Worked examples — Anomaly detection methods

This page is the "hands get dirty" companion to the parent topic (also available in Hinglish). We are not learning new theory here — we are stress-testing the three methods from the parent (Gaussian density, Isolation Forest, One-Class SVM) against every kind of input they can meet. Before you read a solution, you will be asked to Forecast — guess the outcome. Guessing first is what turns reading into learning.

Everything is built from the ground up. If a symbol appears, it was defined either in the parent or right here.

---

The scenario matrix

Think of anomaly detection as a machine with a big lever (the threshold) and some knobs (the model parameters). The matrix below lists every kind of situation that lever-and-knobs machine can be handed. Our worked examples must touch every cell.

Cell	What makes it tricky	Which method	Example
A. Point far in ALL directions	Big deviation in every feature — the "obvious" anomaly	Gaussian	Ex 1
B. Point that looks normal per-feature but not jointly	Each coordinate is fine alone; only the correlation betrays it	Gaussian	Ex 2
C. Exactly at the mean (degenerate/zero distance)	$x=\mu$, distance $=0$, must give the highest possible density	Gaussian	Ex 3
D. Threshold boundary case	$p(x)$ sits right at $ϵ$ — which side wins?	Gaussian	Ex 4
E. Easy-to-isolate point (short path)	Anomaly that a random split slices off immediately	Isolation Forest	Ex 5
F. Deep-in-the-crowd point (long path)	Normal point needing many splits	Isolation Forest	Ex 5
G. Limiting behaviour of the score	What score means "as anomalous as possible" and "as normal as possible"	Isolation Forest	Ex 6
H. One-Class SVM sign flip	Decision score crosses zero — inside vs outside the learned region	One-Class SVM	Ex 7
I. Real-world word problem	Translating messy language into $\mu ,\Sigma ,ϵ$	Gaussian	Ex 8
J. Exam twist: give the answer, find the knob	Reverse-engineer $ϵ$ (or $k$) from a required detection	Gaussian	Ex 9

Every numeric result below is machine-checked in the verify block.

---

Warm-up: the three quantities we keep reusing

Before any example, let us pin down the three objects, in plain words and pictures.

First, the object every Gaussian example compares against a threshold: the probability density $p(x)$. In plain words, $p(x)$ is a height — how "tall" the bell-shaped hill of normal data is above the point $x$. Tall (large $p$) = crowded, typical spot; near-zero (small $p$) = lonely, suspicious spot. Its formula, straight from the parent note, is

$p(x)=\frac{1}{(2\pi {)}^{n/2}|\Sigma {|}^{1/2}}\exp \left(-\frac{1}{2}(x-\mu {)}^T{\Sigma }^{-1}(x-\mu )\right),$

where $n$ is the number of features. Notice the entire exponent is built from one scalar, the thing inside the parentheses — which we now name.

The picture below is the whole intuition in one frame.

Look at the concentric ellipses: each is a constant-$D^2$ ring. Walking outward, $D^2$ grows and $p(x)$ falls. The Gaussian test simply asks: "which ring is $x$ on, and is that ring past our fence $ϵ$?"

Throughout the Gaussian examples we reuse the server-monitoring covariance from the parent: $\mu =\left[\begin{array}{c}30\\ 50\end{array}\right],\Sigma =\left[\begin{array}{cc}25& 10\\ 10& 36\end{array}\right].$

We will need ${\Sigma }^{-1}$. Its determinant is $|\Sigma |=25\cdot 36-10\cdot 10=900-100=800$, so ${\Sigma }^{-1}=\frac{1}{800}\left[\begin{array}{cc}36& -10\\ -10& 25\end{array}\right].$

---

Ex 1 — Cell A: far in every direction

Forecast: both numbers are way above normal — expect a huge $D^2$ and a microscopic $p(x)$. Anomaly, surely.

1. Deviation vector. $x-\mu =[80-30,90-50{]}^T=[50,40{]}^T$. Why this step? Everything downstream measures distance from the center, so we must subtract the center first.

2. Apply ${\Sigma }^{-1}$ to the deviation. ${\Sigma }^{-1}(x-\mu )=\frac{1}{800}\left[\begin{array}{cc}36& -10\\ -10& 25\end{array}\right]\left[\begin{array}{c}50\\ 40\end{array}\right]=\frac{1}{800}\left[\begin{array}{c}1400\\ 500\end{array}\right].$ Why this step? ${\Sigma }^{-1}$ re-weights each direction by how unusual movement there is. Movement along a low-variance direction is punished more.

3. Finish the quadratic form. $D^2=[50,40]\cdot \frac{1}{800}\left[\begin{array}{c}1400\\ 500\end{array}\right]=\frac{50\cdot 1400+40\cdot 500}{800}=\frac{90000}{800}=\mathrm{112.5.}$ Why this step? $D^2$ is the single scalar the density depends on.

