Assumptions and Limitations

Statistical methods for anomaly detection are powerful—but they are not magic. Every method we've covered makes assumptions about the data: its distribution, independence, stationarity, and the nature of anomalies themselves. When these assumptions hold, statistical methods provide principled, interpretable detection with controlled error rates. When they fail, the methods can produce arbitrarily wrong results.

This final page synthesizes the assumptions and limitations of statistical anomaly detection, providing you with the diagnostic skills to know when to trust these methods, when to be cautious, and when to abandon them entirely for alternatives.

All statistical anomaly detection methods share certain foundational assumptions. Understanding these is essential for proper application.

Assumption 1: Distributional Form

What it means: The data follows a known or assumed probability distribution (typically normal/Gaussian).

Why it matters: Threshold calculations depend on this distribution. The "3-sigma rule" assumes normality. Chi-squared thresholds for Mahalanobis distance assume multivariate normality.

Consequences of violation:

• Heavy-tailed data: Extreme values are more common than assumed → too many false negatives (real outliers classified as normal)
• Light-tailed data: Extreme values are rarer than assumed → too many false positives
• Skewed data: Asymmetric false positive rates; detection biased toward one tail
• Multimodal data: One mode's normal values appear as outliers relative to another mode

Assumption 2: Independence

What it means: Each observation provides independent information. The value of one observation doesn't predict another.

Why it matters: Standard error calculations, effective sample size, and sequential testing depend on independence.

Consequences of violation:

• Positive autocorrelation: Observations cluster → overestimated sample size, inflated confidence, more false positives
• Negative autocorrelation: Adjacent observations differ → underestimated variance, more false positives
• Spatial correlation: Geographic or network clustering violates i.i.d. assumption

Assumption 3: Stationarity

What it means: The underlying data-generating process doesn't change over time. The mean, variance, and correlation structure are constant.

Why it matters: Statistics computed from historical data are used to evaluate new observations. If the process changes, historical benchmarks become irrelevant.

Consequences of violation:

• Trend: Values drift over time → historical mean underestimates current mean, creating systematic false positives or negatives
• Seasonality: Periodic patterns → values at seasonal peaks appear anomalous relative to off-peak statistics
• Concept drift: The definition of "normal" changes → the detector becomes obsolete

Assumption 4: Contamination is Low

What it means: The dataset used to estimate parameters is predominantly "normal" (non-anomalous). Anomalies are rare.

Why it matters: Statistics (mean, variance, covariance) are computed assuming most data is normal. High contamination corrupts these estimates.

Consequences of violation:

• Masking: Outliers inflate variance, making other outliers appear less extreme
• Swamping: Outliers shift the mean, making normal points appear extreme
• Corrupted thresholds: Detection limits become meaningless

Assumption 5: Anomalies are Statistically Rare

What it means: Anomalies are defined as low-probability events under the assumed distribution. They occur in the tails.

Why it matters: The very definition of "outlier" as "statistically improbable" requires that most observations are probable.

Consequences of violation:

• If anomalies are common: They're not anomalies—they're a second mode of normal behavior
• If anomalies cluster: They form their own distribution, requiring clustering-based approaches

Before applying statistical methods, check whether your data satisfies the necessary assumptions. Here are practical diagnostic techniques:

Checking Normality

Visual Methods:

• Histogram: Should show symmetric, bell-shaped distribution
• Q-Q Plot (Quantile-Quantile): Points should lie on a straight diagonal line
• Box Plot: Whiskers should be roughly symmetric; many points beyond whiskers suggest heavy tails

Statistical Tests:

• Shapiro-Wilk test: Best for small to medium samples (n < 5000)
• D'Agostino-Pearson test: Tests skewness and kurtosis
• Anderson-Darling test: Emphasizes tail behavior
• Kolmogorov-Smirnov test: General distribution test

Caveat: For large samples, formal tests reject normality even for slight, practically irrelevant deviations. Use visual inspection alongside statistical tests.

