Anomaly detection

In short

Anomaly detection finds the rare observations that do not follow the pattern of the rest of the data - a ₹2 lakh UPI transfer at 3 a.m. from a phone that normally spends ₹200, a bearing vibration spike, a sudden surge in server error logs. It matters because the interesting events in banking, manufacturing, telecom and cybersecurity are exactly the rare ones, and normal supervised learning drowns them: a classifier that calls everything "normal" is 99.9% accurate and useless. Indian university ML and data-science papers examine it under unsupervised learning, with statistical tests (z-score, IQR, Grubbs, Mahalanobis) and algorithms (isolation forest, LOF, one-class SVM, autoencoders); GATE DA asks distance and probability-based outlier questions. Analytics interviews at HDFC, ICICI, Paytm, PhonePe, Razorpay, Flipkart, TCS, Infosys and Wipro ask it as the standard "highly imbalanced data" question.

Explained

What counts as an anomaly, and the three learning settings

• Anomaly (outlier): a point generated by a different mechanism from the bulk of the data - not merely a large value. Rarity plus deviation.
• Noise vs anomaly: noise is random measurement error you want to remove; an anomaly is a signal you want to report. Same arithmetic, opposite intent.
• Types by structure:
  • Point anomaly - a single record is odd by itself (one ₹5 lakh card swipe).
  • Contextual (conditional) anomaly - normal in general, odd in its context (40 °C is normal in Nagpur in May, an anomaly in January).
  • Collective anomaly - individual points are fine, the group is not (100 small transfers of ₹499 in 10 minutes; an ECG holding a flat line).
• Supervised - labelled normals and anomalies exist; treat as extreme class imbalance (see metrics below).
• Semi-supervised / novelty detection - train on *clean normal data only*, flag anything unlike it. This is what one-class SVM and autoencoders are built for.
• Unsupervised / outlier detection - unlabelled data assumed mostly normal; rank points by an anomaly score and cut at a threshold. Most industrial practice is here.
• Contamination (ν): the assumed fraction of anomalies, typically 0.1-5%. It sets the threshold, so it is the single most important hyperparameter.

Statistical methods

• Z-score (univariate, Gaussian): z = (x − μ)/σ; |z| > 3 flagged. Simple and examinable, but μ and σ are themselves inflated by the outliers (masking).
• Robust z-score (modified): uses median and MAD instead of mean and SD - resistant to masking; |0.6745(x − median)/MAD| > 3.5.
• IQR / Tukey boxplot rule: flag x < Q1 − 1.5·IQR or x > Q3 + 1.5·IQR; 3.0·IQR for "extreme" outliers. Distribution-free, the default in EDA.
• Grubbs' test: formal hypothesis test for *one* outlier in a normal sample; G = max|xi − x̄|/s compared with a critical value at α. Dixon's Q-test for small samples; Generalised ESD for several outliers.
• Chi-square / 3-sigma control charts: SPC on a shop floor - points outside UCL/LCL = μ ± 3σ, plus run rules (seven points one side of the centre line).
• Mahalanobis distance (multivariate): D² = (x − μ)ᵀΣ⁻¹(x − μ) accounts for scale and correlation; under normality D² ~ χ²(p), so cut at the χ² quantile. Use Minimum Covariance Determinant (MCD) for a robust Σ.
• Gaussian / GMM density: fit p(x), flag p(x) < ε. Multivariate Gaussian catches correlated anomalies that per-feature rules miss.
• Extreme value theory: model the tail (POT / generalised Pareto) when you need a principled quantile for very rare events - used in financial risk.

