Navigate
Courses Tutorials Practice Pricing Tools Upgrade
Lesson 1 of 7

What Is an Anomaly?

Picture Maya's debit card: dozens of small $20 charges at the same two coffee shops, then one Tuesday a $2,400 charge from an electronics store 300 miles from home. Your eye jumps to that last one before any model runs. Turning that "does not fit" feeling into a number is the whole job of anomaly detection, and it is what this course teaches.

One of the dots in the picture below behaves the same way. It is not like the others, not because someone labelled it, but because it sits alone in a sparse pocket while the rest crowd together.

Before we can catch anomalies with isolation forests, density scores or autoencoders, we need to pin down what an anomaly actually is, and why it is so easy to fool yourself into thinking you have caught them.

By the end of this lesson you will be able to:

  • Say what makes a data point an anomaly (and why unusual is not the same as bad)
  • Score "unusual" two ways, by distance and by density, and see why distance alone misses some outliers
  • Tell global, local and contextual outliers apart
  • Explain the base-rate trap: why a 99%-accurate detector of rare events can still be almost useless, and what to measure instead

Prerequisites: you can run R and read base R (vectors, data.frame, table, mean, sd). No prior anomaly-detection knowledge is assumed.

The idea

An anomaly is a point that breaks the pattern

Back to Maya's card. Her everyday charges tell a steady story: most days she spends $3 to $60 at cafes and the grocery store a few miles from home. The $2,400 charge from the cover breaks that story, and you did not need a model to feel it. That feeling has a definition.

An anomaly (or outlier) is a data point that does not fit the pattern of the rest of the data. Formally, you build a model of what "normal" looks like, then an anomaly is any point that model assigns a low probability, or a high "distance from normal" score. Everything in this course is a different way to build that model of normal.

Key Insight
Anomalous means unusual, not wrong. Maya's $2,400 charge might be a laptop she genuinely bought, or a thief testing her card. Anomaly detection finds the points worth a second look; deciding what they mean is a separate step. Confusing "rare" with "fraud" is the first mistake to avoid.

So the question becomes concrete: how do we measure "does not fit the pattern"? There are two classic answers, and the difference between them matters.