Anomaly and Outlier Detection

The needle, not the haystack

Fraud, defects, and intrusions are anomalies — rare points that differ from the norm. Often you have few or no labels, so this is usually unsupervised.

from sklearn.ensemble import IsolationForest
iso = IsolationForest(contamination=0.01, random_state=42)
flags = iso.fit_predict(X)   # -1 = anomaly

Approaches

• Statistical — z-scores, IQR for simple cases.
• Isolation Forest / LOF — for higher-dimensional data.
• Autoencoders — flag points the model reconstructs poorly.

Tune the expected anomaly rate and validate flagged cases with a domain expert.