cpp-timeseries-anomaly-detector

A C++ multivariate time-series anomaly detector, fronted by a TCP socket server. Two detector implementations: one based on Pearson correlation pairs, the other extending it with Welzl's minimum enclosing circle for non-linear feature relationships.

Bar-Ilan University, Advanced Programming 1 capstone (2022). Co-authored with Ben Levi.

  ┌─────┐   text protocol   ┌────────────┐   in-process   ┌──────────────────────┐
  │ CLI │ ────────────────▶ │   Server   │ ─────────────▶ │ HybridAnomalyDetector│
  └─────┘   over TCP socket │ (threaded) │                │  ↳ SimpleAnomalyDet. │
                            └────────────┘                └──────────────────────┘

• Server.cpp — socket()/bind()/listen()/accept() on a worker thread; uses SIGALRM (alarm(1)) to make accept() interruptible so stop() can join cleanly.
• CLI.cpp — five-command menu wired through a DefaultIO abstraction so the same command objects work over stdin or over the socket.
• SimpleAnomalyDetector — for every feature, find its most-correlated partner via Pearson; for each correlated pair, fit a linear regression on the training window and record 1.1 × max_deviation as the threshold. Detection flags any test point whose deviation from the regression line exceeds the threshold.
• HybridAnomalyDetector — extends Simple. For pairs in the 0.5 ≤ |r| < 0.9 band (correlated but not linearly enough for regression), build the minimum enclosing circle of the training points using Welzl's randomised algorithm (minCircle.cpp), then flag any test point that falls outside 1.1 × radius.

Welcome to the Anomaly Detection Server.
Please choose an option:
1.upload a time series csv file
2.algorithm settings
3.detect anomalies
4.display results
5.upload anomalies and analyze results
6.exit
> 1
Please upload your local train CSV file.
> ... (paste CSV, then "done")
Upload complete.
> 2
The current correlation threshold is 0.9
Type a new threshold
> 0.95
> 3
anomaly detection complete.
> 4
118    feature_a-feature_b
119    feature_a-feature_b
312    feature_c-feature_d
Done.
> 6

BIU Advanced Programming 1 capstone, 2022. Honest framing: this is coursework, not a production system — error handling is light, the protocol is line-based ASCII, and the algorithms are the textbook versions. The Welzl implementation and the threaded-server-with-SIGALRM-shutdown pattern are the bits worth reading.

Eliran Eiluz, Ben Levi. Bar-Ilan University, 2022.