# Anomaly detection
**Anomaly detection** is the task of identifying patterns in data that do not conform to expected behavior; such patterns are called anomalies, outliers, or novelties depending on the research community and application.[1](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf) The problem has been studied for decades across statistics, data mining, machine learning, and domain fields such as finance, cybersecurity, manufacturing, and healthcare, and it differs from related tasks in a specific way: anomaly detection usually does not assume the training set is free of anomalies, whereas tasks such as [novelty detection](https://www.edgepedia.org/novelty-detection) and out-of-distribution detection often do.[1](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf) • [4](https://papers.neurips.cc/paper_files/paper/2022/hash/cf93972b116ca5268827d575f2cc226b-Abstract-Datasets_and_Benchmarks.html)
| Key fact | Detail |
|---|---|
| Definition | Finding patterns in data that do not conform to expected behavior; also called outlier detection or novelty detection[1](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf) |
| Anomaly types | Point anomalies (a single unusual value), contextual anomalies (a normal value in the wrong context), and collective anomalies (individually normal points that are jointly unusual)[11](https://airesearchcenter.org/term/anomaly-detection) |
| Method families | Statistical, distance-based, density-based, clustering-based, learning-based, and ensemble methods[12](https://arxiv.org/abs/2112.00588) |
| Deep learning era | A 2021 ACM Computing Surveys review organizes deep anomaly detection into 3 high-level and 11 fine-grained method categories[2](https://doi.org/10.1145/3439950) |
| Supervision finding | In the ADBench benchmark (30 algorithms, 57 datasets, 98,436 experiments), no unsupervised algorithm was statistically better than the others, and with only 1% labeled anomalies most semi-supervised methods beat the best unsupervised method[4](https://papers.neurips.cc/paper_files/paper/2022/hash/cf93972b116ca5268827d575f2cc226b-Abstract-Datasets_and_Benchmarks.html) |
| Evaluation caveat | The point-adjustment protocol used in time-series benchmarks can overestimate performance so much that even a random anomaly score can appear state-of-the-art[5](https://arxiv.org/abs/2109.05257) |
## What counts as an anomaly
An anomaly is an object that is notably different from the majority of the remaining objects; depending on the domain it may also be called an outlier, a novelty, or an unusual, irregular, rare, erroneous, fraudulent, or malicious object.[3](https://doi.org/doi%3A10.1145/3609333) The 2009 survey by Varun Chandola, Arindam Banerjee, and Vipin Kumar, computer scientists then at the [University of Minnesota](https://www.edgepedia.org/university-of-minnesota), gave the field its standard taxonomy of three anomaly types.[1](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf) • [11](https://airesearchcenter.org/term/anomaly-detection) A **point anomaly** is a single instance that deviates from the rest, such as one fraudulent transaction among millions of legitimate ones. A **contextual anomaly** is normal in itself but abnormal in its context, for example a temperature reading that is ordinary in summer but anomalous in winter. A **collective anomaly** is a set of individually unremarkable data points whose joint occurrence is unusual, such as a specific sequence of system calls that signals an intrusion.
