Optimizing Z-score

Learn how to optimize the Z-score in a way that anomaly detection becomes easier.

So far, we used one standard deviation from the mean or a z-score of ±1 to identify anomalies. Changing the z-score threshold can affect our results. For example, let’s see what anomalies we identify when the z-score is greater than 0.5 and when it is greater than 3:

WITH series AS (
   SELECT *
   FROM unnest(array[2, 3, 5, 2, 3, 12, 5, 3, 4]) AS n
),
stats AS (
   SELECT
       avg(n) series_avg,
       stddev(n) as series_stddev
   FROM
       series
),
zscores AS (
   SELECT
       n,
       (n - series_avg) / series_stddev AS zscore
   FROM
       series,
       stats
)
SELECT
   *,
   zscore NOT BETWEEN -0.5 AND 0.5 AS is_anomaly_0_5,
   zscore NOT BETWEEN -1 AND 1 AS is_anomaly_1,
   zscore NOT BETWEEN -3 AND 3 AS is_anomaly_3
FROM
   zscores;

Enter to Rename, Shift+Enter to Preview

Let’s see what we got:

When we decreased the z-score threshold to 0.5, we identified the value 2 as an anomaly in addition to the value 12.
When we increased the z-score threshold to 3, we did not identify any anomaly.

The quality of our results is directly related to the parameters we set for the query. Later we will see how using backtesting can help us identify ideal values.

Understanding Z-score

Quiz 1

Mark as Completed

Report an Issue

Detecting Anomalies

Analyzing A Server Log

Backtesting

Improving Accuracy

Conclusion

Optimizing Z-score