AI glossary · Basic · Classic ML, recsys & search
Anomaly detection
Anomaly detection is a machine learning technique that learns the "normal pattern" shown by most of the data and automatically finds rare cases that deviate sharply from it.
About this term
- Level
- Basic · Technical terms you often meet in AI news
- Category
- Data, ops & platforms
- Added
- 2026-10-08
How it works
Anomalies are so rare, and their types so hard to know in advance, that there is often too little data labeled "this is anomalous." So the usual approach is unsupervised learning, which learns the normal pattern from normal data only. When new data comes in, the model scores how far it is from the normal pattern as an "anomaly score," and raises an alert if the score exceeds a preset threshold. Methods include statistical methods that measure distance from the average, distance-based methods that find points with almost no close neighbors (such as KNN), tree-based methods that randomly split the data to find points that are easily isolated (Isolation Forest), and deep learning methods that compress and reconstruct normal data and treat whatever does not reconstruct well as anomalous.
How anomaly detection reaches an alert
- 1Collect normal dataMostly normal records
- 2Learn the normal patternStatistics, distance, trees, deep learning
- 3Assign anomaly scoresHow far from normal?
- 4Compare with thresholdAlert if exceeded
- 5Human reviewFeed results back
Why it matters
It is used to catch events that are rare but costly if missed, such as fraudulent card payments, early signs of factory equipment failure, server outages and security intrusions. In environments where data pours in constantly, people cannot review every record, so it is important to have something that surfaces only the suspicious items first. A major advantage is that it can be used without knowing all the anomaly labels in advance. It can catch even never-before-seen types of attacks or failures simply because they are "different from normal."
Things to keep in mind
Set the threshold too low and alerts fire even for normal cases, wearing out staff; set it too high and real problems are missed. Setting this balance to match business costs is the hardest part of real-world deployment. Also, "normal" changes over time. When data drift occurs due to seasons, new product launches or changes in the customer base, the model needs to be recalibrated. Finally, "anomalous" does not necessarily mean "a problem." Some changes have good reasons, such as a sales spike right before a holiday, so a human-in-the-loop setup, where people review alerts and the results are fed back into the model, is commonly used alongside it.
Example
A credit card company learns each customer's usual payment amounts, times of day, locations and merchant types, and flags in real time transactions that deviate sharply from the pattern, such as a large payment at an unfamiliar overseas merchant in the early morning. For high-scoring transactions, it temporarily holds the payment or sends the customer a confirmation text. In manufacturing, it is used to monitor vibration and temperature time series from equipment sensors and request an inspection before a breakdown when unusual shaking appears.