anomaly-detection

Find unusual transactions, sensor readings, log events, users or records, and choose the detection method: z-score or IQR rules, robust statistics, Mahalanobis distance, isolation forest, local outlier factor, or seasonal baselines for time series. Use whenever someone wants to detect fraud, suspicious payments, equipment faults, sudden spikes or drops, bot or attack traffic, or unusual behaviour with few or no labelled examples; set the contamination rate or anomaly score cut-off; turn a team's daily review capacity into an alert threshold; explain why a record was flagged; or test a detector against a handful of confirmed cases. Not for cleaning outliers from a training dataset before modelling, not for segmenting customers, and not for setting the threshold of a supervised classifier.