Is anomaly detection supervised or unsupervised?

Both exist: supervised when past failures are labeled, unsupervised when only normal behavior is available.

Why so many false alarms?

Anomalies are rare, so even a small false-positive rate on normal cases overwhelms the queue.

What makes a deployment succeed?

Thresholds set from real costs, a staffed review loop, and verdicts fed back to improve the scores.

AI Glossary / AI and machine learning / Beginner

Anomaly

Definition

An anomaly is a data point or event that departs from what is normal in a way that deserves attention: the unusual transaction, the strange sensor reading, the login from an unexpected place. Finding anomalies is one of the oldest and most valuable uses of data analysis.

What it means

Most data is boring, and that is the point. Normal transactions, normal readings and normal behavior form a pattern, and an anomaly is whatever breaks it. Detection means characterizing normal well enough that abnormal stands out.

Anomalies come in flavors. A point anomaly is one strange value, like a purchase ten times the customer's norm. A contextual anomaly is normal in one setting and strange in another, like heating running in July. A collective anomaly is a sequence that is odd together, like a hundred small logins in a minute.

Not every anomaly is a problem. Some are errors in measurement, some are fraud, some are the first sign of a new trend, and some are the most valuable records in the dataset. Detection surfaces them; judgment classifies them.

The hard part is the base rate: anomalies are rare by definition, so even good detectors produce many false alarms. A system that flags one percent of normal transactions still buries the reviewer in noise when true anomalies are one in a million.

For a business, anomaly detection is usually the first practical AI project that pays: fraud, quality, security and operations all have expensive rare events hiding in cheap normal data.

How it works

Detectors characterize normal and score deviations. Simple approaches use rules and statistics: flag anything beyond a threshold or several standard deviations from the norm. Machine-learning approaches learn the shape of normal from historical data and score how poorly each new case fits.

Supervised versions learn from labeled examples of past problems, which works when enough labeled failures exist. Unsupervised versions learn only what normal looks like, which is essential when the next fraud pattern has never been seen.

Scores need thresholds, and thresholds need economics: set them from the cost of a miss against the cost of a false alarm, and review them as the alarm queue's reality becomes known.

The review loop closes the system: analysts confirm or dismiss alerts, and their verdicts become training data that sharpens tomorrow's scores.

Three practical examples

Payments: flag transactions that break a card's usual pattern for review, blocking only the strongest signals.
Manufacturing: flag sensor readings that drift from the machine's normal vibration before a breakdown happens.
Security: flag logins from unusual places or at unusual volumes, feeding the security queue rather than locking accounts outright.

Think of it this way

Think of a security guard who knows a building so well that anything out of place registers instantly: a door ajar, a light on, a car in the wrong bay. The guard's power is knowing normal, not knowing every possible threat.

The limit: the guard also knows the building's quirks, the cleaner who works odd hours, the flickering sensor. A new detector lacks that context and flags the quirks along with the threats until it learns them.

Worked example

setting a fraud-alert threshold

Suppose a payment processor builds a detector that scores every transaction for strangeness. At a strict threshold, it catches nearly all fraud but flags so many good transactions that customers abandon purchases.

At a loose threshold, the queue empties and fraud slips through. The team prices the trade: the cost of a missed fraud case against the cost of a falsely blocked customer, and sets the threshold where total cost bottoms out. The numbers are invented; the cost-based threshold is the method.

Alert verdicts feed back weekly: confirmed fraud sharpens the model, false alarms reveal which normal behaviors it still finds strange.

The threshold is revisited monthly, because both fraud patterns and customer behavior move, and yesterday's balance point drifts.

Illustrative case study

A fictional factory's anomaly detector alarms so often that operators silence it. Three months later, a genuine bearing failure goes unnoticed inside the noise and stops the line for two days.

The redesign tiers the alarms: soft signals log quietly, medium signals queue for review, and only the strongest combinations stop anything. Alarm volume drops by an order of magnitude and operators start reading the queue again.

The invented lesson: an anomaly system is judged by its alarm queue, not its detection rate. A detector that cries wolf is worse than a threshold set honestly.

Common misconceptions and mistakes

Anomalies are always bad. They are deviations; some are fraud, some are errors, and some are the first signal of an opportunity.
A good detector flags few normals. The base rate decides: with rare anomalies, even small false-alarm rates produce big queues.
Detection is the job. Detection is the start; the verdict workflow and the feedback loop are where the value is realized.

Business use

Start anomaly projects where rare events are expensive: fraud, quality escapes, security incidents, equipment failure and data errors.

Design the economics first: price a miss and a false alarm, set thresholds from those prices, staff the review queue, and feed verdicts back as training data.

Check your understanding

Operators silence an anomaly detector after weeks of false alarms, then miss a real failure. What two changes restore the system's value?

Answer: Tier the alerts so only strong signals interrupt, and price the threshold from miss-versus-false-alarm costs, with verdicts feeding back to sharpen scoring.

Related terms

Learn next

AI for Business Owners covers setting thresholds and review loops for monitoring systems: https://aiforbusinessandlife.com/academy/ai-for-business-owners. [C2]

Sources

[S3] NIST, AI glossary (AIRC). Full URLs are in the source ledger. Verified 11 October 2026.

Previous: Annealed importance sampling Next: Anomaly detection