The Week 5 tutorial, made interactive. Each question starts with the one idea from the lectures you need, then walks to the official answer in small steps.
How do precision, recall, F-score, AUROC and AUPRC guide us in anomaly detection? Give a scenario for each.
Accuracy fails on rare anomalies: with 9,990 normal and 10 anomalous samples, a model that predicts “normal” for everything scores 99.9% accuracy and catches zero anomalies. So we use metrics built from the four cells below.
| Actual anomaly | Actual normal | |
|---|---|---|
| Flagged | TP caught correctly | FP false alarm |
| Not flagged | FN missed | TN correctly ignored |
6,000 points were clustered into A, B, C. What is the F1-score with respect to cluster B?
“With respect to B” means: B is the positive class, everything else is negative. Then Precision = , Recall = , F1 = .
| Actual | |||||
|---|---|---|---|---|---|
| A | B | C | SUM | ||
| Predicted | A | 600 | 400 | 200 | 1200 |
| B | 1000 | 1200 | 200 | 2400 | |
| C | 400 | 400 | 1600 | 2400 | |
| SUM | 2000 | 2000 | 2000 | ||
Before Q3 questions this scheme, watch it run once: cluster first, then score by distance.
k-means summarises the data with k centres: assign every point to its nearest centre, move each centre to the mean of its points, repeat until nothing moves. Then each point gets an anomaly score — your distance to your centre, relative to your cluster-mates. ≈ 1 means typical; ≫ 1 means anomaly.
Points are scored by distance to their nearest cluster centre. Three questions about the figure below.
Anomaly score of a point = its distance to the nearest centroid (relative to the average distance in that cluster). Big distance → likely anomaly. But the centroid is the mean of its cluster — and means get pulled by outliers.
P(normal flagged) = 0.01, P(anomaly flagged) = 0.99, and 99% of objects are normal. Find both rates.
Detection rate = · False alarm rate = . Think in counts, not probabilities — take 10,000 objects.
Fraudsters invent new tricks all the time. What are the merits of each approach here?
Supervised = learn from labelled examples (like signature detection: great on known patterns). Unsupervised = model normal behaviour and flag deviations (can catch new patterns).
Trained on labelled past fraud.
Strong: accurate on known fraud types.
Blind: a brand-new trick matches no training label — it slips through.
Models normal transactions; flags deviations.
Strong: can flag fraud types never seen before.
Blind: more false alarms; no notion of “known fraud”.
Five quick true-or-false style checks. Tap each card for the answer.
Noise = random error or variance — not interesting. Anomalies = interesting, because they may come from a different mechanism than the rest of the data.
Before Q7 and Q8 ask you to reason about DBSCAN, watch it run once on 16 points.
Two knobs: ε — the radius of the circle around each point — and MinPts — how many points (itself included) must sit inside that circle to make a point a core. Clusters grow by chaining core points; the algorithm visits every point once.
MinPts = 6, ε = 0.1 gave 4 clusters and 5% outliers. Same ε, MinPts = 8 — what do you expect?
Raising MinPts demotes core points. Fewer cores → the connection graph loses nodes and edges → sparse clusters dissolve or split, and more points end up as outliers.
8 points, MinPts = 2. Find the clusters for ε = 2, then for ε = √10.
With MinPts = 2, a point is core as soon as one other point sits within ε. So: list each point's ε-neighbourhood, then chain neighbours into clusters. Points with an empty neighbourhood are anomalies.
| point | ε-neighbourhood | role |
|---|
Before Q9 compares LOF to k-NN, compute one LOF by hand — the exact example from Lecture 8.
LOF asks one question: am I as densely packed as my neighbours? The pipeline: distance to your k-th neighbour (dist₂) → smoothed distances (reachdist) → local density (lrd) → the ratio of your neighbours' density to yours (LOF). Ratio ≈ 1: you fit in. Ratio > 1: you are the sparse one.
Rank anomalies with LOF, then with k-NN distance (k = 1…5, raw and normalised). How much do the top-5 lists agree?
Different lens, different anomalies: LOF (local density) and k-NN (global distance) pick entirely different points here. Scaling the features reshuffles rankings too, though raw and normalised k-NN still mostly agree.