Anomaly detection is related to but distinct from noise removal and noise accommodation, which deal with unwanted noise in data; an anomaly, by contrast, is interesting to the analyst and often the very object of the analysis.[1](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf) The same distinction appears in statistical practice: the NIST Engineering Statistics Handbook separates outlier labeling, accommodation with robust techniques, and identification, and warns that automatic outlier-rejection schemes can discard scientifically interesting observations, citing satellite ozone data in which low ozone readings were screened out as "outliers" before analysis.[9](https://www.itl.nist.gov/div898/handbook/eda/section3/eda35h.htm)
## Method families
The 2009 survey groups techniques by their underlying approach and identifies, for each category, the key assumptions used to differentiate normal from anomalous behavior; these assumptions serve as guidelines for judging whether a technique suits a given domain.[1](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf) A later survey of AI-based outlier detection condenses the field into six major categories: statistical-based, distance-based, density-based, clustering-based, learning-based, and ensemble methods.[12](https://arxiv.org/abs/2112.00588)
**Statistical tests** are the classical core. Grubbs' test, also known as the maximum normed residual test, detects a single outlier in a univariate data set that follows an approximately normal distribution; when more than one outlier may be present, the Tietjen-Moore test or the generalized extreme studentized deviate test is recommended instead.[7](https://itl.nist.gov/div898/handbook/eda/section3/eda35h1.htm)
**Classification-based techniques** operate in two phases: a training phase learns a classifier from labeled data, and a testing phase labels each instance normal or anomalous.[1](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf) Because labeled anomalies are scarce, most practical settings are unsupervised or semi-supervised, which is what makes benchmarking the role of supervision an active question.[4](https://papers.neurips.cc/paper_files/paper/2022/hash/cf93972b116ca5268827d575f2cc226b-Abstract-Datasets_and_Benchmarks.html)
**Deep learning methods** became a major direction in the late 2010s. The 2021 review by Guansong Pang, Chunhua Shen, Longbing Cao, and Anton van den Hengel organizes deep anomaly detection into 3 high-level and 11 fine-grained categories and reviews each category's objective functions, underlying assumptions, and advantages and disadvantages.[2](https://doi.org/10.1145/3439950) More recently, surveys have examined self-supervised anomaly detection, in which models learn from unlabeled data through proxy tasks, and the role of foundation models and large language models.[8](https://arxiv.org/abs/2502.06911)
## Applications
Anomaly detection techniques have been applied across diverse domains, and many techniques were developed specifically for particular application domains while others are generic.[1](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf) Documented uses include credit card fraud detection on highly imbalanced transaction data,[12](https://arxiv.org/abs/2112.00588) healthcare insurance fraud detection combining association rule mining with unsupervised classifiers such as isolation forest and CBLOF,[12](https://arxiv.org/abs/2112.00588) heart anomaly detection from ambulatory electrocardiogram recordings, where over 99% of heartbeat data is normal and the imbalance complicates model training,[12](https://arxiv.org/abs/2112.00588) and cybersecurity for industrial control systems. In the manufacturing setting, the U.S. [National Institute of Standards and Technology](https://www.edgepedia.org/national-institute-of-standards-and-technology)'s National Cybersecurity Center of Excellence and Engineering Laboratory demonstrated behavioral anomaly detection capabilities in a robotics-based manufacturing system and a chemical-industry-style process control system, mapping the capabilities to the Cybersecurity Framework to help detect conditions that indicate malware attacks and threats to operational data.[6](https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8219.pdf)
## Evaluation and benchmarks
Evaluation is a recognized difficulty in the field. The Numenta Anomaly Benchmark (NAB), introduced in 2015, provides a controlled, repeatable, open-source environment for scoring real-time detectors on labeled, real-world streaming time-series data, with a scoring algorithm that rewards detecting anomalies promptly, avoiding false alarms, and adapting to changing statistics.[10](https://ieeexplore.ieee.org/document/7424283/) For tabular data, ADBench (NeurIPS 2022) ran 98,436 experiments comparing 30 algorithms, including 14 unsupervised, 7 semi-supervised, and 9 supervised methods, on 57 datasets across four anomaly types and three data-corruption settings.[4](https://papers.neurips.cc/paper_files/paper/2022/hash/cf93972b116ca5268827d575f2cc226b-Abstract-Datasets_and_Benchmarks.html)
