Anomaly detection
Anomaly detection surfaces records that deviate from learned patterns, which makes it a triage tool for reconciliation, transaction review, and data quality.
- Operational use
- Flagging unusual transactions, duplicate candidates, drifting data feeds, and reconciliation differences worth a person's attention first.
- When not to use it
- When the definition of wrong is precise and known, a rule is better than a model. Anomaly scores should never auto-reject records.
- How it is validated
- Precision on a reviewed sample: of the records flagged, how many were worth flagging. Thresholds tuned to reviewer capacity, monitored over time.
- Limitations
- An anomaly is a statistical statement, not an accusation. Detection surfaces unusual records; it does not independently prove fraud, error, or misconduct.
Isolation Forest, the reference method here, works on a simple insight: anomalous points are easier to isolate than normal ones. It is fast, robust, and needs no labeled fraud examples, which suits operational data where labels rarely exist.
In Eigenvalue systems, anomaly detection is a prioritization layer: it decides what a reviewer sees first, never what gets rejected. The score arrives with the evidence beside it, and the reviewer’s decision feeds back into the record. The method’s honest job is making a large review queue small, not replacing the review.
Where it appears in our work
- System Integration and Migration Validation Considered during system design
- Reconciliation and Transaction Intelligence Considered during system design
Primary sources
- Liu, Ting, and Zhou (2008). Isolation Forest
Last reviewed 2026-08-02. Sources link to primary or official pages; verify current versions before relying on them.