Introduction
Anomaly detection (or outlier detection) means finding examples that are very different from the norm:
- fraud — a card suddenly used for large purchases in another country;
- defects — a product whose sensor readings don't look like normal production;
- cyber-attacks — unusual network traffic;
- data cleaning — removing bad rows before training another model.
Labelled examples of anomalies are usually rare (fraud is rare, and new kinds keep appearing). So instead of learning "what fraud looks like", we learn what normal looks like and flag whatever doesn't fit.
A Gaussian mixture is a natural tool: it estimates the density of the data at every point. Points in low-density regions — where few normal examples live — are suspicious.