Anomaly Detection Basics: Z-Scores, IQR, Seasonality & Alert Precision

What you'll build

What you will be able to do

Each lab ends with a concrete result that you build yourself and the checker confirms, cell by cell.

• Standardise 16 card payments with mean and standard deviation, flag the ones with |z| ≥ 3 and discover why one huge outlier can hide another.
• Replace mean and standard deviation by median and MAD, compute the modified z-score and catch the payment that masking hid.
• Compute quartiles, the IQR and Tukey's fences for one-minute API latencies, label high and low outliers and count the extreme ones.
• Compute a trailing rolling mean and standard deviation, draw ±3σ bands around a traffic metric and see which points break out.
• Build a same-hour-last-weeks baseline, compute residuals and compare seasonal alerts with a flat rule that ignores the daily pattern.
• Standardise three transaction features, combine them into one distance score and find the payment that looks normal on every single feature but odd as a whole.
• Score a detector against labelled incidents: TP and FP per threshold, precision, recall, F1, the best threshold and the trade-off curve.
• Price false alarms and missed incidents, find the cheapest threshold and then the cheapest one a human on-call team can actually handle.