Anomaly Detection for Tabular Data & Time Series

The boundary: this subject is about detectors for rows of features and for metric series, and about the system around them (budget, thresholds, evaluation, triage). Image-based defect detection is the Case Study: Visual Defect Detection on a Production Line (case-study-visual-anomaly-detection-in-manufacturing). Supervised fraud scoring with delayed chargeback labels is the Case Study: Real-Time Payment Fraud Detection (Stripe / PayPal-style) (case-study-fraud-detection); here fraud is only a source of example rows. Dashboards, SLOs and paging policy for service metrics are production-observability-and-monitoring. Single-series decomposition, ETS and ARIMA live in time-series-fundamentals and forecasting many series in forecasting-at-scale-global-and-hierarchical-models; interval theory is uncertainty-quantification-and-conformal-prediction; model and data drift monitoring is ml-monitoring-and-drift; validation checks on pipelines are data-quality-testing-and-observability; generic metric theory is model-evaluation-metrics; clustering and PCA basics are clustering-and-dimensionality-reduction. Metric-definition work is product-analytics-metrics-and-ltv, and event-time modelling is survival-analysis-and-time-to-event. A lesson on fraud and abuse beyond that case study is forthcoming and is mentioned by title only.

Interviews ask this as "how would you detect anomalous transactions with no labels?", "explain how Isolation Forest works", "z-score or something else?", "how do you set the threshold?", "how do you alert on 10,000 metrics without paging everyone?", "how do you know the detector works if you have no labels?", "what is the difference between an anomaly and a changepoint?" and "your alerts are being ignored, what now?". The senior answer starts with the alert budget and the cost of a miss, picks the simplest detector that matches the anomaly's shape, calibrates the threshold on data the model has not seen, and measures with reviewed samples, not with a metric that a lazy detector can game.

Everything executable below was run (Python 3.12, NumPy 2.5, SciPy 1.18, scikit-learn 1.9, statsmodels 0.15, ruptures 1.1, PyTorch CPU, LightGBM, fixed seeds) on simulated data with known injected anomalies, or by hand on tiny examples, and is marked "(verified)". Facts recalled from the literature without re-running (the Isolation Forest, LOF, Extended IF, S-H-ESD, PELT, BOCPD and range-based-metric papers, default parameters) are marked "(from memory)". The simulated tabular data are 5-feature card transactions (log amount, hour, transactions in 24 hours, log distance from home, log hours since the previous one) with three anomaly shapes: A large, far and at night; B a burst of many transactions; C a moderately large amount at night. The simulated series is a 730-day daily metric: level 100, slope 0.02 a day, a weekly profile (Monday +4 to Sunday -14), t5 noise with standard deviation 3, 8 point spikes, 3 contextual anomalies, two collective events (6 days of -12, 8 days of +10) and a +12 level shift at day 450 that is deliberately not an anomaly label. Simulated numbers show mechanics and relative sizes, not the behaviour of a real system.