Finding what does not fit.
WHAT IT DOES
Identifies items unlike the rest: unusual transactions, unexpected traffic, abnormal readings.
WHERE IT IS USED
Fraud detection Network security Equipment monitoring Quality control Detecting unusual account activity
HOW IT WORKS
The system learns what normal looks like, then flags departures from it.
THE ADVANTAGE
It does not require examples of the problem. It only requires examples of normal.
Useful for fraud, where new methods appear constantly.
THE DIFFICULTY
Distinguishing genuinely problematic anomalies from harmless unusual cases.
A legitimate large order looks like fraud. A holiday traffic spike looks like an attack.
THE TRADE-OFF
Sensitive settings catch more and produce more false alarms.
Too many false alarms and people stop investigating, which defeats the purpose.
FOR A SMALL BUSINESS
Your payment gateway includes fraud screening. Use it.
Simple rules frequently work: flag orders above a threshold, or with mismatched addresses, for manual review.
