Anomaly detection basics in ML Python - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main goal of anomaly detection?

In simple terms, what does anomaly detection try to find in data?

A To find data points that are very different from the rest

B To find patterns that happen very often in the data

C To group data points into clusters based on similarity

D To predict future values based on past data

💡 Hint

Think about what makes something stand out or look unusual.

Anomaly detection focuses on finding data points that do not fit the normal pattern, meaning they are different or rare compared to most data.

❓ Predict Output

intermediate

Output of simple anomaly score calculation

Given the following Python code that calculates anomaly scores as the absolute difference from the mean, what is the output list?

ML Python

data = [10, 12, 10, 13, 100]
mean = sum(data) / len(data)
anomaly_scores = [abs(x - mean) for x in data]
print([round(score, 2) for score in anomaly_scores])

A [18.0, 16.0, 18.0, 15.0, 72.0]

B [21.0, 19.0, 21.0, 18.0, 69.0]

C [19.0, 17.0, 19.0, 16.0, 71.0]

D [19.0, 17.0, 18.0, 16.0, 71.0]

💡 Hint

Calculate the mean first, then subtract each value and take absolute value.

The mean is (10+12+10+13+100)/5 = 29.0. The anomaly scores are absolute differences from 29.0: |10-29|=19, |12-29|=17, |10-29|=19, |13-29|=16, |100-29|=71. Rounded to two decimals, the list is [19.0,17.0,19.0,16.0,71.0] which is option C.

❓ Model Choice

advanced

Best model choice for anomaly detection in high-dimensional data

You have a dataset with many features (dimensions) and want to detect anomalies. Which model is best suited?

A K-Nearest Neighbors (KNN) based anomaly detection

B Principal Component Analysis (PCA) based anomaly detection

C Linear Regression

D Decision Tree Classifier

💡 Hint

Think about reducing dimensions to find unusual points.

PCA reduces dimensionality and can highlight points that do not fit the main patterns, making it effective for anomaly detection in high-dimensional data.

❓ Metrics

advanced

Which metric is best to evaluate anomaly detection performance?

You have a model that flags anomalies. Which metric best measures how well it finds true anomalies without too many false alarms?

A Precision

B Accuracy

C Mean Squared Error

D Recall

💡 Hint

Focus on how many flagged anomalies are actually correct.

Precision measures the proportion of detected anomalies that are true anomalies, which is important to avoid false alarms.

🔧 Debug

expert

Why does this Isolation Forest model fail to detect anomalies?

You trained an Isolation Forest model but it flags almost all points as normal. What is the most likely cause?

ML Python

from sklearn.ensemble import IsolationForest
model = IsolationForest(contamination=0.1, max_samples=100)
model.fit(data)
preds = model.predict(data)
print(sum(preds == -1))  # Count anomalies

A max_samples is too high, causing overfitting

B The model needs more trees to detect anomalies

C The data is not scaled, causing model to fail

D The contamination parameter is set too low compared to actual anomaly rate

💡 Hint

Check if the model expects a different anomaly proportion than actual data.

If contamination is set lower than the true anomaly rate, the model will label fewer points as anomalies, missing many.

Practice

1. What is the main goal of anomaly detection in machine learning?

easy

A. To reduce the number of features in the data

B. To increase the size of the training dataset

C. To find unusual data points that differ from normal patterns

D. To cluster data points into groups

Solution

1. Step 1: Understand anomaly detection purpose

   Anomaly detection aims to identify data points that do not fit the expected pattern.

2. Step 2: Compare options with definition

   Only To find unusual data points that differ from normal patterns describes finding unusual data points, which matches the goal.

