Hands-on Lab: Üç Anomali Tipini Sentetik Veriyle Görselleştirme — Python + Matplotlib + Plotly

import numpy as np
import pandas as pd
import matplotlib.pyplot as plt
import plotly.graph_objects as go
from plotly.subplots import make_subplots
from pyod.models.iforest import IForest
from sklearn.metrics import roc_auc_score, precision_score, recall_score, f1_score
 
# Reproducibility
SEED = 42
np.random.seed(SEED)
 
# Matplotlib config
plt.rcParams['figure.figsize'] = (12, 5)
plt.rcParams['figure.dpi'] = 100
plt.rcParams['axes.grid'] = True
plt.rcParams['grid.alpha'] = 0.3
 
print("✓ Kurulum hazır")
print(f"NumPy: {np.__version__}, Pandas: {pd.__version__}")

# 1000 normal nokta (2D Gauss, merkez=(0,0), std=1)
n_normal = 1000
X_normal = np.random.normal(loc=0.0, scale=1.0, size=(n_normal, 2))
 
# 30 point anomaly — uniform dağılım, geniş aralık
n_anom = 30
X_anomaly = np.random.uniform(low=-6.0, high=6.0, size=(n_anom, 2))
 
# Birleştir
X_point = np.vstack([X_normal, X_anomaly])
y_point = np.concatenate([np.zeros(n_normal), np.ones(n_anom)])
 
# DataFrame'e koy (kolaylık için)
df_point = pd.DataFrame(X_point, columns=['x1', 'x2'])
df_point['is_anomaly'] = y_point
 
print(f"Point anomaly dataset: {len(df_point)} satır")
print(f"Anomaly oranı: {y_point.mean()*100:.1f}%")
df_point.head()

fig, ax = plt.subplots(figsize=(10, 8))
normal_mask = df_point['is_anomaly'] == 0
anom_mask = df_point['is_anomaly'] == 1
 
ax.scatter(df_point.loc[normal_mask, 'x1'], df_point.loc[normal_mask, 'x2'],
           c='steelblue', s=15, alpha=0.5, label='Normal')
ax.scatter(df_point.loc[anom_mask, 'x1'], df_point.loc[anom_mask, 'x2'],
           c='crimson', s=80, alpha=0.9, edgecolor='black',
           marker='X', label='Point Anomaly')
 
ax.set_title('Point Anomaly — Tek Gözlemler Kümeden Uzak', fontsize=14)
ax.set_xlabel('Özellik 1')
ax.set_ylabel('Özellik 2')
ax.legend(loc='upper right')
ax.set_xlim(-7, 7)
ax.set_ylim(-7, 7)
plt.tight_layout()
plt.savefig('reports/point_anomaly.png', dpi=120)
plt.show()

# 365 günlük sıcaklık verisi (1 yıl)
days = np.arange(365)
 
# Mevsimsel pattern: sin dalgası — kış 0°C, yaz 30°C
seasonal_mean = 15 + 15 * np.sin(2 * np.pi * (days - 80) / 365)  # 80 günlük faz
 
# Günlük gürültü
daily_noise = np.random.normal(0, 2, 365)
 
# Normal sıcaklık
temperature = seasonal_mean + daily_noise
 
# 5 contextual anomaly: kış aylarında (gün 15, 40, 350) çok sıcak,
# yaz aylarında (gün 180, 200) çok soğuk
anom_days = [15, 40, 180, 200, 350]
anom_values = [28, 25, 8, 7, 30]  # bağlam dışı değerler
 
for d, v in zip(anom_days, anom_values):
    temperature[d] = v
 
# DataFrame
df_ctx = pd.DataFrame({
    'day': days,
    'temperature': temperature,
    'seasonal_mean': seasonal_mean,
})
df_ctx['is_anomaly'] = df_ctx['day'].isin(anom_days).astype(int)
 
print(f"Contextual dataset: {len(df_ctx)} gün")
print(f"Anomaly günler: {anom_days}")

fig, ax = plt.subplots(figsize=(14, 5))
 
# Normal sıcaklık
ax.plot(df_ctx['day'], df_ctx['temperature'],
        color='steelblue', linewidth=1, alpha=0.7, label='Sıcaklık')
 
# Beklenen mevsimsel ortalama (bağlam)
ax.plot(df_ctx['day'], df_ctx['seasonal_mean'],
        color='gray', linestyle='--', linewidth=1, label='Beklenen (mevsimsel)')
 
# Beklenen aralık (mevsimsel ± 3 std)
ax.fill_between(df_ctx['day'],
                df_ctx['seasonal_mean'] - 6,
                df_ctx['seasonal_mean'] + 6,
                color='gray', alpha=0.15, label='Beklenen aralık')
 
