Anomaly Detection for Tabular Data & Time Series
Finding what is unusual without labels — and keeping the alert budget sane
Learn to detect anomalies when almost nothing is labelled and every alert costs someone's time: point, contextual and collective anomalies, outlier versus novelty detection, and the alert budget as the first design input (20 true anomalies a day and a budget of 10 alerts caps recall at 50 percent before any model is chosen). Statistical baselines with their failure modes (z-scores flagged 1.64 percent of t3 data against 0.23 percent for normal data, the MAD-based robust z masked nothing at 10 percent contamination but failed at 33, generalized ESD found two outliers a single Grubbs pass missed, Mahalanobis separated a point whose coordinates were each ordinary); density and distance methods (kNN versus LOF on clusters of different density, scaling that moved AUROC from 0.809 to 1.000, distance concentration, DBSCAN noise); Isolation Forest worked by hand with the exact path-length arithmetic and sklearn's contamination='auto' flagging 479 rows for 50 real anomalies; PCA residuals and autoencoders that memorised 50 training anomalies down to an error 59 times lower than fresh ones; time series with robust STL residuals, seasonal-hybrid ESD, forecast-then-flag with its baseline lock-out failure (270 false-alarm days), CUSUM, PELT and Bayesian online changepoint detection, and the difference between an anomaly and a changepoint; streaming and drift; evaluation with precision@k from review samples, synthetic injection that scored recall 0.00 on the real detector, PR-AUC, range-based recall and point-adjust inflation (a random detector scoring F1 0.13 instead of 0.036); and detector-to-system design with severity, feature attribution, analyst feedback and grouping. A worked example sets thresholds for 10 alerts a day on a 5-feature transaction model and on 10,000 daily metrics. Every number comes from code that was run.
Practice questions (6)
-
View →
Choose an anomaly detection method for four different scenarios
Intermediate · Free -
View →
Explain how Isolation Forest works and when it fails
Intermediate · Free -
View →
Design an anomaly detection pipeline for 10,000 business metrics with 10 alerts a day
Advanced -
View →
Evaluate an anomaly detector when you have no labels
Advanced -
View →
Decide whether a conversion-rate drop is an anomaly or a changepoint
Advanced