🚨Anomaly Detection

NEW

Also known as: Outlier Detection

Process of identifying data points or patterns that deviate significantly from expected behavior.

DESCRIPTION

Anomaly detection flags rare or unusual observations that may indicate errors, fraud, failures, or novel phenomena. Approaches include statistical tests, distance-based methods, density estimation, and machine learning models like isolation forests and autoencoders. Supervised methods require labeled anomalies; unsupervised methods learn normal patterns from data. Threshold selection, class imbalance, and drift complicate production use. In observability, anomaly detection underpins alerting by spotting metric deviations and outlier logs.

ALTERNATIVE DEFINITIONS

Wikipedia

In data mining, anomaly detection (also outlier detection) is the identification of rare items, events or observations which raise suspicions by differing significantly from the majority of the data.

Highlights rarity and significant deviation from the majority.

Source

ACM Computing Surveys (Chandola et al.)

Anomaly detection refers to the problem of finding patterns in data that do not conform to expected behavior.

Canonical survey definition focusing on deviation from expected behavior.

Source

RELATED TERMS

Isolation Forest One-Class SVM Robust Statistics Z-score Autoencoder Thresholding Concept Drift Monitoring

COMPETING TERMS

Novelty Detection Change Point Detection

RELATIONS

• Narrower: Change Point Detection Data Anomaly Detection

KNOWLEDGE AREAS

Data Science AI Observability & Telemetry Data Quality

TARGET AUDIENCE

Data Scientist MLOps Engineer Data Engineer BI Specialist

EXTERNAL SOURCES

• Wikipedia - Anomaly detection
• scikit-learn - User guide on outlier methods
• Google Cloud - Time-series anomaly detection guide

TOP QUESTIONS

What is the difference between Anomaly Detection and Novelty Detection?

Anomaly detection assumes anomalies may exist in training, while novelty detection trains on clean normal data and flags new deviations at inference.

Category: Comparison

How do you evaluate Anomaly Detection performance?

Use precision-recall (especially PR-AUC), ROC-AUC with caution under imbalance, and cost-weighted metrics aligning with alerting goals.

Category: Evaluation

What are common methods for Anomaly Detection?

Isolation Forest, one-class SVM, autoencoders, robust z-scores, and density-based methods like LOF are popular choices.

Category: Technique

How to set thresholds in Anomaly Detection?

Base thresholds on desired alert volume and cost, calibrate on validation data, and adapt over time to handle drift.

Category: Practice

What are typical pitfalls in Anomaly Detection?

Label scarcity, concept drift, and feedback loops can degrade performance. Invest in human feedback and monitoring.

Category: Mistakes

How does Anomaly Detection support observability?

It triggers alerts on deviations in metrics, traces, or logs, enabling faster incident detection and response.

Category: Use-case

Can supervised learning be used for Anomaly Detection?

Yes, when labeled anomalies exist. However, class imbalance and non-stationarity require careful handling.

Category: Approach

How to handle concept drift in Anomaly Detection?

Use rolling retraining, adaptive thresholds, drift detectors, and periodic recalibration with recent data.

Category: Maintenance

What data preprocessing helps Anomaly Detection?

Standardization, de-trending time series, seasonality removal, and robust scaling stabilize scores.

Category: Preparation