Netdata is a real-time, distributed monitoring and observability platform built as a multi-language agent (C core, Go collectors, Rust sidecars, legacy Python plugins). It collects system, container, application, network, and cloud metrics at per-second resolution, stores them in a custom tiered time-series database (dbengine), and exposes rich query APIs (v1/v2/v3), streaming/replication, ML-based anomaly detection, and an extensive alerting framework. The agent can operate standalone, stream to centralization points, or connect to Netdata Cloud via the ACLK (Agent-Cloud Link) using MQTT and protobuf. It also includes a network topology discovery subsystem, netflow/IPFIX/sFlow ingestion, systemd-journal log management, and an OpenTelemetry-compatible OTLP ingestion path. Architecturally, the repository is a hybrid of a daemon (C) with a plugin system that spawns many independent processes (Go, Python, shell) for metric collection. The Go plugin framework enforces a consistent collector lifecycle (config validation, init, collect, cleanup) with embedded JSON schemas and chart templates. The Rust crates handle high-throughput streams like netflow and journal indexing. The codebase is professionally engineered with extensive test coverage, benchmarks, packaging for multiple Linux distros, Windows, and macOS, and a heavy investment in performance optimizations (arena allocators, lock-free data structures, compressed bitmaps). Despite its size, it exhibits strong modularity and reusable abstractions, though some legacy duplication (e.g., Python vs Go collectors) and a few vendored components remain.
sktime is a large, actively developed Python library that provides a unified scikit-learn-style estimator interface for time series machine learning. It is not a single-purpose application or service; it is a framework with a central registry, a datatype/mtype conversion system, tag-based estimator metadata, and a sophisticated automated test suite that generates per-estimator tests from scenarios. The dominant character is application/library, though it has strong research-data aspects: bundled datasets, benchmark suites, and algorithm implementations drawn from the time-series literature (forecasting, classification, clustering, change-point detection, transformations, alignment, distances/kernels, and parameter estimation).
Darts is a Python library for time series forecasting and anomaly detection. It provides a unified API for a wide range of models, from classical statistical methods (ARIMA, Exponential Smoothing) to deep learning architectures (N-BEATS, TFT, TiDE, Transformer) and foundation models (Chronos, TimesFM, PatchTST-FM). The library also includes data preprocessing transformers (scaling, missing value filling, Box-Cox, DTW), anomaly detection scorers and detectors, explainability tools (SHAP, TFT attention), and comprehensive evaluation metrics. The architecture is modular: core TimeSeries data structure, model registry with lazy imports, transformer pipeline, and safe serialization. External dependencies include pandas, numpy, scikit-learn, PyTorch, PyTorch Lightning, and many optional packages for specific models. The codebase is well-tested with extensive unit and integration tests, and follows good engineering practices with CI/CD, dependency audits, and semantic versioning.
nDPI is a production-grade open-source deep packet inspection (DPI) library written in C, developed primarily by ntop.org. It identifies hundreds of network protocols by inspecting packet payloads using static signatures, heuristics, state machines, and machine learning classifiers. The library extracts rich metadata (TLS fingerprints, DNS queries, HTTP headers, etc.), computes flow risks (malware, DGA, obfuscation, anomalies), and supports output serialization in JSON, CSV, or TLV formats. It is designed to be embedded into network monitoring applications such as ntopng, nProbe, and Wireshark (via a Lua extcap plugin), and also ships as a standalone CLI tool (ndpiReader) and Python bindings. The codebase is well-structured with a modular dissector pattern, extensive fuzzing infrastructure, and a comprehensive test suite. While the primary focus is on library reuse, it also contains research-grade components like DGA detection models (scikit-learn/TensorFlow) and time-series anomaly detection, giving it a hybrid character leaning heavily toward a software library.
