In this article
Before you start
Why interviewers ask this
A candidate who answers "flag anything three standard deviations from the mean" has described a method that fails on most real series, because most real series repeat on a schedule. Questions collected for this topic include "How would you build a system to detect regime changes in a financial time series?" and "How do you handle missing data in a time-series dataset?". Both are design questions rather than coding ones, so the reasoning matters more than a library call.
A weak answer names an algorithm. A strong answer says what counts as normal for this series, removes it, scores what is left, and says how to check the alarms.
Anomaly detection in time series from first principles
In plain words
- Seasonality
- Seasonality is a pattern that repeats at a fixed interval, such as higher sales every Saturday or more traffic every evening. A seasonal peak is normal, not an anomaly.
- Modified z-score
- The modified z-score is a distance-from-normal score that uses the median and the median absolute deviation (MAD) in place of the mean and standard deviation, so a few extreme values do not distort the baseline. The NIST handbook labels values above 3.5 in absolute terms as potential outliers.
Think of a lifeguard watching a beach. A crowd at noon on a hot Saturday is expected and no alarm rings. The same crowd at 3 a.m. on a Tuesday would be alarming. The lifeguard compares what she sees with what is normal for that hour.
The analogy breaks because a lifeguard knows the schedule already, while a detector must learn the schedule from the data, including from stretches that contain anomalies. So every method below first learns what normal looks like, then measures how far each value sits from it.
In one precise sentence, time-series anomaly detection is scoring each value against what the series' own pattern predicts for that moment.
Step 1: Decide which kind of anomaly you are hunting
The first step is to name the anomaly type, because the type decides which method can find it. Braei and Wagner (2020) list three types. A point anomaly is a single value that deviates significantly from its neighbours, such as one unusually large credit transaction. A collective anomaly is a sequence of points that is unusual even though no single point is; their example is a customer who withdraws the same amount every day for a week. A contextual anomaly is a value that is normal in one context and anomalous in another, such as a daily temperature that suits summer but not winter.
They add that some approaches that find point anomalies fail on collective or contextual ones altogether, and that anomalies in a time series are generally contextual or collective because each value depends on the values before it. In this article's example a spike is a point anomaly and a missing weekend peak is a contextual one. The input is a series and a question. The output is a choice of what to look for.
Step 2: Remove the trend and the seasonal pattern first
Removing the trend and the seasonal pattern before scoring turns contextual anomalies into ordinary outliers, which is why it comes before any threshold. A decomposition splits the series into a trend, a seasonal part and a residual. The statsmodels documentation (version 0.15.0) describes seasonal-trend decomposition using locally weighted regression (STL) and its outlier-resistant option, which it describes as resistant to some forms of outliers.
Without this step the weekly pattern hides the anomalies. In the worked example below, a three-standard-deviation rule on the raw series flags neither planted anomaly: their z-scores are 2.05 and −1.051. The raw series has a standard deviation of 9.399, but the residual has 4.136, less than half, so the same planted anomalies become much larger in standard-deviation terms1. A Saturday that is 20 units too low reads 101.5, inside the range of ordinary weekdays: four days of the series are lower still, so a raw threshold that catches it also flags those four1. After removing the weekly pattern its residual sits 17 median absolute deviations below the median residual, a modified z-score of −11.471.
Step 3: Score the residual against the median
A median-based rule scores each residual against the median instead of the mean, because the anomalies you hunt would otherwise distort the baseline that judges them. The modified z-score of a value is 0.6745 times its distance from the median, divided by the median absolute deviation, and the NIST handbook flags absolute values above 3.5. The same page warns that the ordinary z-score can mislead, particularly for small samples.
An ordinary z-score has a built-in limit. In a sample of n values it cannot exceed (n − 1) divided by the square root of n in absolute value, a bound the NIST page states, so a sample of 10 or fewer values can never reach a threshold of 3. The example has 70 values, so the bound is not what holds the planted spike to a z-score of 2.051: the weekly pattern inflates the standard deviation. The score's input is the residual series; its output is one number per day and a yes or no against the cutoff.
Step 4: Choose a method and a threshold you can defend
Pick the simplest method that matches the data, then set the threshold by the cost of a false alarm and of a miss. The residual rule above is a statistical method. Braei and Wagner (2020) compare 20 univariate methods across statistical, machine-learning and deep-learning families on 368 series, and report that the statistical methods generally performed best and ran fastest, while the deep-learning methods generally performed poorly on those benchmarks.
