Anomaly Detection — Tutorial

Types of anomalies and why they matter

An anomaly is a data point that deviates significantly from the expected pattern. Three types:

Point anomaly: a single observation that is far from others (e.g. a transaction of $10,000 when typical transactions are $20–200).

Contextual anomaly: normal globally but unusual in context (e.g. 30°C in December in Oslo is anomalous; in Bangkok it is not).

Collective anomaly: a sequence of points that is unusual together but each point is individually normal (e.g. gradual sensor drift that individually looks fine but is collectively unusual).

Applications: fraud detection, network intrusion detection, manufacturing quality control, medical monitoring, log analysis. The key challenge: anomalies are rare and often unlabelled — most approaches are unsupervised.

Isolation Forest

Isolation Forest (Liu et al., 2008) is the most practical general-purpose anomaly detector. The intuition: anomalies are few and different — it takes fewer random splits to isolate an anomaly than a normal point.

Algorithm: build an ensemble of random trees. For each tree, randomly select a feature and a random split value, recursively partitioning the data. The average depth at which a point is isolated across all trees is its anomaly score. Short path length = isolated early = likely anomaly.

Key parameter: contamination — the expected fraction of anomalies (e.g. 0.05 for 5%). This sets the decision threshold. Set it from domain knowledge.

Advantages: O(n log n), works well in high dimensions, robust to irrelevant features.

Statistical and other methods

Z-score / IQR: for univariate data. A point is an outlier if |x - mean| > 3σ or falls more than 1.5 × IQR outside the quartiles. Simple and interpretable, but only works for roughly Gaussian distributions.

One-Class SVM: learns a tight boundary around the normal class in feature space. Works well for low-dimensional, well-behaved data. Slow on large datasets.

Local Outlier Factor (LOF): compares a point's local density to its neighbours'. Points in sparse regions surrounded by dense neighbours get a high LOF score. Good for detecting contextual anomalies where global methods fail.

Autoencoders: train a neural network to reconstruct normal data. Anomalies reconstruct poorly (high reconstruction error). Best for complex data like images, time series, and text.

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to Anomaly Detection — Tutorial.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path