Anomaly Detection for Decision Systems

This course frames anomaly detection as a decision workflow for triage, monitoring, root-cause review, and human oversight. The goal is to design detectors whose scores lead to useful investigations and governed actions.

By the end, a reader should be able to compare statistical, distance-based, density-based, tree-based, reconstruction, and time-series detectors; set thresholds under capacity and error costs; evaluate alerts when labels are scarce; and connect anomaly scores to governed investigations.

Figure: Incident windows on checkout reliability metrics, showing why anomaly detection is a monitoring and triage workflow (adapted from Lecture 10: Time-Series Anomaly Detection).

Lecture Sequence

01. Anomaly Detection for Decision Science

This lecture connects Anomaly Detection for Decision Science to thresholds, labels, explanations, alert quality, and human review.

02. Statistical Foundations of Anomaly Detection

This lecture develops Statistical Foundations of Anomaly Detection with examples that make assumptions, diagnostics, and interpretation visible.

03. Thresholds, Alerts, and Decision Costs

This lecture uses Thresholds, Alerts, and Decision Costs to clarify the analyst’s question, evidence, assumptions, and decision implications.

04. Univariate and Multivariate Statistical Detectors

This lecture compares univariate and multivariate detectors through thresholds, false alarms, and operating context.

05. Distance-Based Methods: kNN and Local Outlier Factor

This lecture frames Distance-Based Methods: kNN and Local Outlier Factor as a decision problem and asks what evidence can be trusted, challenged, and communicated.

06. Density-Based Anomaly Detection

This lecture builds intuition for Density-Based Anomaly Detection and ties the result to model choice, uncertainty, and action.

07. Tree-Based Anomaly Detection: Isolation Forest

This lecture applies Tree-Based Anomaly Detection: Isolation Forest with emphasis on diagnostics, tradeoffs, and evidence limits.

08. One-Class Classification and Support Vector Methods

This lecture develops One-Class Classification and Support Vector Methods as a practical pattern for analysis, diagnostics, and decision support.

09. Reconstruction-Based Detection: PCA and Autoencoders

This lecture connects Reconstruction-Based Detection: PCA and Autoencoders to alert quality, reconstruction error, and human review.

10. Time-Series Anomaly Detection

This lecture develops Time-Series Anomaly Detection with examples that make assumptions, diagnostics, and interpretation visible.

11. Change-Point Detection and Distribution Shift

This lecture uses Change-Point Detection and Distribution Shift to clarify the analyst’s question, evidence, assumptions, and decision implications.

12. Anomaly Detection for Logs, Events, and Sequences

This lecture studies logs, events, and sequences as monitoring data with structure, noise, and escalation costs.

13. Evaluating Anomaly Detection Without Clean Labels

This lecture frames Evaluating Anomaly Detection Without Clean Labels as a decision problem and asks what evidence can be trusted, challenged, and communicated.

14. Explaining Anomaly Scores

This lecture builds intuition for Explaining Anomaly Scores and ties the result to model choice, uncertainty, and action.

15. From Alerts to Root Cause Analysis

This lecture applies From Alerts to Root Cause Analysis with emphasis on diagnostics, tradeoffs, and evidence limits.

16. Governance, Fairness, Privacy, and Human Review

This lecture develops Governance, Fairness, Privacy, and Human Review as a practical pattern for analysis, diagnostics, and decision support.

17. Capstone: Anomaly Detection Decision Pipeline

Brings the anomaly detection course together through alerting, explanation, triage, and operational review.