# Anomaly noktaları
anom_mask = df_ctx['is_anomaly'] == 1
ax.scatter(df_ctx.loc[anom_mask, 'day'], df_ctx.loc[anom_mask, 'temperature'],
           c='crimson', s=120, edgecolor='black', zorder=10,
           marker='X', label='Contextual Anomaly')
 
ax.set_title('Contextual Anomaly — Tek Başına Normal, Mevsim Bağlamında Aykırı', fontsize=14)
ax.set_xlabel('Gün (yıl içinde)')
ax.set_ylabel('Sıcaklık (°C)')
ax.legend(loc='upper right')
plt.tight_layout()
plt.savefig('reports/contextual_anomaly.png', dpi=120)
plt.show()

# 3600 saniyelik trafik (1 saat)
seconds = np.arange(3600)
 
# Normal trafik: her saniyede 5-15 arasında bağlantı
np.random.seed(SEED)
normal_traffic = np.random.poisson(lam=10, size=3600)
 
# DDoS attack: saniye 1200-1320 arasında, her saniyede 80-100 bağlantı
ddos_start, ddos_end = 1200, 1320
ddos_traffic = np.random.poisson(lam=90, size=ddos_end - ddos_start)
normal_traffic[ddos_start:ddos_end] = ddos_traffic
 
# Etiket: collective anomaly window
is_anomaly = np.zeros(3600)
is_anomaly[ddos_start:ddos_end] = 1
 
df_coll = pd.DataFrame({
    'second': seconds,
    'connections': normal_traffic,
    'is_anomaly': is_anomaly,
})
 
print(f"Collective dataset: {len(df_coll)} saniye")
print(f"DDoS window: {ddos_start}-{ddos_end} ({ddos_end-ddos_start} sn)")
print(f"Normal medyan: {np.median(normal_traffic[is_anomaly==0]):.0f}")
print(f"DDoS medyan: {np.median(normal_traffic[is_anomaly==1]):.0f}")

fig, axes = plt.subplots(2, 1, figsize=(14, 8), sharex=True)
 
# Üst: ham trafik
ax1 = axes[0]
ax1.plot(df_coll['second'], df_coll['connections'],
         color='steelblue', linewidth=0.5, alpha=0.7)
ax1.axvspan(ddos_start, ddos_end, color='crimson', alpha=0.2, label='DDoS window')
ax1.set_title('Collective Anomaly — Tek Tek Normal Ama Dizi Aykırı', fontsize=14)
ax1.set_ylabel('Bağlantı / saniye')
ax1.legend(loc='upper right')
 
# Alt: sliding window rolling mean (60 sn)
df_coll['rolling_60s'] = df_coll['connections'].rolling(60).mean()
ax2 = axes[1]
ax2.plot(df_coll['second'], df_coll['rolling_60s'],
         color='darkorange', linewidth=1.5)
ax2.axvspan(ddos_start, ddos_end, color='crimson', alpha=0.2)
ax2.axhline(y=15, color='gray', linestyle='--', label='Threshold (15)')
ax2.set_xlabel('Saniye')
ax2.set_ylabel('60sn rolling mean')
ax2.legend(loc='upper right')
 
plt.tight_layout()
plt.savefig('reports/collective_anomaly.png', dpi=120)
plt.show()

# Isolation Forest
clf = IForest(contamination=0.03, random_state=SEED, n_estimators=100)
clf.fit(X_point)
scores_point = clf.decision_function(X_point)  # yüksek = anomali
preds_point = clf.predict(X_point)            # 0=normal, 1=anomali
 
# Metrikler
auc_point = roc_auc_score(y_point, scores_point)
prec = precision_score(y_point, preds_point)
rec = recall_score(y_point, preds_point)
f1 = f1_score(y_point, preds_point)
 
print(f"Point Anomaly — Isolation Forest")
print(f"  ROC-AUC:   {auc_point:.3f}")
print(f"  Precision: {prec:.3f}")
print(f"  Recall:    {rec:.3f}")
print(f"  F1:        {f1:.3f}")

fig, ax = plt.subplots(figsize=(10, 8))
sc = ax.scatter(X_point[:, 0], X_point[:, 1], c=scores_point,
                cmap='RdYlBu_r', s=20, alpha=0.7)
plt.colorbar(sc, label='Anomaly Score (yüksek=anomali)')
 
# Gerçek anomaliler
true_anom = y_point == 1
ax.scatter(X_point[true_anom, 0], X_point[true_anom, 1],
           facecolors='none', edgecolors='black', s=120, linewidth=2,
           label='Gerçek anomali')
 
ax.set_title(f'iForest Skorlama — AUC: {auc_point:.3f}', fontsize=14)
ax.set_xlabel('Özellik 1')
ax.set_ylabel('Özellik 2')
ax.legend()
plt.tight_layout()
plt.savefig('reports/iforest_scoring.png', dpi=120)
plt.show()

from prophet import Prophet
 
# Prophet ds + y formatı bekler
df_prophet = pd.DataFrame({
    'ds': pd.date_range('2024-01-01', periods=365, freq='D'),
    'y': df_ctx['temperature'].values,
})
 