Checking Independence

Visual Methods:

• Lag plot: Plot $x_t$ vs $x_{t-1}$. Random scatter indicates independence; patterns indicate dependence
• Autocorrelation function (ACF) plot: Bars should decay quickly to near-zero for independent data

Statistical Tests:

• Durbin-Watson test: Tests for first-order autocorrelation
• Ljung-Box test: Tests for autocorrelation at multiple lags
• Runs test: Checks if sequential values are random

Checking Stationarity

Visual Methods:

• Time series plot: Look for trends, seasonal patterns, or changing variance
• Rolling statistics: Compute mean and variance in sliding windows; should be constant

Statistical Tests:

• Augmented Dickey-Fuller (ADF) test: Tests for unit root (non-stationarity)
• KPSS test: Tests null hypothesis of stationarity
• Phillips-Perron test: Alternative to ADF

Checking for Contamination

This is inherently circular—if you knew which points were contamination, you wouldn't need detection. Approaches:

• Compare robust (MCD, MAD) and non-robust estimates; large discrepancy suggests contamination
• Examine the proportion of points flagged by robust methods
• Domain knowledge about expected anomaly rates

Heavy tails are the most common and dangerous violation of normality assumptions in real-world data.

What Are Heavy Tails?

A distribution has heavy tails if extreme values are more probable than under the normal distribution. Mathematically, if the tail probability decays slower than exponentially:

$$P(X > x) \sim x^{-\alpha} \text{ (power law)}$$

vs.

$$P(X > x) \sim e^{-x^2/2} \text{ (Gaussian, exponential decay)}$$

Examples of heavy-tailed data:

• Financial returns (crashes and booms are more common than normal predicts)
• Network traffic (few connections dominate, many are tiny)
• City populations (few mega-cities, many small towns)
• File sizes (many small, occasional huge)
• Insurance claims (most small, occasional catastrophic)

The Impact on Detection

Under heavy tails, Z-scores of 5, 10, or even 20 can occur regularly in normal operation. Applying a threshold of $|z| > 3$ will flag countless legitimate observations as anomalies.

Solutions for Heavy Tails

1. Use Non-Parametric Methods IQR-based detection and MAD-based detection don't assume normality. They're based on order statistics and remain valid for heavy-tailed data.

2. Transform the Data Log, square root, or Box-Cox transforms can reduce heavy-tailedness. Check normality after transformation.

3. Use Tail-Specific Methods Extreme Value Theory (EVT) provides principled methods for heavy-tailed data, modeling only the tail behavior.

4. Use Higher Thresholds If you must use Z-scores on heavy-tailed data, calibrate thresholds empirically rather than using theoretical normal quantiles.

5. Model the Actual Distribution Fit a t-distribution, generalized Pareto, or other heavy-tailed family and compute tail probabilities accordingly.

Time series data—measurements over time—often violates the stationarity assumption.

Types of Non-Stationarity

Trend: The mean systematically increases or decreases over time.

• Sales growing due to business expansion
• Temperature rising due to climate change
• Degrading sensor reading as equipment ages

Seasonality: Regular periodic patterns.

• Retail sales peaking during holidays
• Energy usage peaking in winter/summer
• Website traffic varying by time of day

Level Shifts: Sudden permanent changes.

• New product launch changing sales baseline
• Regulatory change affecting behavior
• Equipment replacement changing readings

Variance Changes (Heteroscedasticity): Volatility increases or decreases.

• Market volatility clustering (calm periods followed by turbulent periods)
• Measurement precision changing with instrument calibration

The Impact on Detection

With trends:

• Recent high values appear as outliers relative to historical mean (when they're actually the new normal)
• Recent low values might not be flagged (even though they represent unusual drops)

With seasonality:

• Peak-season values flagged as outliers when compared to annual statistics
• Off-peak genuine anomalies might be missed

With level shifts:

• All post-shift data appears anomalous relative to pre-shift statistics
• Or all pre-shift data appears anomalous if statistics computed after the shift

Solutions for Non-Stationarity

1. Detrending Fit and remove the trend component before anomaly detection. Common methods:

• Moving average subtraction
• Linear/polynomial regression of time
• Differencing (analyze changes rather than levels)

2. Deseasonalization Remove seasonal components using:

• Seasonal decomposition (STL, X-13A-RIMA)
• Seasonal dummy variables
• Fourier series regression

3. Sliding Window Approaches Compute statistics from a recent window rather than all historical data. Only recent data informs what's "normal" now.

