Editing Anomaly Detection (section)

== <span style="color: #FFFFFF;">Understanding</span> ==
Anomaly detection is fundamentally different from classification: in classification, you have labeled examples of each class. In anomaly detection, you typically only have normal data (or very few labeled anomalies), and anomalies can take any form not seen before.

'''The assumption underlying most anomaly detection''': normal data occupies a compact, well-defined region of the feature space. Anomalies lie outside this region. The challenge is defining "outside" in a meaningful, threshold-able way.

'''Unsupervised approaches''':
- '''Isolation Forest''': Trees that randomly split feature space. Anomalies are isolated by fewer splits than normal points (they're easier to isolate). Anomaly score = average path length across all trees.
- '''Autoencoders''': Train on normal data only. A model that can reconstruct normal patterns will fail on anomalies — high reconstruction error = anomaly.
- '''DBSCAN''': Points not in any dense cluster are noise/potential anomalies.

'''Statistical methods''': Fit a statistical model to normal data (Gaussian, GMM, KDE). Flag points with low probability under the model. Works well in low dimensions but fails in high-dimensional spaces (the curse of dimensionality makes all points equally distant).

'''Supervised approaches''' (when labels exist): Treat as extreme class imbalance classification. Use focal loss, class weighting, or oversampling (SMOTE). Better precision/recall but requires labeled anomalies and fails on unseen anomaly types.

'''Temporal anomaly detection''' adds complexity: what's anomalous is often contextual (day of week, trend, seasonality). LSTM autoencoders learn expected sequences; anomalies produce high sequence reconstruction error.
</div>

<div style="background-color: #8B0000; color: #FFFFFF; padding: 20px; border-radius: 8px; margin-bottom: 15px;">