mark

An IsolationForest anomaly detector over the stat macOS system-telemetry dataset. It learns what normal machine behaviour looks like from per-second CPU, memory, disk and network counters, and flags samples that do not fit. CPU only, scikit-learn only, no PyTorch and no transformer anywhere in the path. The saved bundle is a StandardScaler plus a 200-tree forest over eight features, and runs to about 1.9 MB.

Training used the first 80 percent of the session in time order (4,951 rows) and held out the last 20 percent (1,238 rows). The disk and network columns in stat are since-boot counters, so they enter as per-interval differences, exactly as that card recommends. cpu_temp is null throughout and is dropped; per-core cpu_usage enters as its mean and max.

Usage

No scikit-learn and no pickle. The forest ships as plain arrays in model.safetensors with parameters in config.json, and predict.py scores them with numpy only. It replicates scikit-learn's scoring: 99.9 to 100 percent predict agreement with the original estimator on train, holdout, and synthetic incidents, with scores matching to within 0.003.

import numpy as np
from huggingface_hub import hf_hub_download
from predict import MarkModel

m = MarkModel(".")
X = np.array([[46.8, 96.0, 3410.2, 33.0, 6.1, 5.8, 0.4, 0.3]])
print(m.predict(X))

The eight columns, in order, are cpu_mean, cpu_max, memory_used_mb, battery_status, disk_read_delta, disk_write_delta, net_sent_delta and net_recv_delta. Output is 1 for normal, -1 for flagged. Needs safetensors and numpy only.

Evaluation

Measured on the temporal holdout and on synthetic incidents built from holdout rows:

The contamination parameter is 0.01, so about one percent of training rows score as anomalous by construction; the holdout false-alarm rate of 0.027 reflects the battery recharge region the holdout covers, which the training window never saw.

Single-feature extremes score poorly, and that is a property of the algorithm rather than a bug in this fit. IsolationForest separates points by random splits, and a point that is extreme in one of eight dimensions waits several splits for that dimension to be picked, which is the same depth normal points reach. Standardizing the features changes nothing for the same reason: the splits are uniform in range, and rescaling only reparametrizes the draw. Incidents that move several counters at once, the way a real stressed machine does, are the ones it catches.

Scores

All 1,238 holdout anomaly scores as scored by the published weights, with the decision threshold at -0.6266. Everything left of the line is flagged: 0.027 of the holdout. The shape is shown as measured, uneven tail and all, with no smoothing. This is the distribution behind the false-alarm figure, not a generic illustration. Detection figures stay in the evaluation table above: 0.917 stressed, 0.372 idle crash, 0.245 net storm.

Limitations

This models one machine over one 1-hour-44-minute session. It has not seen another host, another workload, or a longer timescale, and there is no reason to expect it to transfer. The synthetic incidents are illustrative, not a benchmark. The stat card's unit caveat applies here too: the disk and network deltas are raw counter advances whose physical unit was never confirmed, so thresholds learned on them are in those raw units.