Anomaly Detection
What is an anomaly, and what types are there?
An anomaly is a data point that deviates significantly from the expected pattern — fraud, a failing machine, an intrusion. The challenge is they're rare and often unseen before.
One transaction far larger than any normal one.
Normal alone, anomalous given context — high spend at 3 a.m.
A sequence of values that together signal a problem.
What are the main approaches?
All score how “normal” a point is; they differ in how they model normal.
Flag points in the far tails of a fitted distribution.
Points far from neighbors or in sparse regions are anomalies. (DBSCAN labels them noise.)
Random splits isolate outliers in fewer cuts than normal points.
Why is it usually framed as unsupervised?
Anomalies are rare and diverse — you rarely have enough labeled examples, and tomorrow's anomaly may look nothing like yesterday's. So instead of learning “what fraud looks like,” you learn what normal looks like and flag deviations.
- “Semi-supervised vs unsupervised?” — Semi-supervised (novelty detection) trains only on clean normal data; unsupervised assumes anomalies are a small contamination of the training set.
- “When would you go supervised?” — When you have plenty of labeled anomalies and they're stable over time — then it's just imbalanced classification.
How do you evaluate an anomaly detector?
Accuracy is useless — calling everything “normal” scores 99.9% on a 0.1% anomaly rate. Use metrics that focus on the rare class.
Precision, recall, F1 on the anomaly class, and PR-AUC (precision–recall AUC), which is more informative than ROC-AUC under heavy imbalance. See classification metrics.
How do you choose the threshold?
Detectors output a continuous anomaly score; you pick a cutoff. The choice is a business trade-off between catching anomalies (recall) and false alarms (precision).
- “How set it in practice?” — From the expected contamination rate, a target alert volume reviewers can handle, or the precision/recall point that minimizes cost.