Pick a scenario
Anomaly detection starts with the data. Different types of data — steady financial streams, seasonal patterns, noisy operational metrics — require different approaches. Each scenario below simulates 80 normal data points with 6 planted anomalies. Switching between them changes the data shape, and with it, the detection method that works best.
Three kinds of anomalies
Before reaching for a method, it helps to know what shape of anomaly you’re actually hunting. Three categories cover most operational cases:
A single value far outside the expected range — a €50,000 transaction in a €5k stream.
A value that's normal in isolation but abnormal in context — high traffic at 3am, normal at 3pm.
A group of points suspicious only as a sequence — 10 small transfers in a row from the same account.
Scope note
Detection playground
Now let’s apply detection methods to the data. Each method assigns every data point an “anomaly score” — a measure of how unusual it is. The sensitivity slider controls the threshold: higher sensitivity flags more points as anomalous, lower sensitivity is more conservative.
Currently detecting anomalies in transaction amounts (€) with IQR / Tukey. Red dots are flagged anomalies; grey dots are normal. Try switching methods to see how each one ranks the same data differently.
Flags points outside Q1 − k·IQR or Q3 + k·IQR. Quartile-based, robust to skew.
Reading the transaction amounts chart
Since we know where the real anomalies are, we can measure how well the method performs. Precision is the fraction of flagged points that are actually anomalies (fewer false alarms = higher precision). Recall is the fraction of real anomalies that were caught (fewer missed anomalies = higher recall). F1 balances both into a single number between 0 and 1.
Precision
75%
Recall
100%
F1 score
0.86
Which method actually wins?
The playground above lets you tune one method at a time. But how do the methods compare head-to-head? Below, all four methods run on the same data at a fixed sensitivity of 40, so the comparison is fair. The table shows precision, recall, and F1 for each — the highest F1 wins.
| Method | Precision | Recall | F1 |
|---|---|---|---|
| Z-scorebest | 75% | 100% | 0.86 |
| IQR / Tukey | 75% | 100% | 0.86 |
| Rolling Z-score | 75% | 100% | 0.86 |
| KNN-distance | 75% | 100% | 0.86 |
On transaction amounts
Fine-tuning F1
The F1 column above is at a fixed sensitivity of 40. In practice you don’t pick a number — you sweep it. Below: precision, recall, and F1 as sensitivity moves from 5 to 100 for IQR / Tukey on transaction amounts. The vertical line marks where F1 peaks.
Peak F1 · IQR / Tukey on transaction amounts
F1 = 1.00 at sensitivity = 30. Precision = 100%, recall = 100%.
Drag the sensitivity slider in the playground above to this value — the chart updates, and you can verify that F1 indeed lands at its highest point. Below this threshold, recall drops (you stop catching real anomalies); above it, precision drops (you start flagging too many normal points).
Three more levers when threshold sweeping isn’t enough:
Asymmetric F-score
Switch from F1 to F-β when false positives and false negatives have different costs. β > 1 favors recall (don’t miss real fraud); β < 1 favors precision (don’t waste reviewer time). β = 2 is common for fraud detection.
Feature engineering
Most "anomaly is hard" situations turn into "anomaly is obvious" with the right derived features: running deltas, ratios to baseline, time-of-day flags, distance from the seasonal expectation. Better features beat fancier algorithms more often than the other way around.
Cross-validation, not single split
Sweep sensitivity on a rolling window of past data, not just one holdout. The threshold that peaks F1 on March data may underperform on April. Lock in a process that re-tunes monthly.
Connecting back to operations
Anomaly detection earns its keep in audit, finance and compliance work — places where the cost of missing a true outlier (a fraudulent transaction, a misclassified expense, a service degradation) outweighs the noise of investigating a few false alarms. The same toolbox handles EVM variance flags (CV or SV that suddenly spike beyond their historical range), grant disbursement patterns that deviate from a country’s historical baseline, and procurement requests that don’t fit the expected envelope.
The practical recipe: pick the cheapest method that handles your data’s shape, tune the sensitivity so the review queue stays manageable, and rerun monthly. Add a second method only when the data demands it.
To go further
Worth exploring next: Isolation Forest and Local Outlier Factor for multivariate data with multiple correlated features; autoencoders for high-dimensional time series; and changepoint detection(ruptures, PELT) when what’s anomalous is a regime shift rather than a single point.