dbconsultoria/cvm-fundos-anomaly

cvm-fundwatch Isolation Forest (prod)

Layer 5 of the cvm-fundwatch anomaly detector: an Isolation Forest over per report features of the CVM daily fund reports. Its findings are low severity and only where the rule and statistical layers found nothing.

• Tag: if-202609-s20261029
• Trained on: 202603, 202604, 202605, 202606, 202607, 202608 (3,204,348 reports, sampled)
• Threshold: 0.743465: best F1 on errors injected into 202608, raised if needed to respect the clean alarm budget
• Evaluated on: 202609 (held out) with other injected errors
• Features: abs_z_return, abs_z_excess, abs_residual, flow_ratio, shareholder_change, unchanged_reports
• Seed 20261029, 200 trees, max_samples 256
• Libraries: scikit-learn 1.9.1, numpy 2.5.4

Evaluation on 202609

Model	Average precision	Recall at threshold	Precision at threshold	Clean alarms per 10k
challenger (this model)	0.368	0.220	0.386	10.1

Decision: promoted (no champion yet).

Precision is computed against injected errors only, so it is a lower bound: real anomalies in the data count as false positives.

Use

The model is stored with skops (no pickle). Load it with skops.io.load after checking skops.io.get_untrusted_types; model.json holds the threshold and the feature list. Scores are -score_samples(X), higher is more anomalous.