4. Density. With $n=2$: $p(x)=\frac{1}{2\pi \sqrt{800}}{e}^{-112.5/2}=\frac{1}{2\pi \sqrt{800}}{e}^{-56.25}\approx 1.6\times 10^{-27}.$ Why this step? This is the actual number we compare to $ϵ$.

5. Decide. $1.6\times 10^{-27}<10^{-5}$ ⟹ anomaly.

Verify: Sanity — $D^2=112.5$ is enormous (a 1-sigma point has $D^2\approx 1$–$2$), so a near-zero density is exactly what we expect. Units: $D^2$ is dimensionless (it was scaled by ${\Sigma }^{-1}$), $p$ has units of $1/(\text{CPU}\cdot \text{mem})$, and only the ordering against $ϵ$ matters. ✓

---

Ex 2 — Cell B: each feature fine, joint value not

This is the case that makes covariance earn its keep.

Forecast: feature-by-feature this looks borderline-OK. But the two features are positively correlated (${\Sigma }_{12}=+10$): normally, high CPU ⇒ high memory together. Here CPU is up while memory is down — anti-correlated. Predict a surprisingly large $D^2$.

1. Deviation. $x-\mu =[45-30,35-50{]}^T=[15,-15{]}^T$. Why this step? Same as always: distance is from center.

2. Per-feature sanity (the trap). $15/{\sigma }_{\text{CPU}}=15/5=3$ and $-15/{\sigma }_{\text{mem}}=-15/6=-2.5$. So each is a few sigma out — not crazy alone. Why this step? Shows what a naive per-feature detector would (mis)judge.

3. Joint distance with ${\Sigma }^{-1}$. ${\Sigma }^{-1}(x-\mu )=\frac{1}{800}\left[\begin{array}{cc}36& -10\\ -10& 25\end{array}\right]\left[\begin{array}{c}15\\ -15\end{array}\right]=\frac{1}{800}\left[\begin{array}{c}540+150\\ -150-375\end{array}\right]=\frac{1}{800}\left[\begin{array}{c}690\\ -525\end{array}\right].$ $D^2=[15,-15]\cdot \frac{1}{800}\left[\begin{array}{c}690\\ -525\end{array}\right]=\frac{15\cdot 690+(-15)(-525)}{800}=\frac{10350+7875}{800}=\frac{18225}{800}=\mathrm{22.78.}$ Why this step? The off-diagonal terms of ${\Sigma }^{-1}$ inject the correlation penalty. Going against the natural correlation inflates $D^2$.

4. Compare to axis-aligned intuition. If we had ignored correlation (pretended $\Sigma$ diagonal), we'd get $3^2+2.5^2=15.25$. The true $D^2=22.78$ is bigger — the anti-correlation adds ~$7.5$.

Verify: $D^2=22.78>15.25$ confirms correlation raised the alarm. ✓ (Checked numerically below.)

---

Ex 3 — Cell C: degenerate input, $x=\mu$

Forecast: zero distance ⟹ maximum density ⟹ never an anomaly.

1. Deviation is zero. $x-\mu =[0,0{]}^T$. Why this step? This is the degenerate case the matrix demanded — the exact center.

2. Quadratic form vanishes. $D^2=0^T{\Sigma }^{-1}0=0$. Why this step? Any quadratic form of the zero vector is $0$.

3. Density is the peak. $p(\mu )=\frac{1}{2\pi \sqrt{800}}{e}^0=\frac{1}{2\pi \sqrt{800}}\approx 5.63\times 10^{-3}.$ Why this step? $e^0=1$ is the largest the exponential can be, so this is the global maximum of $p$.

4. Decide. For any sensible $ϵ$ (like $10^{-5}$), $5.63\times 10^{-3}\gg ϵ$ ⟹ never flagged. Good — the model must trust its own center most.

Verify: $p(\mu )$ is the largest value $p$ ever takes; every other point has $p(x)<p(\mu )$. Numeric check below. ✓

---

Ex 4 — Cell D: exactly on the threshold

Forecast: the fence is a specific ring; inside it (smaller $D^2$) = normal, outside = anomaly. A point exactly on the fence needs a stated convention.

1. Set density equal to threshold. $\frac{1}{2\pi \sqrt{800}}{e}^{-D_{\star }^2/2}=10^{-3}.$ Why this step? The boundary of the decision rule is exactly where $p=ϵ$.