Distance, density and tree-based algorithms

• k-NN distance score: anomaly score = distance to the k-th nearest neighbour (or mean of the k). Simple, strong baseline; O(n²) and fails when clusters have different densities.
• LOF (Local Outlier Factor): compares a point's local reachability density with that of its neighbours. LOF ≈ 1 normal, LOF ≫ 1 outlier. Handles varying density - its key advantage over global k-NN. Sensitive to k; cost O(n²) without indexing.
• Isolation Forest: builds random trees by picking a random feature and a random split value; anomalies get isolated in few splits, so they sit at short average path length. Score s(x) = 2^{−E[h(x)]/c(n)}, with s → 1 anomalous, s ≈ 0.5 normal. Near-linear time, low memory, works in high dimensions, needs no distance metric - the practical default on tabular data.
• One-class SVM: maps data to a feature space (usually RBF kernel) and finds the boundary enclosing a fraction (1 − ν) of the training points; sign of the decision function gives the label. Powerful but O(n²-n³) and sensitive to ν and γ; assumes clean training data.
• SVDD (support vector data description): the hypersphere variant of the same idea.
• Clustering-based: run k-means or DBSCAN and flag points far from every centroid, or DBSCAN's noise points (label −1), which are its anomalies by construction.
• PCA reconstruction: project onto the top k components, rebuild, and flag large residuals; equivalent to a linear autoencoder and very fast.
• Autoencoder / deep methods: a neural network trained to reconstruct normal data; reconstruction error ‖x − x̂‖² is the score. Variational autoencoders, LSTM autoencoders for sequences, GAN-based (AnoGAN) and deep SVDD extend it. Needs lots of clean normal data and GPU-ish resources.
• Time-series specific: residuals from STL/seasonal decomposition, ARIMA or Prophet forecast error beyond a prediction interval, CUSUM/EWMA for drift, matrix profile for repeated-subsequence discords, and Twitter-style seasonal-hybrid ESD.
• Ensembles: average or rank-average several scores (feature bagging); more stable than any single detector because no one method dominates all datasets.

Step-by-step workflow

1. Define the anomaly in business terms - fraud, failure, data-entry error - and who acts on the alert. Different definitions need different methods.
2. Explore: boxplots, histograms, scatter and correlation; separate genuine outliers from data-quality faults (−999 sentinels, 0 for missing, unit mix-ups).
3. Prepare features: scale (standardise or robust-scale) for every distance/density method - isolation forest and trees do not need it; engineer deviation features (amount ÷ customer's 30-day median, time since last txn, velocity counts).
4. Choose the setting (supervised / novelty / unsupervised) by what labels you actually have.
5. Fit on normal-ish data, set contamination from business capacity (how many alerts per day can analysts review?).
6. Score and threshold: pick the cut-off from a precision-recall curve or from the top-N alerts the team can handle; keep the score, not just the label.
7. Validate: on labelled holdout use PR-AUC, recall at fixed alert volume, precision@k; without labels use stability, expert review of the top alerts, and injected synthetic anomalies.
8. Explain the alert: feature contribution (SHAP, per-feature z-score, reconstruction error per feature) - a bank analyst must know *why* it fired.
9. Deploy and monitor: retrain on drift, track alert rate, false-positive feedback from investigators, and keep a human in the loop for action.

Imbalanced-data handling and evaluation

• Accuracy is meaningless at 0.1% positives; use precision, recall, F1, F2 (recall-weighted), PR-AUC, MCC. ROC-AUC looks optimistically high under extreme imbalance.
• Confusion-matrix thinking: a false negative is a missed fraud (money lost); a false positive is a blocked genuine customer (service cost and annoyance). Cost ratio sets the threshold, not 0.5.
• Resampling (supervised only): SMOTE / ADASYN oversample the minority, random undersampling of the majority, or class weights. Apply resampling inside cross-validation folds, never before splitting.
• Anomaly detection vs classification: use a detector when positives are too few or too varied to learn (new fraud patterns appear monthly); use a classifier once you have thousands of labelled, similar positives. Hybrid: detector generates candidates, classifier ranks them.
• Curse of dimensionality: in high dimensions all pairwise distances converge, so distance/density methods degrade - reduce with PCA, use subspace methods or isolation forest.

Indian regulatory and practice context

• RBI requires scheduled banks and payment operators to run real-time fraud risk management and transaction-monitoring systems, with a board-level special committee for monitoring and follow-up of fraud cases; frauds are reported through RBI's reporting system (FRM/CPFIR) and customer liability for unauthorised electronic transactions is limited if reported promptly - the exact thresholds and timelines are set by RBI's circular on limited customer liability, which is revised from time to time, so quote the circular rather than a number.
• NPCI operates fraud-monitoring on UPI/IMPS/NETC rails and shares risk scores with member banks; velocity and amount-limit rules sit alongside ML scores.
• Digital Personal Data Protection Act, 2023 governs use of customer data for such monitoring - purpose limitation, data minimisation and breach notification apply to the features you build; rules under it have been notified in stages, so check the current stage before claiming an obligation is live.
• SEBI mandates surveillance and alert systems at exchanges and brokers for market manipulation (circular trading, spoofing); PMLA and FIU-IND require suspicious transaction reports.
• CERT-In directions (2022) require reporting of specified cyber incidents within 6 hours and log retention for 180 days - the raw material for intrusion-detection anomaly work.
• Manufacturing and utilities: condition monitoring and SPC follow ISO/IS standards on machine vibration measurement and evaluation; smart-meter theft detection under discom loss-reduction programmes is a large Indian deployment of anomaly detection.

