Intuition The One Core IdeaAnomaly detection means learning a picture of what "normal" data looks like, then flagging any new point that lands far away from that picture. Every method on the parent page — Gaussian, Isolation Forest, One-Class SVM — is just a different way of drawing the boundary between "normal" and "too far".
Before you can read the parent note Anomaly detection methods , you must be able to read its language. This page builds every symbol it uses , from absolute zero, in the order they depend on each other. If you already know one, skip it — but each one below is assumed by the parent, so we build it here.
x data point is one observation — one server reading, one credit-card transaction. We write it x and memory), we stack them into a vector : an arrow from the origin to a location on a grid.
The picture: think of a flat sheet of graph paper. The horizontal axis is feature 1 (say CPU usage), the vertical axis is feature 2 (memory). One server is a single dot; the arrow from the corner ( 0 , 0 ) is the vector x = [ x 1 , x 2 ]
R n R R n n n n how many features each observation has.
Why the topic needs it: anomaly detection compares one point to a whole cloud of points. To do that we must first agree that every point is a location in the same R n R 2 R 3
Definition Superscripts vs subscripts — the trapx ( i ) the i — the i x j the j of a point — the CPU number inside one server. These are totally different jobs done by look-alike notation.
Reveal to lock it in:
x ( 3 ) the 3rd whole observation in your dataset.
x 2 the 2nd feature (coordinate) of a single point.
Definition The summation sign∑ ∑ i = 1 m i i = 1 i = m m how many data points you have.
The picture: imagine a row of m ∑
∑ i = 1 m x ( i ) = x ( 1 ) + x ( 2 ) + ⋯ + x ( m )
Why the topic needs it: to find the "center of the crowd" you literally add every point up and divide by how many there are.
μ μ average location of all your normal points — the balance point of the cloud. Add every point, divide by the count m μ = m 1 ∑ i = 1 m x ( i )
The picture: if each data dot were a coin of equal weight on the graph paper, μ R n
Why the topic needs it: "normal" needs a center. Every method measures anomalies as distance from this center (or from the crowd built around it).
The next section needs three matrix operations, so we build them before using them.
( ⋅ ) T column of numbers into a wide row . We will need it to turn a product of two vectors into a full grid, and to turn a distance calculation into a single number.
The picture: a column vector standing up; the transpose lays it down flat on its side.
∣Σ∣ ∣Σ∣ stretches area/volume — the area-scaling factor of the ellipse the matrix draws. A big value = a big, spread-out cloud; a value of zero = the cloud is squashed flat (degenerate — a warning sign). For a 2 × 2 [ a c b d ] a d − b c
Common mistake Determinant is a scaling factor, not the area itself∣Σ∣ squared stretch. The geometric area (2-D) or volume (n ∣Σ ∣ 1/2 not ∣Σ∣ Σ ∣Σ∣ = 800 800
Σ − 1
Common mistake Determinant zero → no inverseIf ∣Σ∣ = 0 cannot compute Σ − 1 ∣Σ∣ > 0
Intuition Why a single center isn't enoughTwo clouds can share the same center μ where the crowd is, but how it spreads and which way it tilts . That is the job of Σ
σ 2 Variance measures how far points typically sit from the mean along one feature. It is the average of squared distances from the mean (squaring makes negatives positive and punishes far points more). For feature j σ j 2 = Var ( x j ) = m 1 ∑ i = 1 m ( x j ( i ) − μ j ) 2 σ j 2 σ standard deviation and σ 2
Definition Covariance — do two features move together?Covariance asks: when feature j k j k Cov ( x j , x k ) = m 1 ∑ i = 1 m ( x j ( i ) − μ j ) ( x k ( i ) − μ k ) Cov ( x j , x j ) = σ j 2 is its variance.
Definition The covariance matrixΣ Σ not the summation sign, same letter different job) packs all these numbers into a grid. For n n × n Σ = m 1 ∑ i = 1 m ( x ( i ) − μ ) ( x ( i ) − μ ) T Why this formula builds the grid: ( x ( i ) − μ ) ( x ( i ) − μ ) T n × n ( j , k ) ( x j ( i ) − μ j ) ( x k ( i ) − μ k ) i ( j , k ) Cov ( x j , x k )
diagonal entry Σ j j = σ j 2 j off-diagonal entry Σ j k = Cov ( x j , x k ) j k
The picture: Σ ellipse drawn around the crowd — the diagonal sets the width along each axis, the off-diagonal sets the tilt. The figure above shows how the same μ Σ
m m − 1 m 1 population covariance) to match the parent note. Many statistics texts use m − 1 1 unbiased sample covariance) because it corrects a slight underestimate when m m
Common mistake Two differentΣ ∑ i = 1 m Σ ∑ has limits (i = 1 m Σ ∣Σ∣ Σ − 1
Intuition Why plain straight-line distance failsStraight-line ("Euclidean") distance treats every direction equally. But normal data spreads more in some directions than others. A point 3 units out along the wide axis is unremarkable; the same 3 units along the narrow axis is bizarre. We need distance measured in units of the cloud's own spread .
