Anomaly Detection

The class-imbalance lesson had one fraud in fifty-three, and that was already a hard problem — the model learned, correctly, that guessing “legitimate” every time was the cheapest available strategy. Nine examples in a few thousand is a different order of problem. It is not that the classifier is lazy. It is that there is almost nothing to learn.

A model finds the shape of a class by seeing enough of it to notice what varies and what does not. Nine points do not have a shape. They have nine points, and a model asked to draw a boundary around them will draw one around whatever those nine happened to look like — not around fraud in general, which it has not seen enough of to describe.

It gets worse under evaluation. Split nine examples five ways for cross-validation and some folds hold one or two frauds, and some hold none at all. A fold with zero positives cannot report a recall, because there is nothing in it to recall. The score you would quote from that fold is not low. It is undefined, and averaging it in anyway is how a confident-looking number gets reported from a computation that never happened.

The fix is to stop asking the question that needs two classes. Instead of learning the boundary between fraud and not-fraud, learn the shape of ordinary behaviour — the one class with thousands of examples — and measure how far a new case sits from it. Far enough, and it gets a second look. Nothing about this needs to have ever seen a fraud.

“Far” has to mean something precise, and there is more than one way to define it. A cut-off on distance or local density is the simplest version, and the one this chapter uses: measure how far a point sits from the centre of everything ordinary, scaled by how spread out ordinary already is. Isolation forests take a different route, timing how few random splits it takes to cut a point off on its own — outliers separate fast. A one-class SVM draws the tightest boundary it can around the ordinary data and flags whatever falls outside it. An autoencoder learns to compress and rebuild ordinary examples faithfully, and a case it reconstructs badly is a case that did not look like anything it was trained on. Different mechanisms, the same underlying move.

The panel below is the simplest of these made visible: four hundred ordinary transactions plotted by two measurements of how unusual they were, nine genuine frauds scattered among them, and a circle whose radius is the cut-off. Everything the circle does not contain gets flagged.

Drag the circle in and the trade shows itself immediately. At a cut-off of 1.90 the panel catches seven of the nine frauds, and getting them costs 64 false alarms — about ten alerts opened for every real fraud sitting in the pile. Tighten it to 1.40 and every known fraud is caught, at the cost of 165 legitimate transactions swept up alongside them. Loosen it to 3.20 and the false alarms disappear entirely, and with them six of the nine frauds — the ones that were never that far from ordinary to begin with.

Notice that no setting is correct. The precision-recall lesson made the same point about a threshold on a classifier's confidence, and it applies here without modification: which mistake you would rather make is not a fact the data can hand you. It is a decision about how many alerts a review team can actually open in a day, and what a missed fraud costs when nobody opens one at all.

Which is why the honest unit here is not precision, and not recall on its own. It is alerts per real fraud found — because that is what an analyst's day is made of. A model that reports 78% recall sounds finished. A model that means a person opens ten cases to find one fraud is a staffing decision wearing a metric's clothes, and it should be argued about as one.

Everything above assumes “ordinary” holds still, and it does not. A new product launch changes the typical transaction. A payday shifts the typical hour. Ordinary behaviour is a moving target, and a cut-off fitted to last quarter's ordinary starts flagging this quarter's normal simply for having changed shape — which is precisely the false-alarm cost the panel above already made expensive.

The failure is quiet rather than sudden. Nothing crashes. The false-alarm rate simply climbs, review queues back up, and eventually someone loosens the cut-off just to make the noise stop — which is the one change that also lets fraud back through unnoticed. A threshold that is never revisited is a threshold that is already decaying; it just has not been measured yet.

1. 1

   Watch the false-alarm rate, not just the catch rate

   A rising rate of alerts that turn out clean is the first sign that ordinary has moved, well before recall visibly drops.

2. 2

   Re-fit the shape of normal on a rolling window

   Recent weeks, not the whole history — the point is to describe what ordinary looks like now, not what it looked like when the model was built.

3. 3

   Re-check the cut-off against what the review team can absorb

   A refit changes the scores. The cut-off that produced ten alerts per catch last month may produce thirty this month unless it is re-checked alongside the data.