Key points

• Anomaly - a point from a different generating process; rare *and* deviant, not just large.
• Point / contextual / collective - the three structural types; contextual needs conditioning features, collective needs windows or sequences.
• Outlier vs novelty detection - training data contaminated vs training data clean normals only.
• Anomaly score - continuous output; always threshold it separately from the model, because the cut-off is a business decision.
• Contamination ν - assumed anomaly fraction; wrong ν is the commonest cause of useless alert volumes.
• Z-score rule - |z| > 3 for near-normal data; suffers masking, so prefer median/MAD.
• IQR rule - 1.5×IQR fences, distribution-free, the boxplot default.
• Mahalanobis distance - scale- and correlation-aware multivariate distance; D² ~ χ²(p) under normality.
• LOF - local density ratio; ≈1 normal, ≫1 anomalous; the method for varying-density data.
• Isolation Forest - anomalies isolate in few random splits → short path length; near-linear time, scale-free, the tabular default.
• One-class SVM - RBF boundary around normal data; ν bounds the outlier fraction; costly and parameter-sensitive.
• DBSCAN noise - points labelled −1 are anomalies for free from a clustering run.
• Reconstruction error - PCA or autoencoder residual as score; good for images, sensors and high-dimensional signals.
• PR-AUC / recall@alert-budget - the right metrics; accuracy and ROC-AUC mislead under extreme imbalance.
• SMOTE and class weights - for *supervised* imbalance only, applied inside CV folds.
• Curse of dimensionality - distances concentrate; reduce dimensions or use tree/subspace methods.
• Explainability - per-feature contribution must accompany every alert for investigator action and RBI/SEBI audit.
• Human in the loop - detector proposes, analyst disposes; investigator feedback becomes tomorrow's labels.

Formulas and examples

Example 1 - z-score vs IQR vs modified z-score on UPI amounts (₹). Data (n = 12): 120, 150, 180, 200, 210, 220, 240, 260, 280, 300, 320, 9000.

• Sum = 120+150+180+200+210+220+240+260+280+300+320+9000 = 11,480 → mean x̄ = 11,480/12 = ₹956.67.
• Deviation of 9000 = 8043.33. Sum of squared deviations ≈ 836.67²+806.67²+776.67²+756.67²+746.67²+736.67²+716.67²+696.67²+676.67²+656.67²+636.67²+8043.33² ≈ 6.47×10⁷+5.92×10⁶(others) ≈ 7.06×10⁷ → sample variance ≈ 7.06×10⁷/11 ≈ 6.42×10⁶, s ≈ ₹2,534.
• z(9000) = 8043.33/2534 ≈ 3.17 → just crosses 3, because the outlier itself inflated s. Masking demonstrated.
• Quartiles (sorted, n = 12): Q1 = midpoint of 180 and 200 = 190; median = (220+240)/2 = 230; Q3 = midpoint of 280 and 300 = 290. IQR = 100. Upper fence = 290 + 150 = 440 → 9000 flagged decisively (it is also beyond the 3.0·IQR extreme fence of 590).
• Modified z: median = 230; absolute deviations = 110,80,50,30,20,10,10,30,50,70,90,8770 → sorted 10,10,20,30,30,50,50,70,80,90,110,8770 → MAD = (50+50)/2 = 50. M(9000) = 0.6745 × 8770/50 ≈ 118.3 → overwhelming. Robust rules beat the plain z-score.

Example 2 - Mahalanobis distance with correlated features. Features: monthly income (₹ '000) and loan EMI (₹ '000), μ = (50, 15), Σ = [[100, 40], [40, 25]].

• |Σ| = 100×25 − 40×40 = 2500 − 1600 = 900. Σ⁻¹ = (1/900)[[25, −40], [−40, 100]].
• Applicant A = (70, 23): d = (20, 8). D² = (1/900)[25(20²) − 2(40)(20)(8) + 100(8²)] = (1/900)[10,000 − 12,800 + 6,400] = 3,600/900 = 4.0.
• Applicant B = (70, 5): d = (20, −10). D² = (1/900)[25(400) − 2(40)(20)(−10) + 100(100)] = (1/900)[10,000 + 16,000 + 10,000] = 36,000/900 = 40.0.
• Threshold: χ²(2, 0.99) = 9.21. A (4.0) is normal - high income with proportionally high EMI follows the correlation. B (40.0) is a strong anomaly - high income with a tiny EMI breaks the pattern, even though each value alone is unremarkable. Euclidean distance would have called both almost equally far (21.5 vs 22.4).

