Struct EnsembleAnomalyDetector 

pub struct EnsembleAnomalyDetector { /* private fields */ }

Ensemble anomaly detector combining multiple methods

Implementations

impl EnsembleAnomalyDetector

pub fn new( detector_weights: HashMap<String, f64>, voting_threshold: f64, confidence_threshold: f64, ) -> Self

Create a new ensemble anomaly detector

pub fn detect_ensemble_anomalies( &self, metrics: &HashMap<String, f64>, detector_results: &HashMap<String, HashMap<String, AnomalyRecord>>, timestamp: u64, ) -> Result<Vec<AnomalyRecord>>

Detect ensemble anomalies by combining the actual results of the individual member detectors that ran for each metric.

detector_results maps metric_name -> (detector_name -> the AnomalyRecord that detector produced for this metric); a detector that did not flag a metric (or was never configured for it) simply has no entry, rather than a fabricated zero. The expected detector_name keys match the private detector_weights field (by convention, "statistical", "ml", "time_series" – see AdvancedAnomalyDetector::detect_anomalies, the sole real caller, which builds this map from its own per-metric detector runs).

For each metric with at least one flagging detector:

• vote_fraction = (sum of weights of flagging detectors) / (sum of all configured weights). Must be >= self.voting_threshold.
• confidence = a saturating [0, 1) transform of the mean raw anomaly_score reported by the flagging detectors (their scores live on different, unbounded scales – z-score, IQR-distance-ratio, etc. – so this puts them on a common, comparable footing). Must be >= self.confidence_threshold.

Only metrics that clear both real, configured thresholds produce an ensemble AnomalyRecord (detection_method = "ensemble_weighted_vote").