---
title: "Anomaly detection challenges and schemes"
subject: "Data Mining"
chapter: 6
key: "semester_7/data_mining:anomaly-challenges-schemes"
source: https://www.bctengineer.com/q/semester_7/data_mining/anomaly-challenges-schemes
site: BCT Engineering
---

# Anomaly detection challenges and schemes

Data Mining · Chapter 6: Anomaly / Fraud Detection

- Asked in: year not given
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_7/data_mining/anomaly-challenges-schemes
- Whole chapter: https://www.bctengineer.com/md/semester_7/data_mining/chapter-6

## Question

What are the challenges in Anomaly Detection? Explain different types of anomaly detection schemes.

## Short answer

Anomaly detection faces unclear normal boundaries, domain dependence, scarce labels, noise, class imbalance, high dimensionality, threshold choice, and streaming needs. Schemes are supervised, semi-supervised, unsupervised; statistical, proximity, density, clustering, classification; and point, contextual, collective anomalies.

## Answer

#### Challenges in anomaly detection
1. **Defining normal** behaviour: the boundary between normal and abnormal is not clear, and normal behaviour keeps changing.
2. **Different domains**: the notion of an anomaly depends on the application, so a method cannot easily be transferred.
3. **Lack of labelled data**: labelled anomalies are rare and costly to get; training data may be contaminated.
4. **Noise** that looks like anomalies, and adversaries making anomalies look normal (fraudsters).
5. **Class imbalance**: anomalies are only a tiny fraction (< 1%) of the data; accuracy is a poor measure and false alarms are costly (base-rate fallacy).
6. **High dimensionality** and different attribute types.
7. **Choosing the right number or degree of outlierness** (a threshold), and interpretability of results.
8. Real-time requirements for streaming data.

#### Types of anomaly detection schemes
1. **By availability of labels**
   - *Supervised*: both normal and anomaly labels available; a classifier is built (class imbalance is a problem).
   - *Semi-supervised*: only normal data labelled; model of normal; deviation = anomaly.
   - *Unsupervised*: no labels; assumes anomalies are rare and different.
2. **By method**
   - *Statistical (model-based)*: assume a distribution (e.g. normal); objects with low probability are outliers.
   - *Proximity (distance)-based*: an object far from its neighbours is an outlier.
   - *Density-based*: object in a region of much lower density than its neighbours (LOF).
   - *Clustering-based*: objects not belonging to any large cluster, or far from the centroid.
   - *Classification-based*, and graphical (box plot, scatter plot) approaches.
3. **By type of anomaly**: point anomaly, contextual (conditional) anomaly (e.g. 35 °C in winter), and collective anomaly (a group of related records).

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. Why is accuracy a poor measure in anomaly detection?
   A. Anomalies are a tiny fraction (<1%), so predicting all normal scores high accuracy
   B. Anomalies are the majority
   C. Accuracy cannot be computed
   D. Normal data is always labelled wrongly
   Answer: A. Class imbalance makes accuracy misleading and false alarms costly. (Key point: Class imbalance)

2. In the semi-supervised scheme, which data are labelled?
   A. Only anomalies
   B. Both
   C. Only normal data; deviation from the normal model is an anomaly
   D. None
   Answer: C. Semi-supervised builds a model of normal from normal labelled data. (Key point: Semi-supervised)

3. What is a contextual anomaly?
   A. A group of related records
   B. A single point far from all others
   C. A record unusual only in a context, such as 35 deg C in winter
   D. A noise-free point
   Answer: C. Contextual (conditional) anomalies are abnormal only in a specific context. (Key point: Types of anomaly)

4. Which pair is a method-based scheme?
   A. Supervised and unsupervised
   B. Statistical and proximity (distance)-based
   C. Point and collective
   D. Normal and abnormal
   Answer: B. Method-based schemes include statistical, proximity, density, clustering and classification-based; the others classify by labels or anomaly type. (Key point: Method-based schemes)

## Related in Data Mining

- [Anomaly detection and importance](https://www.bctengineer.com/question.md?key=semester_7%2Fdata_mining%3Aanomaly-detection-intro) — Data Mining, chapter 6
- [Short note: Distance-based anomaly detection](https://www.bctengineer.com/question.md?key=semester_7%2Fdata_mining%3Adistance-based-anomaly-note) — Data Mining, chapter 6