How does anomaly detection identify unusual data records?

In the context of data mining, anomaly detection identifies unusual data records by focusing on the definition of "normal" behavior rather than attempting to predict specific types of errors or fraud. Because fraudulent or anomalous events are often rare and evolve quickly, predictive models frequently become inaccurate; therefore, anomaly detection functions as the inverse of clustering, flagging instances that fail to fit established patterns.1

In broader statistical analysis, individual records—often called outliers—are identified by their numerical distance from the rest of the data set. Statisticians often use the z-score to determine this relative position, calculated as:2

$$z=\frac{x-\overline{x}}{s}$$

In this formula, $x$ is the data value, $\overline{x}$ is the sample mean, and $s$ is the sample standard deviation. A common rule of thumb is to flag any value with a z-score less than -3 or greater than +3 as an outlier, which may then be reviewed for accuracy or potential error.2