# Fit
model = Prophet(yearly_seasonality=True, daily_seasonality=False,
                weekly_seasonality=False,
                interval_width=0.99)  # %99 prediction interval
model.fit(df_prophet)
 
# Prediction
forecast = model.predict(df_prophet[['ds']])
forecast['actual'] = df_prophet['y'].values
forecast['residual'] = forecast['actual'] - forecast['yhat']
forecast['is_anom_pred'] = ((forecast['actual'] < forecast['yhat_lower']) |
                            (forecast['actual'] > forecast['yhat_upper'])).astype(int)
forecast['is_anomaly_true'] = df_ctx['is_anomaly'].values
 
# Metrikler (anomaly skoru = |residual|)
abs_residual = forecast['residual'].abs().values
auc_ctx = roc_auc_score(forecast['is_anomaly_true'], abs_residual)
prec_ctx = precision_score(forecast['is_anomaly_true'], forecast['is_anom_pred'])
rec_ctx = recall_score(forecast['is_anomaly_true'], forecast['is_anom_pred'])
 
print(f"Contextual Anomaly — Prophet residual")
print(f"  ROC-AUC:   {auc_ctx:.3f}")
print(f"  Precision: {prec_ctx:.3f}")
print(f"  Recall:    {rec_ctx:.3f}")

fig, ax = plt.subplots(figsize=(14, 5))
 
ax.plot(forecast['ds'], forecast['actual'], color='steelblue',
        linewidth=1, label='Gerçek')
ax.plot(forecast['ds'], forecast['yhat'], color='darkorange',
        linewidth=1.5, label='Prophet yhat (beklenen)')
ax.fill_between(forecast['ds'], forecast['yhat_lower'], forecast['yhat_upper'],
                color='darkorange', alpha=0.2, label='99% PI')
 
# Tespit edilen anomaliler
detected = forecast['is_anom_pred'] == 1
ax.scatter(forecast.loc[detected, 'ds'], forecast.loc[detected, 'actual'],
           c='crimson', s=100, edgecolor='black', zorder=10,
           marker='X', label='Tespit edilen')
 
ax.set_title(f'Prophet Residual ile Contextual Anomaly Tespiti (AUC: {auc_ctx:.3f})', fontsize=14)
ax.set_xlabel('Tarih')
ax.set_ylabel('Sıcaklık (°C)')
ax.legend(loc='upper right')
plt.tight_layout()
plt.savefig('reports/prophet_detection.png', dpi=120)
plt.show()

# Window-based feature extraction (60 sn window)
window_size = 60
windows = []
window_labels = []
 
for i in range(len(df_coll) - window_size + 1):
    w = df_coll.iloc[i:i+window_size]
    features = [
        w['connections'].mean(),
        w['connections'].std(),
        w['connections'].max(),
        w['connections'].min(),
        w['connections'].sum(),
    ]
    windows.append(features)
    # Bu window'da herhangi bir anomaly saniyesi varsa anomali
    window_labels.append(1 if w['is_anomaly'].sum() > 0 else 0)
 
X_win = np.array(windows)
y_win = np.array(window_labels)
 
print(f"Window sayısı: {len(X_win)}")
print(f"Anomali window oranı: {y_win.mean()*100:.1f}%")
 
# iForest on windows
clf_win = IForest(contamination=0.04, random_state=SEED)
clf_win.fit(X_win)
scores_win = clf_win.decision_function(X_win)
preds_win = clf_win.predict(X_win)
 
auc_coll = roc_auc_score(y_win, scores_win)
prec_coll = precision_score(y_win, preds_win)
rec_coll = recall_score(y_win, preds_win)
 
print(f"\nCollective Anomaly — Window iForest")
print(f"  ROC-AUC:   {auc_coll:.3f}")
print(f"  Precision: {prec_coll:.3f}")
print(f"  Recall:    {rec_coll:.3f}")