2. Solve for $D_{\star }^2$. Multiply out and take logs: $e^{-D_{\star }^2/2}=10^{-3}\cdot 2\pi \sqrt{800}\approx 10^{-3}\cdot 177.7=\mathrm{0.17765.}$ $-\frac{1}{2}{D}_{\star }^2=\ln (0.17765)=-1.7277\Rightarrow D_{\star }^2=\mathrm{3.455.}$ Why this step? The $\ln$ undoes the exponential — it is the tool that answers "what exponent produced this value?"

3. Classify (a): exactly on the fence, $D^2=D_{\star }^2=3.455$. Here $p(x)=ϵ$ exactly. The parent's rule is "anomaly if $p(x)<ϵ$" — a strict inequality. So a point with $p(x)=ϵ$ is not flagged; it is (by convention) counted as normal. The fence ring itself belongs to the normal side. Why this step? The boundary case must have a stated tie-break; the strict "$<$" means equality ⟹ keep as normal.

4. Classify (b): $D^2=5$. Since $5>3.455$, we have $p(x)<ϵ$ ⟹ anomaly. Why this step? Larger $D^2$ = lower density = strictly past the threshold.

Verify: Plug $D_{\star }^2=3.455$ back: $\frac{1}{2\pi \sqrt{800}}{e}^{-3.455/2}\approx 10^{-3}=ϵ$. Boundary consistent, and the tie-break ("$=ϵ$ ⟹ normal") is the strict-inequality convention. ✓

The figure shows the fence ring for Ex 4: the point at $D^2=5$ (pink) sits outside it, the $D^2=0$ center (yellow) sits deep inside, and the on-fence point lives on the yellow ring (normal side).

---

Ex 5 — Cells E & F: Isolation Forest short vs long path

Forecast: short path (2.1) ⟹ high score ⟹ anomaly; long path (7.2) ⟹ lower score, but with this small $c(n)$ both might be above $0.6$ — watch out.

1. Normalizer. $c(1000)=2\ln (1000)=2\cdot 6.9078=13.816$. Why this step? $c(n)$ is the expected path length for $n$ points, our "normal baseline," so dividing by it makes scores comparable across dataset sizes.

2. Normal score. $s_{\text{normal}}=2^{-7.2/13.816}=2^{-0.5211}=\mathrm{0.697.}$ Why this step? Apply the score formula; $2^{-x}$ maps path length onto $(0,1]$.

3. Anomaly score. $s_{\text{anom}}=2^{-2.1/13.816}=2^{-0.1520}=\mathrm{0.900.}$ Why this step? Same formula, shorter path ⟹ larger exponent-magnitude reduction ⟹ higher score.

4. Decide. $0.900>0.6$ ⟹ anomaly (correct). But $0.697>0.6$ too — the normal point is also flagged! The threshold $0.6$ is too loose for this $c(n)$.

Verify: anomaly score ($0.900$) $>$ normal score ($0.697$) — ordering is right, the method ranks correctly even when the fixed threshold misfires. ✓

---

Ex 6 — Cell G: limiting behaviour of the isolation score

Forecast: instant isolation should give the most anomalous score (near 1); average depth should give exactly $0.5$; buried-forever should approach $0$.

1. Instant isolation, $\bar{h}\to 0$. $s=2^{-0/c(n)}=2^0=1$. Why this step? $\bar{h}=0$ means "isolated with zero questions" — the most extreme outlier imaginable, so the score maxes out at $1$.

2. Average depth, $\bar{h}=c(n)$. $s=2^{-c(n)/c(n)}=2^{-1}=0.5$. Why this step? When a point behaves exactly like the baseline, the score is a neutral $0.5$ — the natural "undecided" midpoint.

3. Buried forever, $\bar{h}\to \infty$. $s=2^{-\infty }=0$. Why this step? Deeper than everyone ⟹ maximally normal ⟹ score floors at $0$.

Verify: The score's range is exactly $(0,1]$ with $0.5$ at the baseline — matches the parent's claim "near 1 = anomaly, near 0 = normal." ✓

---

Ex 7 — Cell H: One-Class SVM sign flip

Recall from the parent: a point is an anomaly when its decision score $f(x)={\sum }_i{\alpha }_{i}K(x,x^{(i)})-\rho$ is negative (on the origin side of the learned hyperplane). We build a tiny concrete instance.

Forecast: $x_A$ sits right among the support vectors ⟹ high kernel sums ⟹ $f>0$, normal. $x_B$ is far ⟹ kernels ≈ 0 ⟹ $f=0-1.2<0$, anomaly.

1. Kernel of $x_A$ to each SV. Distances-squared: to $s_1$: $0.25$; to $s_2$: $0.25$. $K(x_A,s_1)=e^{-0.5\cdot 0.25}=e^{-0.125}=0.8825,K(x_A,s_2)=\mathrm{0.8825.}$ Why this step? The RBF kernel measures closeness — near points give values near $1$.

