detect

Detect anomalies in time series using trained detector model

Since R2025a

Syntax

detectionResults = detect(detector,data)

detectionResults = detect(___,Name=Value)

Description

detectionResults = detect(detector,data) detects subsequence anomalies in data using the trained anomaly detector detector and the subsequence length specified in the property detector.DetectionWindowLength. By default, the subsequences do not overlap.

detect calculates the anomaly scores, labels anomalies using the threshold value in the property detector.Threshold, and returns these labels and scores, as well as the window start indices, in detectionResults. A label of 1 indicates an anomaly and a label of 0 indicates no anomaly.

For an example of using detect as part of the detector development workflow, see Train and Test TCN Anomaly Detector.

detectionResults = detect(___,Name=Value) sets additional options using one or more Name=Value arguments. These options include execution-related specifications and the plotting of a histogram.

Input Arguments

detector — Trained anomaly detector

TcnDetector object | DeepantDetector object | UsadDetector object | VaelstmDetector object

Trained anomaly detector model, specified as a TcnDetector, DeepantDetector, UsadDetector, or VaelstmDetector object.

data — Time series data

matrix | timetable | cell array

Time series data to be evaluated for anomalies, specified as a matrix, a cell array, or a timetable.

When data contains m sets of signals, each of which contain n = detector.NumChannels channels, the possible formats are these:

• n-column matrix that consists of a single multichannel signal observation (m=1).

  A sufficiently long single observation can be as effective for training as multiple shorter observations.

• Cell array with m cells that each contain a matrix that has NumChannels columns.

• Timetable that contains a single multichannel signal observation, arranged in one of two possible ways.

  • The n channels are distributed in the columns of a matrix that the timetable contains in a single variable

  • The n channels are represented by n timetable variables that each contain a vector.

  In either case, the timetable must contain finite, increasing, and uniformly sampled time values.

Name-Value Arguments

Specify optional pairs of arguments as Name1=Value1,...,NameN=ValueN, where Name is the argument name and Value is the corresponding value. Name-value arguments must appear after other arguments, but the order of the pairs does not matter.

Example: detectResults = (detectortcn,data,ExecutionEnvironment="cpu") specifies that the software use the CPU to perform the detection, whether or not a GPU is available.

All Detectors

MiniBatchSize — Mini-batch size

128 (default) | positive integer scalar

Mini-batch size, specified as a positive integer scalar for network detection computations.

PlotHistogram — Option to plot a histogram

false (default) | true

Option to plot a histogram of the anomaly scores, specified as false (no histogram or true (plot histogram).

TCN, DeepAnt, and VAE-LSTM Detectors Only

ExecutionEnvironment — Execution environment

"auto" (default) | "gpu" | "cpu"

Execution environment that determines what hardware resources the software uses to run the network, specified as "auto", "gpu", or "cpu".

• "auto" — Use the GPU if it is available, or if not, the CPU.

• "gpu" — Use the GPU.

• "cpu" — Use the CPU.

Output Arguments

detectionResults — Detection information

table

Detection information for each window, returned as a table containing a column of tables, one table for each data channel. Each table within detectionResults contains the window anomaly labels, anomaly scores, and window start indices for the corresponding channel.

Version History

Introduced in R2025a