Example 3 - Isolation Forest score. Dataset n = 256, a point has average path length E[h(x)] = 4.2 across 100 trees.

• c(256) = 2(ln 255 + 0.5772) − 2(255)/256 = 2(5.5413 + 0.5772) − 1.9922 = 12.2370 − 1.9922 = 10.245.
• s = 2^{−4.2/10.245} = 2^−0.4100 = 0.752 → clearly anomalous (≈0.75 ≫ 0.5).
• A normal point with E[h(x)] = 10.3: s = 2^−1.0054 = 0.498 ≈ 0.5 → normal. With a contamination of 1%, only the top 2.56 points (≈3) by score are flagged.

Example 4 - Threshold choice from costs (card fraud). 10,00,000 transactions/month, fraud rate 0.05% → 500 frauds. Average fraud loss ₹8,000; cost of investigating/blocking a genuine transaction ₹150.

• Net benefit = recall × 500 × ₹8,000 − FP × ₹150. The medium threshold wins at ₹27.14 lakh, not the highest-recall one: chasing recall past the economic break-even destroys value. Accuracy at the medium setting = (999,500 − 4,575 + 425)/10,00,000 ≈ 99.5% - slightly *worse* than the 99.95% a do-nothing "all normal" model gets, which is why accuracy is never reported here.

Example 5 - metrics on an imbalanced confusion matrix. TP = 425, FP = 4,575, FN = 75, TN = 9,94,925.

• Precision = 425/5,000 = 0.085; Recall = 425/500 = 0.85; F1 = 2(0.085)(0.85)/(0.085+0.85) = 0.1445/0.935 = 0.1546.
• F2 (recall weighted, β = 2) = 5(0.085)(0.85)/(4×0.085 + 0.85) = 0.36125/1.19 = 0.3036 - a fairer score when a miss costs far more than a false alarm (β = 2 weights recall four times as heavily as precision).

Method comparison

import numpy as np
from sklearn.ensemble import IsolationForest
from sklearn.neighbors import LocalOutlierFactor
from sklearn.preprocessing import RobustScaler
from sklearn.metrics import average_precision_score, classification_report

X_train, X_test, y_test = load_txn_features()      # y_test: 1 = fraud

iso = IsolationForest(n_estimators=300, contamination=0.005,
                      max_samples=256, random_state=42).fit(X_train)
score_iso = -iso.score_samples(X_test)             # higher = more anomalous
print("PR-AUC (IF):", average_precision_score(y_test, score_iso))

Xs = RobustScaler().fit_transform(X_test)          # LOF needs scaling
lof = LocalOutlierFactor(n_neighbors=20, contamination=0.005)
pred_lof = lof.fit_predict(Xs)                     # -1 = outlier
score_lof = -lof.negative_outlier_factor_

# threshold by alert budget, not by 0.5
k = int(0.002 * len(score_iso))                    # top 0.2% = analyst capacity
cut = np.sort(score_iso)[-k]
print(classification_report(y_test, (score_iso >= cut).astype(int), digits=4))

Where it is used

• Banking and payments: real-time card/UPI/IMPS fraud scoring and AML transaction monitoring at HDFC, ICICI, SBI, Axis, Paytm, PhonePe, Razorpay and NPCI - roles titled Fraud Risk Analyst, Decision Scientist, AML Analytics.
• Manufacturing and energy: predictive maintenance on vibration, temperature and current signatures (Tata Steel, L&T, Siemens, Bosch, Honeywell); SPC on process lines; smart-meter theft and non-technical-loss detection for discoms.
• Cybersecurity and IT operations: intrusion detection, insider-threat UEBA and log/metric anomaly detection in SOCs and SRE teams (TCS, Infosys, Wipro, Zscaler, Freshworks); CERT-In reporting pipelines.
• E-commerce and ad tech: fake reviews, return abuse, seller collusion, bot and click fraud, price-scraping detection at Flipkart, Amazon India, Meesho, Swiggy and Zomato.
• Healthcare and insurance: claims fraud and medical-coding abuse for insurers and PMJAY-type schemes; ECG/EEG arrhythmia and medical-image abnormality screening.
• Telecom and markets: SIM-box and subscription fraud, network KPI degradation at Jio and Airtel; SEBI-mandated market-surveillance alerts for manipulation at exchanges and brokers.

