timeSeriesRrcforestAD
Create a machine learning robust random cut forest anomaly detector model for time series data
Since R2026a
Syntax
Description
Add-On Required: This feature requires the Time Series Anomaly Detection for MATLAB add-on.
timeSeriesRrcforestAD creates an anomaly detector based on
the machine learning Robust Random Cut Forest algorithm. This algorithm
is detects anomalies by evaluating the changes in model complexity (known as
collusive displacement) introduced by the data.
Similar to the isolation forest algorithm, the robust random cut forest algorithm builds an ensemble of trees. The two algorithms differ in how they choose a split variable in trees and how they define anomaly scores.
For more information on the model that timeSeriesRrcforestAD creates,
see TimeSeriesRRCForestDetector.
detector = timeSeriesRrcforestAD(numChannels)TimeSeriesRRCForestDetector model for time series data with
numChannels input channels.
detector = timeSeriesRrcforestAD(
sets additional options using one or more name-value arguments.numChannels,Name=Value)
For example, detector = timeSeriesRrcforestAD(3,NumLearners=120)
creates a robust random cut forest with three input channels and 120 trees.
detector = timeSeriesRrcforestAD(3,DetectionWindowLength=20) creates a
detector model with a detection window length of 20.
Examples
Load the file sineWaveAnomalyData.mat, which contains two sets of synthetic 3-channel sinusoidal signals.
sineWaveNormal contains 10 sinusoids of stable frequency and amplitude. Each signal has a series of small-amplitude impact-like imperfections. The signals have different lengths and initial phases. sineWaveAbnormal contains 3 sinusoids that contain the same normal data as sineWaveNormal, but that also include anomalous data.
load sineWaveAnomalyData.mat sineWaveNormal sineWaveAbnormal
Plot input signals
Plot all 3 channels of the first three anomalous signals.
s1 = 3; tiledlayout("vertical") ax = zeros(s1,1); for kj = 1:s1 ax(kj) = nexttile; plot(sineWaveAbnormal{kj}) title("Anomalous Signals") end
sineWaveAbnormal contains three signals, all of the same length. Each signal in the set has one or more anomalies.
All channels of the first signal have an abrupt change in frequency that lasts for a finite time.
The second signal has a finite-duration amplitude change in one of its channels.
The third signal has spikes at random times in all channels.
Create Detector
Use the timeSeriesRrcforestAD detector to create a robust random cut forest detector with 3 channels and default options.
detector_tsrrcf = timeSeriesRrcforestAD(3)
detector_tsrrcf =
TimeSeriesRRCForestDetector with properties:
NumLearners: 100
NumObservationsPerLearner: []
CollusiveDisplacement: "maximal"
NumChannels: 3
IsTrained: 0
WindowLength: 10
TrainingStride: 1
DetectionStride: 10
Threshold: []
ThresholdMethod: "kSigma"
ThresholdParameter: 3
ThresholdFunction: []
Normalization: "zscore"
FeatureExtraction: 1
Train Detector
Train the detector using the normal data.
detector_tsrrcf = train(detector_tsrrcf,sineWaveNormal);
View the threshold that train computes and saves within detector_tsif. This computed value is influenced by random factors, such as which subsets of the data are used for training, and can change somewhat for different training sessions and different machines.
thresh = detector_tsrrcf.Threshold
thresh = 13.9436
Plot Anomaly Scores
Plot the histogram of the anomaly scores for the normal data. Each score is calculated over a single detection window. The threshold, plotted as a vertical line, does not always completely bound the scores.
plotHistogram(detector_tsrrcf,sineWaveNormal);
Use Detector to Identify Anomalies
Use the detect function to determine the anomaly scores for the anomalous data. Then, plot the anomaly scores.
results = detect(detector_tsrrcf, sineWaveAbnormal);
results is a cell array that contains three tables, one table for each signal. Each cell table contains three variables: WindowLabel, WindowAnomalyScore, and WindowStartIndices.
View the contents of the six rows between 32 and and 37 rows of the third table.
results_table3 = results{3};
results_t3_rows32to37 = results_table3(32:37,:)results_t3_rows32to37=6×3 table
Labels AnomalyScores StartIndices
______ _____________ ____________
false 4.3742 311
false 3.9586 321
true 47.502 331
false 4.4312 341
false 4.1574 351
false 5.0923 361
Plot Anomaly Score Distributions
Plot a histogram that shows the anomaly scores for both sets of data together, along with the threshold, for comparison.
plotHistogram(detector_tsrrcf,sineWaveNormal,sineWaveAbnormal)
The histogram uses different colors for the normal (Data 1) and anomalous (Data 2) data. Both types of data appear to the left of the threshold. To the right of threshold, Data 2 is prevalent.
Plot Detected Anomalies
Plot the detected anomalies of the third abnormal signal set.
plot(detector_tsrrcf,sineWaveAbnormal{3})
The top plot shows an overlay of red where the anomalies occur. The bottom plot shows how effective the threshold is at dividing the normal from the abnormal scores for Signal set 3.
Input Arguments
Name-Value Arguments
Output Arguments
Version History
Introduced in R2026a
See Also
train | detect | plot | plotHistogram | updateDetector
