Anomaly detection doesn't need labelled examples of every possible anomaly — it just needs a good model of what normal looks like, then flags what doesn't fit.
score(x) = distance(x, cluster_centroid)
flag if score > sensitivity
- Data points — sample points, most drawn from the normal-behaviour distribution.
- Cluster tightness — how compact the normal cluster is, which sharpens the anomaly boundary.
- Anomaly injection rate — fraction of points deliberately drawn from an outlier distribution.
- Detection sensitivity — distance-from-centroid threshold that triggers a flag.
This exact distance-from-normal logic runs behind credit-card fraud alerts and datacenter intrusion detection, both scoring deviation from a learned baseline.