Unsupervised anomaly detection

Abstract

Described are techniques for anomaly detection including a method comprising sorting a univariate data set in an numeric order and generating a second univariate data set based on the sorted univariate data set, where respective elements in the second univariate data set correspond to respective differences between consecutive elements in the sorted univariate data set. The method further comprises sorting the second univariate data set in numeric order and generating a third univariate data set that includes index values corresponding to respective differences in the sorted second univariate data set that are above a threshold. The method further comprises modifying the third univariate data set and defining a set of clusters based on the modified third univariate data set. The method further comprises clustering the sorted univariate data set according to the set of clusters and characterizing a new data point as anomalous in response to the clustering.