For several features at once, the scikit-learn documentation (version 1.9.1) describes the isolation forest. An isolation forest is an ensemble of random trees that isolates a point by random splits, so anomalies end up with shorter average paths. Its contamination setting is the expected share of outliers and places the threshold (IsolationForest reference). The scikit-learn outlier-detection guide separates outlier detection, where the training data contains outliers, from novelty detection, where it is clean and new points are judged.
Step-by-step description
- Point, collective or contextual.
- Subtract trend and seasonality.
- Median and MAD, flag above 3.5.
- Method and threshold by cost.
- The first step is to name the anomaly type, because the type decides which method can find it.
- Removing the trend and the seasonal pattern before scoring turns contextual anomalies into ordinary outliers.
- A median-based rule scores each residual against the median instead of the mean.
- Pick the simplest method that matches the data, then set the threshold by the cost of a false alarm and of a miss.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →Worked example
| Rule | Days flagged | True anomalies found | False alarms |
|---|---|---|---|
| Raw z-score above 3 | 0 | 0 of 2 | 0 |
| Raw modified z-score above 3.5 | 5 | 1 of 2 | 4 |
| Modified z-score of the residual above 3.5 | 2 | 2 of 2 | 0 |
The series is synthetic and illustrative: 70 daily values with a slow upward trend, a weekly pattern that is high on weekends and random noise (seed 0). The script adds a spike of 25 units on day 31, a Thursday counting day 0 as Monday, and removes 20 units from day 40, a Saturday1. Day 31 reads 130.7, day 40 reads 101.5, and the median Saturday reads 123.3, so day 40 is ordinary against the whole series but about 22 units low for a Saturday1.
The raw z-score rule finds nothing: the spike scores 2.05 and the low Saturday scores −1.051. The raw modified z-score finds the spike at 3.86, misses the low Saturday at −1.01, and flags four ordinary weekend days as faults, one of them day 41, the Sunday after the low Saturday1. The residual rule works as follows: take the 7-day moving average as the trend, take each weekday's median of what is left as the seasonal pattern, subtract both, and score the residual. It scores day 31 at 12.77 and day 40 at −11.47, and flags only those two1.
Text description of the diagram
- Day 31 is 21.3 above its expected value of 109.4.
- Day 40 reads 101.5 against an expected 120.6, a residual of -19.2.
A reader can redo the key step by hand. The weekday pattern puts a Saturday 10.48 above the trend, so day 40 is expected at 120.6 and its residual is −19.21. The residuals have a median of 0 and a median absolute deviation of 1.126, so its modified z-score is 0.6745 × −19.2 ÷ 1.126 ≈ −11.5, the script's −11.47 before rounding1. The centred 7-day average needs three days on each side, so the first and last three days get no score, and a live detector would use a trailing window or a forecast instead.
Trade-offs and edge cases
No single method is best, and the cleanest rule fails when its assumptions break. The choice depends on the anomaly type, the data volume and the cost of an error.
Text description of the diagram
- A point anomaly is a single value that deviates significantly from its neighbours, such as one unusually large credit transaction.
- A contextual anomaly is a value that is normal in one context and anomalous in another, such as a daily temperature that suits summer but not winter.
- A collective anomaly is a sequence of points that is unusual even though no single point is.
- Changing seasonality. A weekly pattern that shifts, for example after a promotion, makes the decomposition wrong and floods the output with alarms. Refit on a recent window and expect a short period of misfires after a regime change.
- Missing values. A moving average and a weekday median need regular spacing, so fill or drop gaps deliberately and record what you did, instead of letting the library interpolate silently.
- Contaminated training data. The scikit-learn documentation separates outlier detection (training data may contain outliers) from novelty detection (training data is clean). Say which one you are doing.
- Threshold drift. The 3.5 cutoff is a convention from the NIST handbook, not a law; tune it against reviewed alarms.
- Alarm cost. The confusion matrix of reviewed alarms gives precision and recall, and the right balance depends on whether a miss or a false alarm costs more. Monitoring in production is covered under machine learning operations (MLOps).
