Anomaly Detection Pipeline

Project roadmap

1. 01

   Design the pipeline

   ~2h

   Choose a dataset with some known anomalies (for example a public credit card fraud or network intrusion dataset, or your own data with injected anomalies). Write DESIGN.md: the stages (validate input, preprocess, score with each method, combine scores, flag the top records or those above a threshold, and export), the saved model (the fitted recipe and detectors with their settings), and the review loop. Done when: DESIGN.md covers every stage and output.

2. 02

   Validate and preprocess

   ~2h

   Validate incoming data (required columns, types and ranges) and report problems clearly. Build a recipes recipe that imputes missing values, handles skewed columns (for example with a log or Yeo-Johnson transformation), encodes categories and normalizes numeric columns, fitted only on training data. Done when: the recipe prepares training and new data identically.

3. 03

   Score with several methods

   ~3h

   Implement three scores: the largest robust z-score across columns (using the median and MAD), the Mahalanobis distance using a robust covariance estimate (for example from the robustbase package), and an isolation forest (with the isotree package). Convert each to a rank from 0 to 1 and combine them (for example by averaging), keeping each method's score so you can explain flags. Done when: every record has a combined score and the individual scores.

4. 04

   Evaluate and choose a threshold

   ~2h

   Using the known anomalies, compute precision and recall for the top-k records, and the area under the precision-recall curve for each method and the combination (with yardstick). Choose a threshold based on how many records reviewers can check per day. Record the results in README.md. Done when: README.md compares the methods and justifies the threshold.

5. 05

   Save and reuse the model

   ~1.5h

   Save the fitted recipe, detectors, threshold and a version number as one object, and write a score_new_data() function that loads it and scores a new file, exporting flagged records to CSV with their scores and the columns that contributed most. Scoring the same data twice must give identical results. Done when: new data is scored consistently, and the export explains each flag.

6. 06

   Build the review app

   ~2.5h

   Build a Shiny app that loads a scored file, lists flagged records sorted by score with filters, shows each record's values compared with typical values and the contributing columns, and lets reviewers mark each as a real anomaly or a false alarm with a comment, saved to a file. Show how precision at the current threshold would change with the reviews so far. Done when: reviewers can go through flagged records and save verdicts.

7. 07

   Test it

   ~2h

   Write testthat tests: input validation, the recipe applied to new data with unseen categories, each scoring method on a small dataset with an obvious outlier, reproducible scores with a fixed seed, and the export format. Done when: all tests pass.

Resources

• Docsrecipes documentation
• Docsisotree: isolation forests
• ArticleAnomaly detection (Wikipedia)
• Docsyardstick documentation
• DocsMastering Shiny (free online book)