PyTimeTK is a Python time series toolkit (port of R's timetk) providing a unified API for time series analysis, feature engineering, visualization, anomaly detection, and financial technical indicators. It supports pandas, Polars, and cuDF backends via a clean engine abstraction layer, enabling transparent multi-engine execution. The library is structured around modular subpackages: core (summarization, padding, future frames), feature_engineering (lags, rolling, expanding, Fourier, wavelet, spline, holiday signatures), finance (MACD, RSI, Bollinger Bands, regime detection, risk metrics), plot (Plotly/Plotnine/Matplotlib), datasets, cross-validation, and a beta FeatureStore with MLflow integration. All functions follow a consistent augment_* pattern, register as DataFrame/GroupBy methods via pandas_flavor, and expose a .tk accessor for Polars. The codebase demonstrates strong engineering practices: extensive unit tests, CI workflows, versioned dependencies, and a clear API surface.
PyOD is a comprehensive Python library for anomaly/outlier detection offering 60+ detectors across tabular, time series, graph, text, image, and audio modalities. It provides a classic scikit-learn-compatible API (fit/predict/decision_function) via pyod.models, a high-level orchestration engine (ADEngine) for automatic profiling, detector selection, consensus scoring, and reporting, and an agentic workflow layer for LLM-driven anomaly detection through CLI, MCP server, and packaged AI skills. The library is primarily a software library (application) with strong data research influence: it comes with benchmark-backed routing rules, academic references, and Jupyter notebooks for research reprocibility. Its architecture follows a three-layer design (classic detectors, ADEngine orchestration, agentic skills) that allows progressive engagement from simple model fitting to full automated pipelines.
PyCaret 4.0 is a full-stack MLOps platform combining a low-code Python AutoML engine, a FastAPI control plane server, and a React web UI into a single deployable system. The engine provides OOP Experiment classes for classification, regression, clustering, anomaly detection, and time series, with native sklearn pipeline implementations and typed result dataclasses. The server adds multi-user workspace management, experiment tracking, model registry, deployment serving, drift monitoring, LLM-powered advisory copilots, scheduling, webhooks, and audit logging. The React frontend offers a rich SPA with real-time event streaming, interactive plots (Plotly), and data-driven forms generated from engine introspection. The architecture is well-structured with protocol-based abstractions for storage (local-fs/S3), data sources (CSV/Postgres), LLM providers (Anthropic/OpenAI/fake), and notebook backends. This is primarily an application (ML platform) but has strong data/research characteristics due to the engine's statistical analyses, dataset profiling, and time-series utilities. The codebase is under active development with a systematic migration from legacy functional APIs to the new OOP architecture, and many components are genuinely reusable.
Merlion is a mature Python library for time series intelligence, specializing in anomaly detection and forecasting. It provides a comprehensive, modular ecosystem including model zoo (classical, tree-based, deep learning, ensemble, AutoML), composable transforms, post-processing chains, evaluation frameworks, and a Dash-based interactive dashboard. The architecture follows a clean layered design: data loading via `ts_datasets`, core `TimeSeries` abstraction, `ModelBase` hierarchy with config-driven instantiation, invertible transforms, and pluggable post-rules. It integrates with Spark for distributed inference and provides benchmarks against standard datasets (NAB, M4, UCR). Though primarily a library (application), it includes research-oriented components such as state-of-the-art transformer architectures (Autoformer, Informer) and Bayesian change point detection, making it a hybrid tool suitable for both production and research.
This repository provides the official code, datasets, and checkpoints for the Timer family of large time series foundation models (Timer, Timer-XL, Sundial) from Tsinghua University. It implements a decoder-only Transformer architecture pre-trained on the Unified Time Series Dataset (UTSD) using the single-series sequence (S3) format. The code supports fine-tuning and evaluation on three downstream tasks: forecasting, segment-level imputation, and predictive anomaly detection. Data loading modules handle multiple time series formats (CSV, NPZ, TXT) with flexible windowing and scaling. The repository includes shell scripts for reproducible experiments across multiple datasets and data scarcity ratios. It also provides HuggingFace integration for zero-shot forecasting without training. While primarily a research codebase rather than a production application, it is well-structured with clean module separation and reusable components.
