Machine Learning Interactive

Anomaly Detection

Find unusual patterns that don't conform to expected behavior. Essential for fraud detection, sharp identification, and data quality.

📊 Types of Anomalies

📍

Point Anomalies

Single data point is unusual

📈

Contextual

Unusual for this context/time

📊

Collective

Group of points is unusual together

Detection Parameters

1 4

1 15

50 200

📊 Detection Performance

Precision 75%

Recall 100%

F1 Score 86%

TP: 3

FP: 1

FN: 0

TN: 96

Data Visualization

Normal points

True anomalies

Detection boundary

Threshold Trade-off

↓ Lower Threshold

✓ Higher recall (catch more)
✗ More false positives

↑ Higher Threshold

✓ Higher precision (fewer alerts)
✗ Miss more anomalies

🔧 Detection Methods

Z-Score

Distance from mean in std devs

Best for: Normal data, univariate

IQR

Outside 1.5×IQR from quartiles

Best for: Robust to skew

Isolation Forest

Random splits to isolate

Best for: High-dimensional

DBSCAN

Density-based clustering

Best for: Clusters of anomalies

🎰 Betting Applications

Fraud Detection

Unusual betting patterns

Sharp Detection

CLV > expected

Line Errors

Odds far from consensus

Data Quality

Stats outside possible range

R Code Equivalent

# Anomaly detection methods
library(isotree)

# Z-score method
zscore_anomaly <- function(x, threshold = 2.5) { 
  z <- scale(x)
  abs(z) > threshold
}

# IQR method
iqr_anomaly <- function(x, k = 1.5) { 
  q1 <- quantile(x, 0.25)
  q3 <- quantile(x, 0.75)
  iqr <- q3 - q1
  x < (q1 - k * iqr) | x > (q3 + k * iqr)
}

# Isolation Forest
iforest_anomaly <- function(df, contamination = 0.05) { 
  model <- isolation.forest(df, ntrees = 100)
  scores <- predict(model, df)
  scores > quantile(scores, 1 - contamination)
}

# Apply
anomalies <- zscore_anomaly(df$feature)
cat(sprintf("Detected %d anomalies (%.1f%%)\n", 
    sum(anomalies), mean(anomalies) * 100))

✅ Key Takeaways

• Anomaly detection finds unusual patterns
• Trade-off between precision and recall
• Z-score works for normal data

• Isolation Forest for high dimensions
• Define "anomaly" based on business context
• Use for fraud, sharps, data quality