Anomaly detection
Anomaly detection is the identification of observations, events, or behaviors that substantially deviate from expected patterns or a normal baseline.
Data-Driven Cybersecurity
An anomaly is an observation or activity that deviates significantly from an expected pattern or reference value.
- How it is used
- Uses deviations from normal activity to direct cybersecurity investigation and support earlier threat detection.
- How deep it goes
- Defines behavioral baselines and works through detection examples and Python methods, while treating flags as candidates requiring investigation rather than proof.
- Examples
- Illustrates suspicious transfers and geographic login patterns, then uses synthetic network-device data for a DBSCAN exercise.
- What you can do after
- Apply it via Python examples to flag unusual activity, then investigate alerts and assess detection and response metrics.
Read how Data-Driven Cybersecurity explains anomaly detection →
Time Series Forecasting Using Foundation Models
Anomaly detection is the task of identifying observations or patterns that substantially deviate from expected behavior.
- How it is used
- Deploys anomaly detection as a secondary capability of time-series forecasting models for practical series monitoring.
- How deep it goes
- Works through rolling forecasts, interval thresholds, implementation functions, plots, and precision-recall evaluation, but stops short of comprehensive benchmarking.
- Examples
- Uses daily New York City taxi rides to compare TimeGPT, Chronos, Moirai, Time-LLM, Flan-T5, and Llama-3.2.
- What you can do after
- Apply it via forecasting APIs or Python workflows, then diagnose detections with plots and precision, recall, and F1 score.
Read how Time Series Forecasting Using Foundation Models explains anomaly detection →
Financial AI in Practice
The identification of observations or patterns that substantially differ from expected behavior, including without labeled training examples.
- How it is used
- Flags unfamiliar transaction patterns for fraud investigation when known-pattern classifiers may miss new tactics.
- How deep it goes
- Works through autoencoder training, reconstruction-error scoring, threshold selection, shadow testing, and monitoring; defers network and graph detection.
- Examples
- Uses legitimate transaction training, reconstruction-error distributions, and atypical legitimate travel to distinguish alerts from confirmed fraud.
- What you can do after
- Build it from scratch with an autoencoder, then test alert thresholds in shadow mode and monitor review results.
Read how Financial AI in Practice explains anomaly detection →
Cloud Observability in Action
Anomaly detection is the identification of observations or behavior that significantly deviates from an established normal baseline.
- How it is used
- Uses metric baselines to identify abnormal service behavior and trigger operational alerts.
- How deep it goes
- Explains baselines, normal ranges, automation, and alerting, but defers detailed detection methods.
- Examples
- Uses metric thresholds, healthy-service observations, Prometheus anomaly detector, and CloudWatch website monitoring.
- What you can do after
- Operate metric monitoring by establishing baselines, recognizing deviations, and configuring notifications for abnormal values.
Read how Cloud Observability in Action explains anomaly detection →
Digital Twins in Action
An anomaly is an observation or condition that deviates from expected system behavior or normal operating patterns.
- How it is used
- Identifies unusual sensor behavior in a digital twin before a predefined fault becomes apparent.
- How deep it goes
- Defines anomaly detection against faults and diagnostics, then works through a rolling z-score calculation; does not establish a diagnostic cause.
- Examples
- Uses indoor PM2.5 readings, a bushfire-shifted baseline, and a pandas calculation over Parquet data.
- What you can do after
- Build it from scratch with pandas rolling statistics and a z-score threshold to flag unusual PM2.5 readings.
Read how Digital Twins in Action explains anomaly detection →
Machine Learning Algorithms in Depth
A technique for identifying observations that differ substantially from established data patterns.
- How it is used
- Flags unusual observations in unlabeled data and detects anomalous behavior in time-series sensors.
- How deep it goes
- Derives Gaussian likelihoods, latent-space regularization, training objectives, thresholding, and a from-scratch LSTM-VAE implementation.
- Examples
- Uses distant points from clusters, multivariate sensor signals, a square wave, and the Numenta Anomaly Benchmark.
- What you can do after
- Implement an LSTM-VAE anomaly detector from scratch with Keras/TensorFlow and threshold log-likelihood drops.
Read how Machine Learning Algorithms in Depth explains anomaly detection →
Data Without Labels
Anomaly detection is the identification of observations or behaviors that deviate substantially from an expected pattern.
- How it is used
- Uses unlabeled data to discover expected patterns and flag outliers for investigation.
- How deep it goes
- Defines pattern-based detection and reconstruction error, but stops short of implementation procedures, thresholds, and evaluation metrics.
- Examples
- Uses network-provider monitoring, outliers in clustered data, and autoencoder reconstruction errors as concrete detection examples.
- What you can do after
- Evaluate unusual observations using unsupervised patterns, outliers, or autoencoder reconstruction error.
Related concepts
- fraud detectioncontrasts with · Fraud detection is the process of identifying transactions, activities, or other events suspected of involving intentional deception or unauthorized gain.
- autoencoderaddressed by · An autoencoder is a neural network that encodes input data into an internal representation and decodes it to reconstruct the input or an approximation.
- unsupervised learningused by · Unsupervised learning is a machine-learning approach that discovers patterns, structure, or representations in data without labeled target outputs.
- support vector machineused by · A support vector machine is a supervised-learning model that uses support vectors to determine a maximum-margin decision boundary or regression function, optionally using kernels to model nonlinear relationships.
- prediction intervalconfigured by · A prediction interval is a range computed from a forecasting model that is expected to contain a future or unobserved value at a specified confidence level.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.