Open-source anomaly detection
PyOD is the hub library and API standard for outlier detection in Python: 60+ algorithms across five data types, a 9,000-star knowledge base, and thousands of projects building on top.
What it is
Four parts hold together under one API: a hub library, a knowledge base, a contributor community, and the projects built on top.
One interface for 60+ outlier detectors across tabular, time-series, graph, text, and image data, with an orchestration core and a natural-language investigation layer. The detector others reach for first.
github.com/yzhao062/pyod ↗The field's reading list: curated books, papers, courses, benchmark datasets, and toolboxes for anomaly detection, maintained alongside the library.
anomaly-detection-resources ↗Detectors arrive by pull request. 57 contributors have merged 217 changes, 120 of them from outside the core team, including the fix for the library's first reported CVE.
contributors ↗About 5,500 public projects depend on PyOD, and sibling libraries extend its API to new data types. The interface has become a shared standard for the field.
dependent projects ↗One hub, many projects
A real ecosystem is layered. PyOD sits at the core; around it orbit the family that shares its API, the tools that embed it in production, and the institutions, books, and courses that build on it. Hover any node to trace its ties.
Where it runs
Independent, verifiable records name PyOD in production systems and peer-reviewed methods, not vendor testimonials.
And built into the tools teams already run
Anomaly detection guards the input to decisions: fraud screens, telemetry health, intrusion alerts. When a defensive detector is poisoned or silently degraded, the systems downstream stop seeing what they were built to catch. That blast radius is the case for hardening the ecosystem, not only the library.
Why it compounds
A package is used. An ecosystem grows on its own contributions. PyOD works the second way: the community adds a new detector as a pull request, that detector reaches everyone on the next release, more usage brings more contributors, and the API becomes the interface newcomers learn first.
Aggregation is the mechanism. As model hubs collect models behind one interface, PyOD collects anomaly detectors behind one API. Sixty-plus algorithms now sit under the same three-line calling convention, which is why downstream libraries copy it rather than invent their own.
The clearest proof is reach beyond one lab and one data type. The PyOD-style API now carries graph outliers (PyGOD), time-series detection (TODS), and a shared benchmark (ADBench), and the surrounding research has published at NeurIPS, JMLR, MLSys, AAAI, EMNLP, and ACL. That is a standard taking hold, and it is what a reviewer means by a real, distributed ecosystem.
Learn PyOD
A hands-on book teaches anomaly detection through PyOD, from classic detectors to modern models.
Handbook of Anomaly Detection: With Python Outlier Detection
Chris Kuo (Dr. Dataman), Columbia University
Ten-plus PyOD detectors, from kNN, LOF, and HBOS to XGBOD and deep models, each with code and worked examples. The most direct path for practitioners into the library.
Maintained and accountable
An ecosystem this widely deployed needs governance a reviewer can inspect: an external advisory committee, reviewed contribution, coordinated security, and predictable releases.
Advisory committee
Chris Kuo
Columbia University · "Dr. Dataman"
Author of the Handbook of Anomaly Detection and a leading PyOD educator; the adoption and education voice.
Guansong Pang
Singapore Management University
A leading deep anomaly-detection researcher and author of the field's standard deep-AD survey.
Alicia Guo
IBM Consulting · AI Service Partner
Leads enterprise AI at IBM Consulting, with deep financial-services fraud and AML experience: anomaly detection applied at scale.
How it is run
Every detector and fix lands through pull-request review by the core maintainers before it reaches the release stream, keeping a single quality bar across 217 merged changes.
The library's first reported vulnerability was disclosed by an outside contributor, patched, and shipped in a point release. That response path is the security governance the ecosystem is now formalizing.
113 semantic-versioned releases since 2018 give the 5,500 dependent projects a stable upgrade contract, so a security fix propagates without breaking downstream installs.