When data comes from multiple subpopulations with different characteristics, applying global statistics produces nonsensical results.

What Causes Multimodality?

Multiple User Types:

• Free vs. premium subscribers (different usage patterns)
• Mobile vs. desktop users (different session lengths)
• Domestic vs. international customers (different purchase sizes)

Multiple Operating Regimes:

• Machine on vs. off (bimodal power consumption)
• Peak vs. off-peak traffic (bimodal request rates)
• Working hours vs. night (bimodal activity)

Mixture of Sources:

• Combined data from multiple sensors
• Aggregated data from different departments
• Mislabeled or merged datasets

Why Global Statistics Fail

Consider bimodal data with modes at 10 and 100. The global mean is around 55—a value that almost never occurs! A point at 10 or 100 (both perfectly normal) might be flagged as ~3-4 standard deviations from the mean.

Meanwhile, a value at 55 (which never occurs naturally) would appear perfectly normal by Z-score—it's right at the mean!

Solutions for Multimodality

1. Stratified Analysis If you can identify subpopulations (e.g., user_type column), analyze each separately. Compute statistics within each group.

2. Mixture Model Approach Fit a Gaussian Mixture Model (GMM) to the data. For each point, evaluate its probability under the mixture—not relative to a single Gaussian.

3. Clustering First Apply clustering (k-means, DBSCAN) to identify natural groups. Then detect anomalies within clusters or as points far from all cluster centers.

4. Density-Based Methods Methods like Local Outlier Factor (LOF) or Isolation Forest implicitly handle multimodality by evaluating local density rather than global statistics.

5. Domain Knowledge Often the subpopulations are known. Segment the data before applying statistical methods.

Given the assumptions and failure modes, how do you choose the right method for your data? Here's a decision framework:

Decision Tree for Method Selection

Statistical methods are powerful but not universal. Some situations call for fundamentally different approaches.

Signs You Need Non-Statistical Methods

1. Complex Feature Interactions When anomalies are defined by intricate combinations of features that can't be captured by linear covariance structures, consider:

• Isolation Forest: Random partitioning finds anomalies efficiently
• Local Outlier Factor (LOF): Local density comparison handles complex shapes
• One-Class SVM: Learns a decision boundary in kernel space
• Autoencoders: Neural networks learn to compress; anomalies reconstruct poorly

2. Categorical or Mixed Data Statistical methods assume continuous numeric data. For:

• Categorical features: Use frequency-based or distance-based methods
• Mixed types: Encode appropriately or use methods like Isolation Forest that handle heterogeneous data

3. Labeled Anomaly Examples Available If you have examples of known anomalies, use supervised or semi-supervised learning:

• Classification (with class imbalance handling)
• Positive-unlabeled learning
• Anomaly-aware metric learning

4. Very High Dimensions In hundreds or thousands of dimensions:

• Distance metrics become meaningless (curse of dimensionality)
• Covariance estimation is impossible without more samples than features
• Consider: Deep learning autoencoders, dimensionality reduction + detection, or feature selection

5. Sequential/Graph Structure When data has inherent structure:

• Time series: Specialized methods (Prophet, ARIMA residuals, LSTM autoencoders)
• Graphs: Graph neural networks, community detection-based methods
• Text: NLP-specific approaches (embedding distances, perplexity)

6. Domain-Specific Anomaly Definitions Statistical rarity isn't always the right definition of "anomaly":

• Security: Known attack signatures (rule-based detection)
• Business: Values outside acceptable ranges (threshold-based)
• Quality: Specific defect patterns (supervised classification)

Statistical methods detect statistically unusual. If your definition of anomaly is different, use methods aligned with that definition.