Anomaly & Novelty Detection

An anomaly is an observation that is unusual under a defined context and representation. Unusual is not synonymous with erroneous, fraudulent, dangerous, or interesting. A rare but legitimate customer and a corrupted sensor packet can receive the same score while demanding opposite actions.

Outlier detection versus novelty detection #

Outlier detection assumes the training set itself may contain anomalies and tries to identify them while fitting. Novelty detection assumes training data represent normal operation and asks whether later observations depart from it. Applying a novelty detector back to its training points uses different score behavior from evaluating genuinely new points.

Anomalies may be:

• point anomalies: one transaction has an extreme amount;
• contextual anomalies: the amount is normal generally but unusual for this account and hour;
• collective anomalies: no packet is strange alone, but their sequence or rate is.

Flattening context into a global row can make the desired anomaly invisible.

A score is not a label #

Most detectors output a ranking $s(x)$. A threshold converts it into alerts. That threshold should reflect review capacity and false-positive/false-negative costs, not an arbitrary assumed contamination fraction. When labels are scarce, manually investigate a stratified sample across score ranges; otherwise the system learns only about cases it already chooses to alert on.

Precision is often more operational than accuracy because anomalies are rare. At 0.1% prevalence, a detector with 99% specificity still produces roughly ten false alerts per true case even with perfect recall.

Three mechanisms #

Distance/density methods mark points far from neighbours or in locally sparse regions. Local Outlier Factor compares a point's local reachability density with its neighbours, so a point can be unusual relative to a nearby cluster even when global density varies. High-dimensional distances and irrelevant features degrade this mechanism.

One-class boundary methods estimate a region containing normal data and treat points outside as novel. The boundary depends on kernel/representation and the permitted fraction outside; it can wrap noise tightly or reject legitimate new modes.

Isolation Forest asks how quickly random recursive splits isolate a point. At each node it selects a feature and a split between observed limits. Rare, distinct points tend to separate near the root and therefore have short average path lengths across trees. Normalizing expected path length produces a comparable anomaly score. Subsampling can reduce masking by dense normal data and makes fitting efficient.

flowchart TD
  R["Reference population"] --> S["Fit an anomaly scoring rule"]
  S --> Q["Rank new observations"]
  Q --> T["Apply capacity/cost threshold"]
  T --> I["Investigate and collect outcomes"]
  I --> U["Update representation, threshold and reference"]

Worked contextual counterexample #

A temperature of 30 °C may be ordinary for a running motor and alarming for a refrigerated enclosure. A global z-score mixing both devices can flag neither or the wrong one. Conditioning on device type and operating state—or modelling residuals from expected temperature—makes anomaly score correspond to the question.

Likewise, a new product launch can create a dense new legitimate mode. A detector trained on older data may correctly report distributional novelty while an operator incorrectly labels it fraud. Novelty is a statistical observation; harmfulness requires domain feedback.

Evaluation when positives are rare #

If historical incident labels exist, preserve time and entities in the split and report precision–recall, alert volume, time-to-detection, and performance by anomaly type. Randomly injecting large noise spikes tests only easy synthetic corruption and can make a detector look unrealistically strong.

Without labels, use controlled faults when physically valid, red-team scenarios, known process changes, stability across resamples, and expert review. Estimate the denominator: “30 confirmed anomalies” is uninterpretable without how many alerts and opportunities existed.

Failure modes #

• Feature scaling lets one unit dominate distance or random split ranges.
• Training contamination masks anomalies or makes them a learned normal mode.
• A detector finds data-pipeline outages rather than domain events; that may be useful, but it is a different target.
• Thresholding by a fixed percentile forces alerts even during healthy periods and misses absolute deterioration when the whole distribution shifts.
• Adaptive adversaries learn the boundary and stay within familiar marginal ranges while changing joint behavior.
• Removing all outliers before supervised training can delete the rare cases the final model must handle.

Separate anomaly detection from drift monitoring. An isolated point can occur under a stable distribution; drift can move the entire population while no individual point looks extreme. Both require a reference and an operational response, but they answer different questions.