The one idea for today
There is no single "anomaly detector." There is a ladder of methods, and each rung earns its place by catching a different kind of odd at a different cost. The simplest rung is a threshold you could explain to your board in a sentence; the top rung is a deep model that needs a data lake and a team. Your job as a leader is not to build any of them - it is to know which rung a given problem needs, and to push back when someone reaches for the top of the ladder to solve a bottom-of-the-ladder problem.
The method ladder 12 min live
Read it from the bottom up. Each rung is more powerful than the one below, and also more expensive - more data, more compute, more to explain. The rule of the ladder: start at the bottom, and only climb when the rung below genuinely cannot see your anomaly.
Here is the same ladder as a quick-reference: what each rung catches, when it fits, and what it costs you.
| Rung | Catches | Reach for it when | Cost |
|---|---|---|---|
| Statistical z-score, IQR, MAD | Obvious point anomalies - a value far from the rest | One number, roughly stable, and you want an explainable threshold | Tiny - a line of logic |
| Rolling / seasonal | Contextual anomalies - odd for their time or season | The data has a rhythm (weekday, weekend, holiday) that a flat threshold would fight | Low |
| Distance / density kNN, LOF | Points sitting in a sparse, lonely neighbourhood | Several signals at once, no clean "normal" sample, moderate data size | Medium - slows on big data |
| Isolation Forest | Anything that is easy to separate from the crowd | Many signals, lots of rows, you want fast and low-fuss | Medium - scales well |
| One-class OC-SVM, Elliptic Envelope | Departures from a learned shape of "normal" | You have a clean sample of normal-only data to learn from | Medium |
| Deep autoencoders | Complex, high-dimensional patterns simpler methods cannot model | Images, sequences, or rich signals - and a large dataset and a team | High - data, compute, expertise |
LiveThe bottom three rungs - cheap and often enough3 min▶
Most real problems are solved on the bottom three rungs. Do not skip past them for something shinier.
- Statistical - a z-score, an IQR fence, or a robust MAD. It asks: how far is this value from the typical value? Cheap, instant, and you can explain it in one sentence. It catches obvious point spikes and drops, and nothing subtler. The robust version (MAD) matters because a few big outliers can inflate a plain standard deviation and blind it.
- Rolling / seasonal - the same idea, but each point is judged against its local or seasonal context instead of the global average. This is the rung that finally catches contextual anomalies: a weekday sitting at a weekend-low level, which a flat threshold waves through. If your data has any rhythm, you climb to here.
- Distance / density - when a point has several signals at once, you look at its neighbourhood. kNN asks "how far to your nearest neighbours?"; Local Outlier Factor (LOF) asks the sharper question "is your neighbourhood far sparser than your neighbours' neighbourhoods?" These catch multivariate oddities the bottom two rungs cannot see.
Self-studyThe top three rungs - powerful, and pricier3 min read▶
- Isolation Forest - built on a lovely intuition: anomalies are few and different, so they are easy to isolate. Split the data with random cuts and the odd points get separated in just a few cuts, while normal points take many. It is fast, scales to lots of rows and columns, and needs little tuning - a strong default when you have many signals.
- One-class - instead of hunting outliers directly, learn the shape of normal and flag anything outside it. One-Class SVM draws a tight boundary around the normal region; Elliptic Envelope fits a robust Gaussian bubble. Both need a reasonably clean sample of normal-only data, which is their catch.
- Deep (autoencoders) - a neural net learns to compress and rebuild normal data; when it fails to rebuild a point well, that reconstruction error flags an anomaly. This is the rung for genuinely complex, high-dimensional data - images, long sequences, rich sensor streams. It is powerful and hungry: it needs a large dataset, real compute, and expertise, so it is the last rung you climb, not the first.
The over-reach trap. A team spends a quarter building an autoencoder to flag a daily traffic spike - a job a z-score does in one line. Deep methods (surveyed in Pang et al., 2021) are real and valuable, but on a single well-behaved metric they are a Ferrari in a car park. The ladder exists so you climb only as high as the anomaly forces you to.
You almost never have labels 5 min live
There is a fork before you even pick a rung: do you have labelled examples of past anomalies? Usually you do not. Anomalies are rare, and the truth about them arrives late - after an investigation, a customer complaint, a post-mortem. So most detection is unsupervised: the method assumes anomalies are rare and different, and scores how much each point stands out, with no answer key. This is why the whole ladder above is built for the no-labels world.
Self-studyThe three label situations, and what each unlocks2 min read▶
- Unsupervised (the common case) - no labels at all. Every rung of the ladder works here. You cannot directly measure how well you are doing, which makes honest evaluation the hard part (session 5).
- Semi-supervised - you have a clean sample of normal data only. This unlocks the one-class rung: learn what normal looks like, flag the rest.
- Supervised - you have labelled anomalies. Rare, precious, and heavily imbalanced. It becomes a classification problem with special care, and the labels almost always arrive late via investigation, not up front.
No free lunch - match the method to the anomaly 8 min live
No method wins everywhere. The right rung is decided by three questions about your problem: is it a time series, do you have a clean sample of normal, and how many signals does each point carry? Walk the chooser and it points you at a family. It is a starting point, not a verdict - but it stops you reaching for the top of the ladder by reflex.
Same company, different rungs. Lumen watches daily site traffic (one signal, strong weekly rhythm) - that is the rolling/seasonal rung. Its fraud team watches transactions (many signals per event, no clean normal sample) - distance/density or isolation. Its image-QA line inspects product photos (rich, high-dimensional) - the deep rung. One org, three rungs, because the anomaly and the data differ. Asking "which detector is best?" is the wrong question; "which rung does this problem sit on?" is the right one.
Try it yourself - this week ◐ 20-30 min total
- Pick one real detection need in your org (a spike, a drop, a fraud pattern, a defect). Write down what a single anomaly looks like.
- Walk it through the chooser: is it a time series, do you have a clean normal sample, how many signals per point?
- Pick the rung the chooser lands on, and write one sentence justifying it - what it catches, and why a lower rung would miss it.
- Sanity-check for over-reach: could a rung below solve it just as well and cheaper? If yes, drop down.
- Optional: skim the technique families in Chandola, Banerjee & Kumar (2009), "Anomaly Detection: A Survey" - the taxonomy this ladder follows.
Sources covered (cited)
Taught from the anomaly-detection canon. This session covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · Your metric is a single daily number with a strong weekly rhythm. Which rung fits first?
One signal with a rhythm sits on the rolling/seasonal rung. A flat threshold would fight the weekly pattern, and a deep model is wild over-reach for a single metric.
2 · Why is most real anomaly detection unsupervised?
You rarely have an answer key up front. Labels come late, via investigation - so methods must score how much each point stands out with no labels, and any labels you get are precious.
3 · What does "no free lunch" mean for choosing a detector?
The right method depends on the problem - time series, labels, number of signals. Start low on the ladder and climb only when the rung below cannot see your anomaly.