Anomaly Detection on Financial Data — HANA PAL Plus an LLM Explanation
As of 2026-09-25
Pairs SAP HANA PAL's deterministic anomaly detection (via hana-ml) with a generative-AI-hub explanation layer, and makes the boundary between them the central lesson: PAL decides what is anomalous, the model only narrates. Covers hana-ml's OutlierDetectionTS for financial time series (three residual-extraction methods — median filter, seasonal decomposition, combined — and five scoring methods with documented default thresholds: Z1/Z2 at 3, IQR at 1.5, MAD at 3, Isolation Forest score at 0.7) and the separate IsolationForest class for multi-feature record-level detection (n_estimators=100, max_samples=256, max_features=0, bootstrap=False by default, contamination in (0, 0.5] defaulting to 0.1). Shows how to combine the two for a monthly close review, then builds a strictly field-only narration prompt that explicitly forbids concluding fraud or error. Closes with a three-part evaluation: detector precision, narration groundedness, reviewer time.
What you will learn
- Distinguish a time-series anomaly question from a multi-feature record-level anomaly question, and pick the matching hana-ml tool
- Choose a residual-extraction method (median filter, seasonal decomposition, or both) in OutlierDetectionTS for a given financial time series
- Choose among Z1, Z2, IQR, MAD and Isolation Forest scoring methods and their default thresholds, and tune the threshold against a false-positive tolerance
- Configure IsolationForest's key parameters (n_estimators, max_samples, max_features, bootstrap, contamination) deliberately for a record population
- Write an orchestration prompt that narrates a PAL-flagged anomaly from its own fields only, explicitly forbidding a fraud/error conclusion
- Evaluate an anomaly pipeline on detector precision, narration groundedness and reviewer time — not on a single demo case
Module overview
Who this is for. This module pairs two things that are often bolted together badly: a deterministic statistical detector and a language model. SAP HANA's Predictive Analysis Library (PAL), through its Python wrapper hana-ml, does the actual anomaly scoring — auditable, thresholded, repeatable. The generative AI hub turns a flagged record into a sentence a reviewer can act on. The module's real subject is the boundary between the two: PAL decides what is anomalous; the model only narrates. Get that boundary backwards and you have built an unauditable fraud detector that occasionally hallucinates a verdict.
Prerequisites
- M333 — AI & LLM Fundamentals for SAP Consultants (tabular models vs LLMs, grounding discipline)
- Comfort with Python and hana-ml, and a working HANA Cloud connection
- Recommended alongside M338 (SAP HANA PAL hands-on) for PAL fundamentals beyond anomaly detection
- Basic statistics: mean, standard deviation, quartiles, median absolute deviation
Outcomes
- Build a time-series anomaly detector over a real financial KPI with a justified residual-extraction and scoring method.
- Build a multi-feature Isolation Forest detector over a transaction population with deliberately set parameters.
- Write a narration prompt that summarises a PAL result faithfully and explicitly refuses to conclude fraud or error.
- Set up a three-part evaluation (precision, groundedness, reviewer time) and use it to retune the detector.
Full module available to members. The full module adds: the decision framework · the end-to-end scenario walkthrough · the KPI scorecard · the anti-patterns · the code blocks · the knowledge check · the diagrams.