Definition Mahalanobis distanceThe quantity ( x − μ ) T Σ − 1 ( x − μ ) Mahalanobis distance : how far x rescaled by Σ − 1 . The red point in the figure is the same Euclidean distance from center as the black one, but far more anomalous — because it lies along the narrow direction.
Why the topic needs it: this single number is the heart of Gaussian anomaly detection. Big Mahalanobis distance → far from normal → low probability → anomaly.
Definition The exponentialexp ( ⋅ ) exp ( z ) e z e ≈ 2.718 exp big negative number is tiny . exp ( − 56 ) 1 0 − 25 exp ( − distance )
Why this tool and not another? We want a rule where near the center → high value, far away → value crashing toward zero, but never negative . The exponential does exactly this smoothly. That is why the Gaussian formula wraps the Mahalanobis distance inside exp ( − 2 1 ⋅ dist )
π π ≈ 3.14159 ( 2 π ) n /2 ∣Σ ∣ 1/2 1 total probability sums to 1 (every possible point, added up, gives certainty). It doesn't change which points are anomalies — it just makes p ( x )
Definition Probability densityp ( x ) p ( x ) x p ( x ) p ( x )
ϵ ϵ p ( x ) ϵ ϵ dial you tune , not something derived. The parent's whole rule is: anomaly if p ( x ) < ϵ .
h ( x ) c ( n ) h ( x ) x Few cuts → the point stands alone → anomaly. To compare scores across datasets of different sizes we divide by c ( n ) average path length expected for n c ( n ) = 2 H ( n − 1 ) − n 2 ( n − 1 ) , H ( k ) = ∑ i = 1 k i 1 ≈ ln ( k ) + 0.577 n c ( n ) ≈ 2 ln ( n ) s ( x ) = 2 ( − c ( n ) h ˉ ( x ) ) h ˉ ( x ) h ( x ) near 1 = anomaly, near 0 = normal.
K ( x , x ′ ) ν K ( x , x ′ ) similarity score between two points — 1 if identical, shrinking toward 0 as they differ. ϕ ν ( 0 , 1 ] fraction of training points allowed to be outliers.
You don't need to master these three yet — the parent derives them. You only need to recognize the symbols as "distance-like" (h K ν , ϵ .
Transpose Determinant Inverse
Covariance matrix Sigma = shape
Exponential turns distance into p of x
Threshold epsilon flags anomaly
Anomaly Detection Methods
Path length h and score s
Test yourself — say the answer out loud before revealing.
I can explain the difference between x ( i ) x j x ( i ) i x j j
I know what R n the space of lists of n n
I can read ∑ i = 1 m add the thing on the right once for each i m
I know what μ the average location — the balance point of the data cloud.
I know what ( ⋅ ) T transpose — flips a matrix across its diagonal; turns a column vector into a row vector.
I can write the variance of feature j σ j 2 = m 1 ∑ i ( x j ( i ) − μ j ) 2
I know what each entry of Σ diagonal Σ j j j Σ j k j k
I can tell the summation ∑ Σ the summation has limits attached; the matrix stands alone (or as Σ − 1 ∣Σ∣
I know what ∣Σ∣ Σ − 1 determinant = area/volume-scaling factor (the ellipse's area scales like ∣Σ ∣ 1/2
I can explain why ∣Σ∣ = 0 no inverse exists — the cloud has collapsed to a line, formula breaks.
I know why we use Mahalanobis instead of straight-line distance it measures distance in units of the cloud's own spread per direction, not treating all directions equally.
I know why exp ( − distance ) it turns big distances into tiny positive values smoothly — far points get near-zero probability.
I can write the full Gaussian density p ( x ) p ( x ) = ( 2 π ) − n /2 ∣Σ ∣ − 1/2 exp ( − 2 1 ( x − μ ) T Σ − 1 ( x − μ ))
I know what p ( x ) < ϵ the point's probability is below the tunable cutoff, so it is flagged as an anomaly.
I know what c ( n ) the expected average path length for n ≈ 2 ln ( n )
Recall Quick self-check: which symbol answers "how far, adjusted for shape?"The Mahalanobis distance ( x − μ ) T Σ − 1 ( x − μ )