**Benchmark findings and flaws.** ADBench's headline results are that none of the benchmarked unsupervised algorithms was statistically better than the others, that a mere 1% of labeled anomalies lets most semi-supervised methods outperform the best unsupervised method, and that for specific anomaly types the best unsupervised methods can even beat semi- and fully-supervised ones.[4](https://papers.neurips.cc/paper_files/paper/2022/hash/cf93972b116ca5268827d575f2cc226b-Abstract-Datasets_and_Benchmarks.html) On the time-series side, the widely used point-adjustment (PA) protocol, which credits a detected segment once a single point within it is flagged, was shown theoretically and experimentally to overestimate performance so severely that even a random anomaly score can appear state-of-the-art, and an untrained model can match existing methods when PA is forbidden.[5](https://arxiv.org/abs/2109.05257) Later work continues to rework time-series evaluation, including range-aware metrics on the UCR Anomaly Archive and unified evaluation libraries.[12](https://arxiv.org/abs/2112.00588)
## Recent directions
Since 2023, research has turned toward foundation models. A 2025 survey classifies foundation models in anomaly detection pipelines by their functional role as encoders, detectors, or interpreters, and reports applications across finance, manufacturing, and healthcare.[8](https://arxiv.org/abs/2502.06911) Companion surveys cover transformers and foundation models for visual anomaly detection, dividing methods into reconstruction-based, feature-based, and zero/few-shot approaches,[8](https://arxiv.org/abs/2502.06911) and large language models for anomaly and out-of-distribution detection, exploiting zero- and few-shot reasoning.[8](https://arxiv.org/abs/2502.06911) A persistent theme across these surveys is that the field's central difficulty remains unchanged since the 2009 survey: an anomaly is defined relative to a model of normal behavior, and the data itself must supply that model.[1](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf) • [11](https://airesearchcenter.org/term/anomaly-detection)
## References
1. [Chandola, V., Banerjee, A., and Kumar, V. (2009). Anomaly Detection: A Survey. ACM Computing Surveys 41(3), Article 15.](https://arindam.cs.illinois.edu/papers/09/anomaly.pdf)
2. [Pang, G., Shen, C., Cao, L., and van den Hengel, A. (2021). Deep Learning for Anomaly Detection: A Review. ACM Computing Surveys 54(2), Article 38.](https://doi.org/10.1145/3439950)
3. [A Survey on Explainable Anomaly Detection. ACM Transactions on Knowledge Discovery from Data.](https://doi.org/doi%3A10.1145/3609333)
4. [Han, S., Hu, X., Huang, H., Jiang, M., and Zhao, Y. (2022). ADBench: Anomaly Detection Benchmark. NeurIPS 2022 Datasets and Benchmarks Track.](https://papers.neurips.cc/paper_files/paper/2022/hash/cf93972b116ca5268827d575f2cc226b-Abstract-Datasets_and_Benchmarks.html)
5. [Kim, S., Choi, K., Choi, H.-S., Lee, B., and Yoon, S. (2021). Towards a Rigorous Evaluation of Time-series Anomaly Detection. arXiv:2109.05257.](https://arxiv.org/abs/2109.05257)
6. [Powell, M. et al. (2020). Securing Manufacturing Industrial Control Systems: Behavioral Anomaly Detection. NIST IR 8219.](https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8219.pdf)
7. [Grubbs' Test for Outliers. NIST/SEMATECH e-Handbook of Statistical Methods.](https://itl.nist.gov/div898/handbook/eda/section3/eda35h1.htm)
8. [Ren, J. et al. (2025). Foundation Models for Anomaly Detection: Vision and Challenges. arXiv:2502.06911.](https://arxiv.org/abs/2502.06911)
9. [Detection of Outliers. NIST/SEMATECH e-Handbook of Statistical Methods, Section 1.3.5.17.](https://www.itl.nist.gov/div898/handbook/eda/section3/eda35h.htm)
10. [Lavin, A. and Ahmad, S. (2015). Evaluating Real-Time Anomaly Detection Algorithms: The Numenta Anomaly Benchmark. IEEE ICMLA 2015.](https://ieeexplore.ieee.org/document/7424283/)
11. [Anomaly detection. The Library, AI Research Center.](https://airesearchcenter.org/term/anomaly-detection)
12. [Outlier Detection using AI: A Survey. arXiv:2112.00588.](https://arxiv.org/abs/2112.00588)
---
*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Artificial intelligence and data › Machine learning and neural computation › Machine learning methods › Supervised, unsupervised, and semi-supervised learning › Anomaly and novelty detection*
*Initially written Sep 17, 2026 · Reviewed: Sep 17, 2026; Sep 30, 2026; Oct 15, 2026 · Edited: Sep 30, 2026; Oct 15, 2026 · Last review: Oct 15, 2026*
*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*
License: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license