Unsupervised Anomaly Detection Methods

Anomalies are rare and often unlabelled, so most detection is unsupervised: define what normal looks like and flag departures from it. Every method makes that definition differently, and the definition is the assumption that determines what gets found and what is missed.

The three families

Density-based. Anomalies are points in low-density regions. Local outlier factor compares a point's local density to its neighbours', so it detects points that are unusual relative to their own neighbourhood rather than globally, which matters when the data has clusters of very different densities. Kernel density estimates and Gaussian mixtures make the same assumption parametrically. All degrade in high dimension, where density estimation itself becomes unreliable.

Distance and isolation-based. Anomalies are far from other points, or are easy to separate. Isolation Forest inverts the usual framing: it builds random trees and measures how few splits are needed to isolate a point, on the reasoning that anomalies are isolated quickly because they sit apart. It is fast, has near-linear complexity, needs no distance metric, and handles high dimension better than density methods, which is why it is a common default.

Reconstruction-based. Anomalies are points a model of normality cannot reproduce. Train an autoencoder or a PCA projection on the data, and flag points with high reconstruction error, on the assumption that the model has learned the manifold normal data lies on and cannot represent departures from it.

Each encodes a different meaning of anomalous, and a point can be anomalous under one and ordinary under another. Choosing between them is choosing a definition, not tuning for accuracy.

The contamination assumption

Every unsupervised method is trained on data that contains anomalies, since that is the setting. Reconstruction methods are most vulnerable: an autoencoder with enough capacity learns to reconstruct the anomalies too, and the error signal disappears exactly where it was needed. Constraining capacity, training on a curated clean subset, or iterating between detection and refitting are the responses.

Most implementations also take a contamination parameter, the assumed anomaly fraction, and use it to set the threshold. It is frequently left at a default and is doing a great deal of work, since it directly determines how many points are flagged regardless of what the scores look like.

When it breaks

High dimension breaks distance. As dimension grows, distances between points concentrate, so nearest and farthest neighbours become comparably far and any distance-based notion of outlyingness loses discrimination. Subspace methods and feature selection are the responses, and both require deciding which dimensions matter.

Contextual anomalies need the context as a feature. A temperature of 30 degrees is normal in summer and anomalous in winter, and no method detects that unless season is available to condition on. Much of what is called a detection failure is a missing feature.

Collective anomalies are invisible pointwise. A sequence where each value is ordinary but the pattern is wrong requires modelling the sequence, so pointwise methods on windowed features, or sequence models, are needed rather than point detectors.

Scores are not comparable across methods or across runs. Each family produces a score on its own scale with no probabilistic meaning, so a threshold tuned for one does not transfer, and ensembling requires normalising scores whose distributions differ in shape as well as in range.