mediumConceptDesignScenarioMidSeniorStaff
You need to flag anomalies and nobody has labelled a single one. How do you build it?
4 min readUpdated 2026-08-15
Answer
Short answer
Model what normal looks like and score deviation from it, using distance or density methods, an isolation forest, or reconstruction error from an autoencoder. Then set the threshold from how many alerts the team can investigate per day, because an unlabelled score distribution cannot tell you where to cut.
Was this answer helpful?
Likely follow-ups
- How do you evaluate this before a single confirmed anomaly exists?
- The same account trips the detector every night. What do you change?
- Why can a point be normal on every individual feature and still be a genuine anomaly?
- How would you handle a metric whose normal range shifts with the day of the week?
Related questions
- An upstream feed resets ten thousand of your prices to a penny and orders start arriving. What should have stopped it, and what do you do with the orders that got through?hardAlso on anomaly-detection6 min
- You've clustered the customer base and there are no labels. How do you know the clustering is any good?mediumAlso on unsupervised-learning4 min
- When does dimensionality reduction help, and when does it hide the problem?mediumAlso on unsupervised-learning4 min
- A transform has been writing wrong revenue figures for three days and six downstream tables have consumed it. How do you backfill the corrected data without double-counting anything?hardSame kind of round: scenario4 min