MSTICpy is a Python library for cybersecurity threat hunting and investigation, primarily designed for use in Jupyter Notebooks. It provides a unified interface to query multiple data sources (Azure Sentinel, Splunk, Kusto, MDE, etc.), enrich data with threat intelligence and geolocation, perform anomaly detection and process tree analysis, and visualize results with interactive timelines, maps, and graphs. The architecture follows a modular, plugin-based design: data drivers abstract away backend-specific protocols, threat intelligence providers are registered via a consistent base class, and a pivot framework dynamically attaches investigation functions to entity types. The library also includes configuration editors, Azure authentication helpers, and notebook widgets to streamline analyst workflows. While the core purpose is security analysis, the repository also contains substantial research-oriented components, such as anomalous sequence detection (Markov models on command sessions), time-series anomaly detection, and event clustering. These are packaged alongside the production-grade query and enrichment infrastructure, making the repo a hybrid of an application library and a data analysis toolkit. The codebase is well-tested with extensive unit and integration tests, though many require mocked or optional external services. Key entry points include the `QueryProvider` class for data acquisition, `TILookup` for threat intelligence, `Pivot` for entity-driven investigations, and the `mp` pandas accessor for inline transformations. External dependencies span Azure SDK, Bokeh, ipywidgets, and multiple third-party APIs, which introduces some maintenance overhead. Overall, MSTICpy is a mature, actively maintained tool that demonstrates strong engineering practices with reusable patterns, but some modules show signs of version drift and compatibility workarounds.
OpenUBA is a full-stack User and Entity Behavior Analytics (UEBA) platform for security anomaly detection, investigation, and response. It provides a complete lifecycle for ML models (install, train, infer, version, share) via a pluggable registry supporting OpenUBA Hub, GitHub, HuggingFace, and local filesystem. The platform includes a rule engine with a visual DAG-based builder (ReactFlow), case management, real-time dashboards, multi-backend visualization (matplotlib, plotly, bokeh, etc.), and an LLM-powered assistant. The backend is built on FastAPI with PostgreSQL, SQLAlchemy, JWT/RBAC authentication, and optional Spark/Elasticsearch integrations. The frontend uses Next.js 14 (App Router), Apollo Client (GraphQL), shadcn/ui, and Recharts. A Python SDK enables programmatic access to all features. The system runs on Kubernetes with a Kopf operator managing custom resources (UBATraining, UBAInference, UBAWorkspace, UBAPipeline) for containerized model execution in isolated Docker images per ML framework (sklearn, PyTorch, TensorFlow, NetworkX). While primarily an application, it includes research-oriented components like experiment tracking, feature store, and Jupyter notebook workspaces, making it a hybrid tool for both security operations and data science workflows.
This repository is a comprehensive, curated list of anomaly detection (outlier detection) resources, maintained by the author of the PyOD library. It aggregates books, academic papers, tutorials, open-source toolkits, datasets, and relevant conferences/journals, covering tabular, time-series, graph, and text data modalities. The repository also includes two utility scripts: a downloader for paper PDFs and a robust URL checker for verifying links in the documentation. While the core value is the curated resource list itself, the utility scripts demonstrate clean engineering practices and are reusable for similar link-checking and batch download tasks. This is not a software application or data pipeline; it is a reference catalog for researchers and practitioners.
This repository implements the INP-Former model for anomaly detection in industrial inspection tasks. The system extracts Intrinsic Normal Prototypes (INPs) directly from test images using a DINOv2 vision transformer encoder, followed by an INP extractor and decoder to reconstruct normal regions. Reconstruction errors serve as anomaly scores. The repository provides training scripts for various settings (single-class, multi-class, few-shot, zero-shot, super-multi-class), a Gradio-based zero-shot application for interactive inference, ONNX conversion and inference tools, and a competition submission kit. It achieves state-of-the-art performance on standard benchmarks like MVTec-AD, VisA, and Real-IAD. The architecture is modular, separating the core model, dataset handling, utilities, and training logic, though training scripts show some duplication across different settings.
This repository implements Dinomaly, a reconstruction-based unsupervised anomaly detection method for industrial inspection datasets. It uses vision transformers (primarily DINOv2) as feature extractors with a noisy bottleneck and linear attention mechanism. The code supports both class-separated and unified training across MVTec-AD, VisA, and Real-IAD datasets. Key components include dataset loaders, custom optimizers, training utilities, and evaluation metrics. While the research code achieves state-of-the-art results, it contains hardcoded paths, version-specific dependencies, and dataset-specific logic that limit immediate reproducibility.