勤怠・売上の異常検知は設計が9割｜SLOとRules→Stats→MLで“静かな監視”を作る

# 準備：5分粒度へのリサンプリング、祝日/営業時間フラグ
import pandas as pd

# df: DatetimeIndex、columns=\['sales','traffic','cvr'] 等

Five = df.resample('5T').sum(numeric\_only=True)
Five\['traffic'] = df\['traffic'].resample('5T').sum().fillna(0)
Five\['sales'] = df\['sales'].resample('5T').sum().fillna(0)

# カレンダー特徴（外部の社内CSVやAPIで統合）

Five\['dow'] = Five.index.dayofweek
Five\['hour'] = Five.index.hour

import pandas as pd
from pathlib import Path

def rule\_zero\_sales(df: pd.DataFrame, window=3):
z = (df\['sales'] == 0).astype(int)
streak = z.rolling(window).sum()
alert = streak >= window
return df\[alert]

def rule\_missing\_file(path: str):
p = Path(path)
return (not p.exists()) or (p.stat().st\_size == 0)

import numpy as np
import pandas as pd
from statsmodels.tsa.seasonal import STL

def robust\_z(x: pd.Series):
med = np.median(x)
mad = np.median(np.abs(x - med)) or 1e-9
return 0.6745 \* (x - med) / mad

# ロバストZで急落のみ拾う例

z = robust\_z(Five\['sales'])
alerts\_z = Five\[z < -3.5]

# STL分解（5分×288=1日）

stl = STL(Five\['sales'], period=288)
res = stl.fit()
resid = res.resid
alerts\_stl = Five\[np.abs(robust\_z(resid)) > 3.0]

from sklearn.ensemble import IsolationForest
from sklearn.svm import OneClassSVM
from sklearn.preprocessing import StandardScaler

feat = Five\[\['sales','traffic','cvr','hour','dow']].fillna(0)
X = StandardScaler().fit\_transform(feat)

# IsolationForest（軽量で堅牢）

iso = IsolationForest(n\_estimators=300, contamination=0.01, random\_state=42)
alerts\_iso = Five\[iso.fit\_predict(X) == -1]

# OneClassSVM（シャープだが調整が難しい）

oc = OneClassSVM(nu=0.01, kernel='rbf', gamma='scale')
alerts\_svm = Five\[oc.fit\_predict(X) == -1]

# attn: columns=['date','dept','work_hours', ...]
by_dept = attn.groupby(['date','dept'])['work_hours'].median().rename('dept_med')
X = attn.merge(by_dept, on=['date','dept'])
X['z'] = robust_z(X['work_hours'] - X['dept_med'])
alerts_attn = X[X['z'] > 3.5]

eps = 1e-9
Five['cvr'] = Five['sales'] / (Five['traffic'] + eps)
ma = Five['cvr'].rolling(288, min_periods=60).mean()
std = Five['cvr'].rolling(288, min_periods=60).std()
alerts_cvr = Five[(ma - Five['cvr']) > 3*std]

[ALERT][S1] ゼロ売上が3連続（EC）
- 時刻: 2025-09-05 10:15 JST
- 影響: 決済/カート障害の可能性
- 対応: 1) ステータスページ確認 2) エラーログ検索 3) 決済ベンダーへ連絡
- Runbook: https://internal/wiki/alerts/zero-sales
- 抑止: なし

import numpy as np
import pandas as pd

ths = np.linspace(2.0, 4.0, 9)
rows = \[]
for t in ths:
pred = (np.abs(robust\_z(resid)) > t)
\# y\_true は 0/1 のラベル（ここでは擬似コード）
P = (pred & (y\_true==1)).sum(); FP = (pred & (y\_true==0)).sum(); FN = ((\~pred) & (y\_true==1)).sum()
prec = P / (P+FP+1e-9); rec = P / (P+FN+1e-9)
rows.append({"t"\:t, "precision"\:prec, "recall"\:rec, "alerts"\:int(pred.sum())})
res = pd.DataFrame(rows)