Anomaly Detection: From a Competition to My Master’s Thesis
My project compares how anomaly-detection algorithms behave on multidimensional data. It began as a competition topic in October 2025 and became the subject of my master’s thesis at Phenikaa University in January 2026. This page is the decision log and reading map; it does not claim final model results that have not yet been produced.
The project has two stages
- October 2025 — competition: I started with application logs and APM metrics. Each synthetic file has its own trace structure, but the published files do not share identifiers with each other.
- January 2026 — master’s thesis: I kept the topic and began documenting the scope, model choices, root-cause-analysis question, and implementation milestones.
Read the project in this order
- Inspect the synthetic logs and metrics dataset.
- Understand why Isolation Forest isolates anomalies early.
- Compare local density with Local Outlier Factor.
- Read the rule I use when working with ChatGPT on my thesis.
- See how I reduced the first coding milestone.
The journal records the decisions in sequence so later results can be compared with the scope defined before implementation.
Each entry answers a different project question
| Entry | Question answered | Current boundary |
|---|---|---|
| Synthetic logs and metrics | What is actually present in the published files? | The two JSONL files have no shared trace IDs and cannot yet support cross-signal RCA |
| Isolation Forest | Why can random partitions rank unusual points? | Detection score is separated from alert threshold and root-cause evidence |
| Local Outlier Factor | When does local density reveal what a global rule misses? | Distance, scaling, neighborhood size, and novelty deployment remain explicit choices |
| Thesis AI rule | What work can ChatGPT assist without owning the research? | Every claim, experiment, and decision must remain reproducible and defensible |
| First assignment | What is the smallest defensible first pipeline? | Tabular data, three candidate detectors, one trace-safe evaluation contract |
The next meaningful update is not another algorithm summary. It is a reproducible MVP that fixes one dataset split and evaluation protocol, then runs the first detector through that pipeline. Later results can then be compared with decisions recorded before the outcome was known.