2. Decision score of $x_A$. $f(x_A)=1\cdot 0.8825+1\cdot 0.8825-1.2=1.765-1.2=0.565>0\Rightarrow \text{normal.}$ Why this step? Positive $f$ = inside the enclosing region.

3. Kernel of $x_B$. Distances-squared: to $s_1$: $16$; to $s_2$: $9$. $K(x_B,s_1)=e^{-8}=3.35\times 10^{-4},K(x_B,s_2)=e^{-4.5}=\mathrm{0.0111.}$ Why this step? Far points give near-zero kernel values — the "influence" of each SV decays fast.

4. Decision score of $x_B$. $f(x_B)=3.35\times 10^{-4}+0.0111-1.2=-1.1886<0\Rightarrow \text{anomaly.}$ Why this step? Sum of tiny kernels can't reach $\rho$, so $f$ goes negative — outside the region.

Verify: $f$ flipped sign ($+0.565\to -1.189$) exactly as the geometry predicts. ✓

The blue-shaded blob is the region where $f>0$ (normal). $x_A$ (yellow) is inside; $x_B$ (pink) is well outside.

---

Ex 8 — Cell I: real-world word problem

Forecast: temperature is $2.5$ sigma high, humidity $2$ sigma low; independent, so $D^2$ just adds their squares. $2.5^2+2^2=10.25>9$ — expect an anomaly.

1. Translate words to model. Independent ⟹ $\Sigma$ is diagonal: $\mu =[180,40{]}^T,\Sigma =\left[\begin{array}{cc}16& 0\\ 0& 25\end{array}\right],{\Sigma }^{-1}=\left[\begin{array}{cc}1/16& 0\\ 0& 1/25\end{array}\right].$ Why this step? "Independent" is the plain-English word for "zero off-diagonal covariance."

2. Deviation. $x-\mu =[190-180,30-40{]}^T=[10,-10{]}^T$. Why this step? Distance from the normal operating point.

3. Diagonal $D^2$ = sum of standardized squares. $D^2=\frac{10^2}{16}+\frac{(-10{)}^2}{25}=\frac{100}{16}+\frac{100}{25}=6.25+4.0=\mathrm{10.25.}$ Why this step? With a diagonal $\Sigma$, Mahalanobis distance is just each feature measured in its own sigma-units, squared and summed.

4. Decide. $10.25>9$ ⟹ anomaly — flag the oven.

Verify: $6.25=2.5^2$ (temp is $2.5\sigma$), $4=2^2$ (humidity $2\sigma$); sum $=10.25>9$. Units check: each term is (units${}^2$)/(units${}^2$) = dimensionless. ✓

---

Ex 9 — Cell J: exam twist, reverse-engineer the threshold

Forecast: we work backwards through the density formula to solve for $ϵ$. Then check that a much smaller $D^2$ gives $p>ϵ$.

1. Density at the required point. $p=\frac{1}{2\pi \sqrt{800}}{e}^{-20/2}=\frac{1}{177.72}{e}^{-10}=\frac{4.54\times 10^{-5}}{177.72}=2.553\times 10^{-7}.$ Why this step? The fence is defined by "$p$ at that point $=ϵ$," so compute that $p$.

2. Set $ϵ$. $\boxed{ϵ=2.553\times 10^{-7}}$. Why this step? Choosing $ϵ$ equal to the density there makes that exact point the boundary.

3. Check a normal point, $D^2=3$. $p=\frac{1}{177.72}{e}^{-3/2}=\frac{0.22313}{177.72}=1.255\times 10^{-3}.$ Since $1.255\times 10^{-3}\gg 2.553\times 10^{-7}=ϵ$, it is safely normal. Why this step? A tighter (smaller $D^2$) point should have far higher density than the fence — confirms monotonicity.

Verify: $ϵ=2.553\times 10^{-7}$ reproduces $D^2=20$ on the boundary, and the $D^2=3$ point has density ~$4900\times$ larger. ✓

---

Recall Self-test (reveal after guessing)

What single scalar decides the Gaussian test? ::: The Mahalanobis distance squared $D^2=(x-\mu {)}^T{\Sigma }^{-1}(x-\mu )$ — density is a monotone-decreasing function of it. Why can a point be normal per-feature yet anomalous jointly? ::: Because the off-diagonal terms of ${\Sigma }^{-1}$ penalize movements that violate the learned correlation (Ex 2). In Isolation Forest, what score corresponds to "average / baseline" behaviour? ::: Exactly $0.5$, when $\bar{h}=c(n)$ (Ex 6). For One-Class SVM, which sign of $f(x)$ is the anomaly? ::: $f(x)<0$ — the origin side, outside the enclosing region (Ex 7).