Where we are
Last session we settled the one idea - flag the point that does not belong - and the trade-off you price on every project: cost of a miss against cost of a false alarm. Tonight we get sharper about what "does not belong" actually means, because it comes in three flavours. The canonical survey (Chandola, Banerjee & Kumar, 2009) names them point, contextual, and collective. The reason a leader cares is practical: the type decides which detector can even see the anomaly, so getting the type wrong is how detection projects quietly fail.
The three types, on one series 8 min live
Here is the whole taxonomy on a single line of Lumen's daily web traffic. Watch how differently the three kinds behave: one leaps off the chart, one hides in plain sight at a perfectly normal value, and one only reveals itself as a stretch.
LiveThe three types, in one sentence each4 min▶
- Point - a single value far from everything else. The easy case. Example: a card suddenly charged $9,000 when this cardholder never breaks $200. It stands out on its own, so even a crude threshold catches it.
- Contextual - a value that is perfectly normal in general, but wrong for this context. Example: a quiet Tuesday. Tuesday traffic at a Sunday level is not a strange number - plenty of days sit there - but for a Tuesday it is alarming. You cannot see it without knowing "it is a Tuesday".
- Collective - no single point looks wrong, but a run of them together is. Example: a slow leak - a tank that drips a little longer each hour. Any one reading is plausible; the sustained stretch is the anomaly. You have to look at the window, not the point.
Notice the difficulty climbs as you go down the list. Point anomalies are the ones everyone already catches. Contextual and collective are where the fraud, the slow outages, and the subtle defects hide - and where the rest of this course earns its keep.
Lumen carries all three. The bot surge that triples one day's sessions is a point anomaly - obvious. The weekday sitting at a weekend-low level is contextual - the number is fine, the day is not. And a sustained odd run of elevated evenings would be collective - no single hour alarming, the stretch unmistakable. One brand, one metric, all three shapes.
Why context changes everything 5 min live
Contextual anomalies deserve their own moment, because they are the ones simple detectors are blind to - and the ones that cause the most expensive misses. The trap is that the value looks completely normal. The exact same number can be perfectly fine on one day and a red flag on another.
Self-studyWhy the type decides the detector3 min read▶
This is the single most useful rule in the course, and it is why one detector is never enough:
- Global methods (a simple threshold, a z-score) only ask "is this value extreme overall?" They catch point anomalies beautifully and miss contextual ones completely - the value is not extreme, only wrong for its day.
- Context-aware methods first strip out the expected pattern (the weekly rhythm) and then look at what is left. Now the quiet Tuesday finally stands out. This is what "deseasonalize before flagging" means.
- Window methods look at stretches of points rather than one at a time, which is the only way to catch a collective anomaly - a run where no single point is alarming.
So when a team proposes a detector, the leader's question is simple: which type are we trying to catch, and can this method even see it? A mismatch there is a guaranteed miss, no matter how sophisticated the model sounds.
Which type points to which kind of method 3 min live
You do not need to know the algorithms yet (that is a3). You only need the mapping - which shape of anomaly calls for which broad kind of detector. Keep this picture; it is the spine of the whole method discussion.
Try it yourself - this week ◐ 20-30 min total
- Think of three real anomalies you have seen - a fraud case, an outage, a weird sales day, a quality escape, anything.
- Classify each into one of the three types: point (stood out on its own), contextual (normal value, wrong context), or collective (a run that was wrong together).
- For any you labelled contextual, name the context that made it wrong (day of week, season, customer, location) - that is the pattern a detector would have to remove first.
- Ask which type your current monitoring is actually built for, and whether the anomalies you worry about are that same type.
- Optional: revisit the taxonomy section of Chandola, Banerjee & Kumar (2009) - the source of these three names.
Sources covered (cited)
Taught from the anomaly-detection canon. This session covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · A card is charged $9,000 when this cardholder never breaks $200. Which type of anomaly is that?
One value far from the rest, standing out on its own, is a point anomaly - the easy case a simple threshold can catch.
2 · Why do simple global detectors miss contextual anomalies?
A quiet Tuesday sits at a value plenty of days share. Only by removing the weekly pattern (deseasonalizing) does the wrong-for-its-day dip stand out.
3 · A slow leak where each hourly reading is plausible but the sustained stretch is wrong is which type?
Collective anomalies live in the window, not the point. You need methods that judge a stretch, because no single reading looks wrong.