Revenue Anomaly Detector

generate_data.py builds 720 rows of monthly revenue across 30 fictitious SaaS accounts spanning July 2024 through June 2026. Each account starts with its own baseline MRR, its own gentle growth or decline trend, and its own natural month-to-month noise — so the simulated data doesn't look artificially uniform.

Five deliberate anomalies are seeded on top of that baseline, each shaped differently so the detection logic has to handle more than one pattern type:

• Apex Holdings — sudden churn-style drop to ~30% of prior revenue, staying low (a customer that's leaving)
• Lighthouse Media — one-month spike to nearly 3x normal revenue, then reverting (a billing error, not real growth)
• Northgate Partners — slow erosion across 12 consecutive months, a few percent at a time (easy to miss month-to-month)
• Sterling Capital — sharp one-month spike followed by a gradual climb to a genuinely higher baseline (a real expansion, not an error)
• Crestline Industries — sudden drop followed by partial recovery the next month (a service disruption that got partially resolved)

The core method: for every account, compute a trailing 6-month rolling mean and rolling standard deviation, shifted forward one month so the current month is being compared against its own prior baseline — not a baseline that includes itself.

The classification logic that turns raw z-scores and erosion flags into a labeled anomaly type:

def classify(row):
    # Point anomalies (single dramatic month) take priority over erosion
    # since a sudden drop or spike is more urgent than a gradual trend
    if row["point_anomaly"] and row["z_score"] > 0:
        return "SPIKE"
    elif row["point_anomaly"] and row["z_score"] < 0:
        return "DROP"
    elif row["erosion_flag"]:
        return "EROSION"
    else:
        return "NORMAL"

g["anomaly_type"] = g.apply(classify, axis=1)

# Severity score unifies point anomalies and erosion onto one scale
g["severity_score"] = np.where(
    g["anomaly_type"] == "EROSION",
    g["erosion_pct"].abs() * 100,
    g["z_score"].abs().fillna(0)
)

Top of the ranked anomaly report

The script outputs a four-panel chart of the top flagged accounts, showing each account's revenue line against its own rolling baseline with anomalies marked at the point of deviation. Gradient fills and glowing markers make the deviation points immediately visible without needing to read the underlying numbers.

Apex Holdings shows the churn-style drop staying low across three months. Lighthouse Media shows the single-month billing-error spike reverting immediately after. Crestline Industries shows a sharp drop with partial recovery. Sterling Capital shows a spike followed by a genuinely higher sustained baseline — the model correctly stops flagging it as anomalous once the new baseline catches up.