Interview questions

• Q: Why is accuracy a bad metric for anomaly detection? A: With 0.1% anomalies, predicting "normal" always gives 99.9% accuracy and zero detections; precision, recall, F2 and PR-AUC on the anomaly class are what matter.
• Q: Difference between outlier detection and novelty detection? A: Outlier detection trains on data that already contains anomalies and finds them in it; novelty detection trains on clean normal data and flags new points unlike it.
• Q: How does Isolation Forest work, and why is it fast? A: Random feature/threshold splits isolate rare points in fewer splits, so a short average path length means anomalous; it subsamples (default 256 points) and builds shallow trees, giving near-linear time with no distance computation.
• Q: When would LOF beat Isolation Forest? A: When normal data has clusters of very different densities - LOF compares a point's density to its own neighbours' and so catches a point that is locally sparse but globally central.
• Q: Why use Mahalanobis instead of Euclidean distance? A: It divides out each feature's variance and the correlation between features, so it measures distance in units of the data's own spread; Euclidean treats a 1-unit change in income and in EMI as equally surprising.
• Q: A plain z-score misses an obvious outlier. Why? A: Masking - the outlier inflates the mean and standard deviation it is compared against; use median and MAD, or the IQR rule.
• Q: What is the contamination parameter and how do you set it? A: The assumed fraction of anomalies that sets the score threshold; set it from the historical base rate or from the number of alerts investigators can actually review per day, then tune on a labelled holdout.
• Q: Should you use SMOTE for an unsupervised detector? A: No - SMOTE synthesises minority-class points and needs labels; it belongs to supervised imbalanced classification, and must be applied inside cross-validation folds only.
• Q: Anomaly detection or a classifier for fraud? A: Classifier when you have many labelled, similar frauds; detector when positives are few, unlabelled or constantly changing form. Production systems usually run both - the detector surfaces novel patterns, the classifier scores known ones.
• Q: How do you detect a contextual anomaly? A: Model the expected value given the context (time of day, season, customer's own history, machine's operating mode) and score the residual, rather than scoring the raw value.
• Q: Why do distance-based methods fail in high dimensions? A: Distance concentration - as dimensionality grows, all pairwise distances become similar, so nearest and farthest neighbours stop differing; reduce dimensions or use tree-based/subspace ensembles.
• Q: An autoencoder reconstructs anomalies well and misses them. Why? A: It was over-parameterised or trained on data containing anomalies, so it learned to rebuild them; shrink the bottleneck, train on verified normals, add regularisation or use a denoising/variational variant.
• Q: How do you explain a flagged transaction to a bank investigator? A: Give the per-feature contributions - which features deviated and by how much (z-scores, SHAP values, per-feature reconstruction error) - plus the customer's own baseline for comparison, which is also what audit and RBI's monitoring expectations require.

Common mistakes

• Reporting accuracy or ROC-AUC on a 0.1%-positive problem instead of precision, recall at a fixed alert budget, and PR-AUC.
• Forgetting to scale features before k-NN, LOF, one-class SVM or Mahalanobis-style methods, so one large-unit column (income in rupees) dominates the distance.
• Deleting every point beyond the 1.5·IQR fence as "bad data" - in fraud and failure work those rows are the answer, and in skewed data (income, transaction amounts) the fence flags a large share of genuine records.
• Fitting the scaler, PCA or detector on the full dataset including the test split, or resampling before splitting - both leak information and inflate scores.
• Training a novelty detector (one-class SVM, autoencoder) on data that still contains anomalies, then wondering why recall is poor.
• Leaving contamination at its default and shipping an alert volume nobody can investigate, or tuning the threshold to 0.5 as if it were a balanced classifier.
• Treating a point anomaly method as sufficient for sequences - a flat ECG line or a burst of ₹499 transfers is a collective anomaly and needs windows, decomposition or sequence models.
• Confusing masking (outliers inflate μ and σ) with swamping (an extreme point makes normal neighbours look anomalous too) in Grubbs-style tests.

Related topics

Clustering: k-means and hierarchical · Model evaluation metrics · Dimensionality reduction and PCA · Support vector machines and k-nearest neighbours · Naive Bayes and probabilistic models · Machine learning workflow