Anomaly Detection

Machine learning technology can be leveraged for anomaly detection to identify risk signals before failures occur.

Anomaly detection methods are friendlier to unknown defect types but have a relatively high false positive rate; synthetic data can expand sample size but has a domain gap from the real defect distribution.

Common methods in academia and industry for addressing few-shot defect detection include anomaly detection (such as autoencoder reconstruction error methods), data augmentation and synthetic defect generation, transfer learning, and semi-supervised/self-supervised learning.

The sample inflation problem caused by overlapping windows applies to any sliding-window evaluation where 'the window is wider than the step,' including sensor data processing, electricity load forecasting, anomaly detection and medical monitoring.

For local tampering detection, the task should be re-modeled from receipt-level binary classification to patch-level anomaly detection or segmentation tasks.

Anomaly detection focuses on deviations of metric patterns relative to historical baselines, and can identify abnormal behavioral patterns even when absolute values remain within the normal range.

Common practices for addressing baseline drift and cold start include dynamically updating baselines with a sliding window, triggering a baseline reset after a release event, and setting a minimum observation period before enabling detection.

Anomaly detection faces engineering challenges such as false positive rates, baseline drift, and cold start problems, and is not a silver bullet.

RADAR proposes using anomaly detection to fill the blind spots of traditional monitoring.

Traditional monitoring relies on pre-configured static thresholds, which are either too sensitive and generate a large number of false alerts, or too lenient and miss real problems.

Machine learning models can learn the baseline of a system's normal behavior, dynamically identifying signals that deviate from the norm, thereby issuing early warnings before a fault erupts.

Controlling input consistency through means such as fixed lighting, mechanical positioning, and image registration can eliminate environmental interference before data enters the anomaly detection model, significantly reducing false positives.

In industrial inspection scenarios with almost no defect samples, anomaly detection should be prioritized over supervised learning, because what is available is a large volume of normal samples rather than defects.

Anomaly detection methods based solely on normal samples have a high false positive rate because their definition of anomaly is too broad, causing stains or slight positional deviations to be flagged as anomalies.

By learning normal tool-call patterns to identify suspicious behavioral sequences that deviate from the baseline, unknown attack patterns can be discovered without relying on predefined rule libraries.

Fake account detection in the field of anomaly detection faces classic challenges including class imbalance, scarcity of labeled data, and adversarial evolution.

Fake account detection is a classic Anomaly Detection problem, where a single feature is often insufficient for accurate judgment.

AI fraud detection relies on two main technical approaches: supervised learning (scoring new applications for fraud probability) and unsupervised learning (cluster analysis and anomaly detection).

In a personal portfolio, the prediction + anomaly detection direction is highly aligned with the monitoring component of MLOps, making it more technically differentiated and business-valuable than pure energy consumption prediction.