# Window skorlarını orijinal time axis'e geri map et
window_scores = np.zeros(len(df_coll))
window_centers = np.arange(window_size//2, len(df_coll) - window_size//2 + 1)
for i, center in enumerate(window_centers[:len(scores_win)]):
    window_scores[center] = scores_win[i]
 
fig, axes = plt.subplots(2, 1, figsize=(14, 8), sharex=True)
 
ax1 = axes[0]
ax1.plot(df_coll['second'], df_coll['connections'],
         color='steelblue', linewidth=0.5, alpha=0.7)
ax1.axvspan(ddos_start, ddos_end, color='crimson', alpha=0.2, label='Gerçek DDoS')
ax1.set_title('Ham trafik', fontsize=12)
ax1.set_ylabel('Bağlantı / saniye')
ax1.legend()
 
ax2 = axes[1]
ax2.plot(df_coll['second'], window_scores, color='darkorange', linewidth=1)
ax2.axvspan(ddos_start, ddos_end, color='crimson', alpha=0.2)
ax2.axhline(y=np.percentile(window_scores[window_scores>0], 95),
            color='gray', linestyle='--', label='95p threshold')
ax2.set_title(f'Window iForest Skoru (AUC: {auc_coll:.3f})', fontsize=12)
ax2.set_xlabel('Saniye')
ax2.set_ylabel('Anomaly score')
ax2.legend()
 
plt.tight_layout()
plt.savefig('reports/window_iforest.png', dpi=120)
plt.show()

summary = pd.DataFrame([
    {
        'Tip': 'Point',
        'Yöntem': 'Isolation Forest',
        'ROC-AUC': f'{auc_point:.3f}',
        'Precision': f'{prec:.3f}',
        'Recall': f'{rec:.3f}',
        'F1': f'{f1:.3f}',
    },
    {
        'Tip': 'Contextual',
        'Yöntem': 'Prophet Residual',
        'ROC-AUC': f'{auc_ctx:.3f}',
        'Precision': f'{prec_ctx:.3f}',
        'Recall': f'{rec_ctx:.3f}',
        'F1': '–',  # interval-based decision
    },
    {
        'Tip': 'Collective',
        'Yöntem': 'Window + iForest',
        'ROC-AUC': f'{auc_coll:.3f}',
        'Precision': f'{prec_coll:.3f}',
        'Recall': f'{rec_coll:.3f}',
        'F1': '–',
    },
])
 
print("\n=== ÖZET ===")
print(summary.to_string(index=False))

# 3 panel: point, contextual, collective
fig = make_subplots(
    rows=3, cols=1,
    subplot_titles=(
        f'Point Anomaly — iForest (AUC: {auc_point:.3f})',
        f'Contextual Anomaly — Prophet (AUC: {auc_ctx:.3f})',
        f'Collective Anomaly — Window iForest (AUC: {auc_coll:.3f})'
    ),
    vertical_spacing=0.12,
)
 
# 1. Point
normal_p = df_point[df_point['is_anomaly']==0]
anom_p = df_point[df_point['is_anomaly']==1]
fig.add_trace(go.Scatter(x=normal_p['x1'], y=normal_p['x2'], mode='markers',
                         marker=dict(color='steelblue', size=4), name='Normal',
                         hovertemplate='x=%{x:.2f}, y=%{y:.2f}'),
              row=1, col=1)
fig.add_trace(go.Scatter(x=anom_p['x1'], y=anom_p['x2'], mode='markers',
                         marker=dict(color='crimson', size=10, symbol='x'),
                         name='Anomaly',
                         hovertemplate='x=%{x:.2f}, y=%{y:.2f}'),
              row=1, col=1)
 
# 2. Contextual
fig.add_trace(go.Scatter(x=forecast['ds'], y=forecast['actual'],
                         mode='lines', line=dict(color='steelblue', width=1),
                         name='Gerçek sıcaklık',
                         hovertemplate='Tarih: %{x|%Y-%m-%d}<br>Sıcaklık: %{y:.1f}°C'),
              row=2, col=1)
fig.add_trace(go.Scatter(x=forecast['ds'], y=forecast['yhat'],
                         mode='lines', line=dict(color='orange', width=1.5),
                         name='Beklenen', hoverinfo='skip'),
              row=2, col=1)
detected_ctx = forecast[forecast['is_anom_pred']==1]
fig.add_trace(go.Scatter(x=detected_ctx['ds'], y=detected_ctx['actual'],
                         mode='markers',
                         marker=dict(color='crimson', size=10, symbol='x'),
                         name='Anomaly',
                         hovertemplate='Tarih: %{x|%Y-%m-%d}<br>Sıcaklık: %{y:.1f}°C'),
              row=2, col=1)
 
# 3. Collective
fig.add_trace(go.Scatter(x=df_coll['second'], y=df_coll['connections'],
                         mode='lines', line=dict(color='steelblue', width=0.5),
                         name='Bağlantı/sn', hoverinfo='skip'),
              row=3, col=1)
fig.add_vrect(x0=ddos_start, x1=ddos_end, fillcolor='red', opacity=0.2,
              line_width=0, row=3, col=1)
 
fig.update_layout(height=900, showlegend=True,
                  title_text='Anomaly Detection — Üç Tip Görselleştirme')
fig.write_html('reports/dashboard.html')
fig.show()