Rare is not the same as anomalous
An anomaly is an observation worth investigating because it may signal fraud, failure, abuse, data corruption, or a new operating regime. Define that consequence, review capacity, and acceptable miss rate first. Otherwise the detector will optimize mathematical unusualness while producing alerts nobody can use.
With labels, treat it as imbalanced classification
If reliable incident labels exist, use supervised classification with the appropriate split, imbalance metrics, and operating threshold. Preserve a rule or novelty channel for cases unlike the labeled history, but do not discard useful labels merely because the product uses the word anomaly.
Without labels, the assumptions are strong
Unsupervised detectors assume important anomalies are uncommon and structurally distinguishable. That fails when rare behavior is legitimate, attackers resemble normal traffic, or the population contains several normal modes. State those assumptions and audit them against real cases.
Isolation Forest
Isolation Forest uses random partitions and treats cases isolated in fewer splits as more unusual. It is a scalable tabular baseline and avoids an explicit distance metric, but its contamination setting and feature representation still shape the alert ranking.
Local density and boundary methods
Local Outlier Factor compares a point with nearby density and can find cases unusual relative to their peers. One-class SVM estimates a boundary around normal examples but is sensitive to scaling and can be expensive as the dataset grows.
Reconstruction error for high-dimensional inputs
Autoencoders and related representation models can flag images or sensor windows reconstructed poorly. High-capacity models may also reconstruct anomalies, while normal but underrepresented cases may score badly. Reconstruction error is a signal to validate, not a guarantee.
Human review creates the evaluation set
Sample across score ranges, not only the highest alerts. Report precision at reviewer capacity, recall on known incidents where possible, time-to-detection, and false positives by subgroup. Do not tune contamination until output merely matches an assumed incident count.
Feed decisions into the next model
Capture reviewer outcomes with stable event IDs and join them back to scores. Monitor alert volume and score distributions so upstream drift cannot silently flood or empty the queue. Confirmed labels may support supervised learning over time. The production unit is scoring, thresholding, investigation, feedback, and response—not the detector alone.