Anomaly Detection — Isolation Forest and One-Class SVM

Anomaly detection — also called outlier detection — asks a fundamentally different question from clustering: rather than grouping similar points together, it asks which points are so different from the majority that they should be flagged as suspicious. Applications are everywhere: detecting fraudulent transactions, identifying sensor faults in industrial equipment, finding manipulated match statistics, or catching data entry errors before they corrupt a model.

Most anomaly detection is unsupervised: you have plenty of normal data but few (or zero) labelled anomalies to train on. The algorithms you will study here — Isolation Forest and One-Class SVM — both learn the structure of normal data and flag points that deviate from it. DBSCAN's noise points (Lesson 27) gave you a taste of this idea; Isolation Forest and One-Class SVM are purpose-built for anomaly scoring at scale.

Analogy🏏Cricket

🏏 Think of it like cricket: imagine a ball-tracking system recording 10,000 deliveries over a season. Most deliveries cluster around normal speed, line, and length profiles. An unusual delivery — a beamer arriving at head height at 155 km/h — stands out immediately because it is easy to isolate from everything else. Isolation Forest works exactly like a selector playing 'one of these things is not like the others': anomalies are points that get separated from the rest by just a few random cuts of the feature space. Normal deliveries need many cuts to isolate; the beamer needs just one.