y=2.2 Anomaly x=8, y=2.68 Anomaly x=2, y=1.45 Anomaly x=17, y=2.79 Anomaly x=17, y=2.58 Anomaly x=3, y=1.24 Anomaly x=11, y=2.77 Anomaly x=1, y=1.46 Anomaly x=9, y=0.57 Anomaly x=16, y=1.38 Anomaly x=19, y=0.85 Anomaly x=19, y=2.75 Anomaly x=0, y=2.16 Anomaly x=12, y=1.32 Anomaly x=17, y=2.68 Anomaly x=8, y=1.8 Anomaly x=18, y=1.86 Anomaly x=12, y=2.6 Anomaly x=21, y=3.63 Anomaly x=18, y=1.76 Anomaly x=0, y=1.92 Anomaly x=0, y=1.44 Anomaly x=11, y=1.71 Anomaly x=8, y=1.42 Anomaly x=12, y=2.49 Anomaly x=17, y=2.78 Anomaly x=14, y=1.93 Anomaly x=0, y=1.59 Anomaly x=16, y=0.94 Anomaly x=15, y=1.57 Anomaly x=9, y=2.81 Anomaly x=19, y=0.96 Anomaly x=11, y=2.73 Anomaly x=10, y=2.99 Anomaly x=14, y=2.43 Anomaly x=21, y=3.22 Anomaly x=2, y=1.18 Anomaly x=13, y=2.02 Anomaly x=11, y=1.43 Anomaly x=19, y=1.73 Anomaly x=1, y=1.77 Anomaly x=10, y=2.36 Anomaly x=20, y=1.89 Anomaly x=18, y=2.26 Anomaly x=9, y=1.28 Anomaly x=18, y=2.68 Anomaly x=19, y=1.51 Anomaly x=18, y=2.66 Anomaly x=21, y=1.62 Anomaly x=12, y=1.36 Anomaly x=0, y=1.23 Anomaly x=19, y=1.25 Anomaly x=17, y=1.52 Anomaly x=20, y=1.2 Anomaly x=17, y=1.43 Anomaly x=10, y=2.15 Anomaly x=9, y=1.74 Anomaly x=8, y=2.62 Час суток sum (log10 €) Normal Anomaly Выводы Аномалии группируются ночью и на крупных суммах — Isolation Forest ловит 50,4% F1. Часть аномалий — «мелкие, но нетипичные по времени»: одной суммы мало, Isolation Forest делает 401 детекцию.