Noise and scale also matter: the Gaussian assumptions behind the ordinary z-score are explained on the Gaussian distribution page, and pipelines that deliver the data are covered in data engineering.
How to answer it in an interview
How would you detect anomalies in a daily sales series?
First I decide which kind of anomaly matters: a spike, a stretch, or a value that is odd for its context. Sales repeat weekly, so a raw threshold would flag every busy Saturday. I would split the series into trend, seasonal pattern and residual, using a decomposition that resists outliers so past anomalies do not distort it, and score the residual with the median and median absolute deviation. I would flag absolute scores above about 3.5, then review the alarms, count false alarms and misses, and tune the cutoff to the cost of each. If I had many features at once I would try an isolation forest.
The spoken structure is: name the anomaly type, remove the expected pattern, score the residual against the median, then say how you check and tune the alarms.
Common mistakes
- "Flag anything more than three standard deviations from the mean" (wrong). The mean and standard deviation are pulled by the anomalies themselves and ignore the schedule; in the example this rule found nothing (right: remove the pattern, then use the median and the median absolute deviation).
- "A value inside the normal range cannot be an anomaly" (wrong). A low Saturday is inside the range of the whole series but far outside the range for Saturdays (right: judge each value in its context).
- "Use a deep model because it is more advanced" (wrong). On 368 univariate series, Braei and Wagner found the statistical methods generally beat the deep-learning ones (right: start with the simplest method that matches the data and beat it before adding complexity).
- "Fit on all the data, anomalies included" (wrong). Contamination distorts the baseline (right: use median-based statistics or clean the training window, and say which of outlier or novelty detection you are doing).
- "The alarm count is the result" (wrong). Alarms are only useful if reviewed (right: report precision and recall against reviewed cases).
Follow-up questions
How do you handle missing data in a time-series dataset?
Decide why values are missing first: a sensor outage and a genuine zero are different. Fill short gaps by a documented rule such as carrying the last value or interpolating, drop or mask long gaps, and keep a flag column so the detector can ignore filled points.
How would you build a system to detect regime changes in a financial time series?
A regime change is a collective or level change, so a point-wise rule is the wrong tool. Compare statistics of a recent window against a longer reference window, alert when they diverge, and review alerts against known events. State clearly that this separates a change of level from a one-day spike; the full pipeline, from data to alert routing, is in how to design an anomaly-detection system.
How do you evaluate an anomaly detector without labels?
Plant known anomalies of several types into held-out data and check how many the detector finds, then have a person review a sample of its alarms to estimate false alarms. Both numbers are estimates, so report them with the sample size.
What if the seasonal pattern itself changes?
The decomposition will mislabel the new pattern as anomalies until it is refitted. Use a rolling window for the seasonal profile and treat a burst of alarms across a whole weekday as a sign that the pattern moved, not that every day is faulty. A lasting move of this kind is a form of distribution shift.
Why use the median instead of the mean for the baseline?
Because the anomalies you want to find are the values that would drag the mean and inflate the standard deviation. The median and the median absolute deviation barely move when a few values are extreme, which is the reason the modified z-score exists.
- A time-series anomaly is a point, a stretch or a value that is unusual for its context.
- Remove the trend and the seasonal pattern first; then anomalies stand out in the residual.
- Score the residual with the median and the median absolute deviation, and flag above about 3.5.
- On the example series the raw z-score found 0 of 2 anomalies and the residual rule found 2 of 2 with no false alarm.
- Choose the method by the anomaly type, and tune the threshold by reviewed alarms.
Sources
- Anomaly Detection in Univariate Time-series: A Survey on the State-of-the-Art, arXiv 2004.00433 v1 — arXiv (Braei and Wagner), 1 Apr 2020
- Novelty and Outlier Detection, scikit-learn 1.9.1 documentation — scikit-learn (page shows version only; read 2026-10-24), 24 Oct 2026
- IsolationForest, scikit-learn 1.9.1 documentation — scikit-learn (page shows version only; read 2026-10-24), 24 Oct 2026
- Detection of Outliers, NIST/SEMATECH e-Handbook of Statistical Methods — NIST (page undated; read 2026-10-24), 24 Oct 2026
- statsmodels.tsa.seasonal.STL, statsmodels 0.15.0 documentation — statsmodels (page shows version only; read 2026-10-24), 24 Oct 2026