3. Final Answer:

   To find unusual data points that differ from normal patterns -> Option C

4. Quick Check:

   Anomaly detection = find unusual points [OK]

Hint: Anomaly detection finds data points that stand out [OK]

Common Mistakes:

• Confusing anomaly detection with clustering
• Thinking it reduces features
• Assuming it increases dataset size

2. Which of the following is the correct way to import the IsolationForest model from scikit-learn in Python?

easy

A. from sklearn.ensemble import IsolationForest

B. import IsolationForest from sklearn

C. from sklearn.isolation import Forest

D. import sklearn.IsolationForest

Solution

1. Step 1: Recall correct import syntax for IsolationForest

   The IsolationForest model is in sklearn.ensemble module and imported as shown in from sklearn.ensemble import IsolationForest.

2. Step 2: Check other options for syntax errors

   Options A, C, and D have incorrect syntax or wrong module names.

3. Final Answer:

   from sklearn.ensemble import IsolationForest -> Option A

4. Quick Check:

   Correct import = from sklearn.ensemble import IsolationForest [OK]

Hint: Remember sklearn.ensemble holds IsolationForest [OK]

Common Mistakes:

• Using wrong module name like sklearn.isolation
• Incorrect import syntax like 'import X from Y'
• Trying to import directly from sklearn without submodule

3. Given the following Python code using IsolationForest, what will be the output of print(predictions)?

from sklearn.ensemble import IsolationForest
import numpy as np

X_train = np.array([[1], [2], [3], [4], [5]])
model = IsolationForest(random_state=42)
model.fit(X_train)

X_test = np.array([[1], [10], [3]])
predictions = model.predict(X_test)
print(predictions)

medium

A. [0 1 0]

B. [-1 -1 -1]

C. [1 1 1]

D. [ 1 -1 1]

Solution

1. Step 1: Understand IsolationForest prediction output

   IsolationForest predicts 1 for normal points and -1 for anomalies.

2. Step 2: Analyze test points relative to training data

   Points 1 and 3 are close to training data, so predicted as normal (1). Point 10 is far, predicted as anomaly (-1).

3. Final Answer:

   [ 1 -1 1] -> Option D

4. Quick Check:

   Close points = 1, far point = -1 [OK]

Hint: Normal points get 1, anomalies get -1 in IsolationForest [OK]

Common Mistakes:

• Assuming all predictions are 1
• Confusing -1 with 0 for anomalies
• Ignoring distance of test points from training data

4. The following code throws an error. What is the most likely cause?

from sklearn.ensemble import IsolationForest
model = IsolationForest()
model.predict([[1], [2], [3]])

medium

A. The input data format is incorrect

B. The model was not trained before prediction

C. IsolationForest cannot predict on lists

D. Missing random_state parameter

Solution

1. Step 1: Check if model is trained before prediction

   The code calls predict without calling fit first, so the model is not trained.

2. Step 2: Understand IsolationForest requirements

   Model must be trained with fit() before predict() to avoid error.

3. Final Answer:

   The model was not trained before prediction -> Option B

4. Quick Check:

   Call fit() before predict() [OK]

Hint: Always train model with fit() before predict() [OK]

Common Mistakes:

• Trying to predict without training
• Thinking input format causes error here
• Assuming random_state is mandatory

5. You have a dataset with mostly normal data and a few anomalies. You want to detect anomalies using IsolationForest. Which approach is best to prepare your model?

hard

A. Train IsolationForest only on normal data, then predict on all data

B. Train IsolationForest on all data including anomalies

C. Train IsolationForest only on anomalies

D. Train IsolationForest on random subsets ignoring labels

Solution

1. Step 1: Understand IsolationForest training strategy

   IsolationForest is an unsupervised algorithm designed to be trained on data that mostly contains normal points. Training only on normal data helps the model learn the normal pattern and then detect anomalies during prediction.

2. Step 2: Evaluate options for training data

   Training only on normal data, then predicting on all data (D) is the best approach. Training on all data including anomalies (B) can reduce detection accuracy as anomalies influence the model.

3. Final Answer:

   Train IsolationForest only on normal data, then predict on all data -> Option A

4. Quick Check:

   Train on normal data only [OK]

Hint: Train IsolationForest on normal data only for better anomaly detection [OK]

Common Mistakes:

• Training on all data including anomalies
• Training only on anomalies
• Ignoring the importance of training data quality