Practice — Anomaly Detection for Tabular Data & Time Series (6 questions)

Your team has four unlabelled anomaly detection problems on the table. For each one, name the method you would start with, one reason, and the failure mode you would test first.

1. Refund amounts. 2 million refunds a month in USD, heavily right-skewed (median 12, a long tail into the thousands). Finance wants a short daily list of refunds to review.
2. Plant sensors. 10 temperature and pressure sensors on one machine that normally move together. Faults show up as one sensor drifting against the others while every sensor stays inside its normal range.
3. Daily signups. One metric with a strong weekly pattern and a slow upward trend. A marketing team wants to know about unusual days, including a Saturday that looks like a Wednesday.
4. Customer profiles. 80 numeric and categorical features per customer, millions of rows, and the fraud team will review at most 25 customers a day.

In an interview you are asked: "Explain Isolation Forest to a colleague who has only used z-scores. Why does it need no distance computation? What does the contamination parameter do? Name two situations where you would not use it."

Include a short numerical illustration, for example eight one-dimensional points 10, 11, 12, 13, 14, 15, 16 and 40, and say what you would change if your colleague wants to flag the top 0.05 percent of 20,000 daily transactions.