Anomaly Detection Quiz

Practice Quiz: Anomaly Detection

Question 1

You are building a system to detect if computers in a data center are malfunctioning. You have 10,000 data points of computers functioning well, and no data from computers malfunctioning. What type of algorithm should you use?

Anomaly detection ✓
Supervised learning

Answer found in: Section 1 (Finding unusual events) and Section 5 (Anomaly detection vs. supervised learning) - With only normal examples and no malfunction data, anomaly detection is appropriate to learn what normal behavior looks like and flag deviations.

Question 2

You are building a system to detect if computers in a data center are malfunctioning. You have 10,000 data points of computers functioning well, and 10,000 data points of computers malfunctioning. What type of algorithm should you use?

Anomaly detection
Supervised learning ✓

Answer found in: Section 5 (Anomaly detection vs. supervised learning) - With large numbers of both positive and negative examples (10,000 each), supervised learning is more appropriate since you have sufficient labeled data to learn patterns.

Question 3

Say you have 5,000 examples of normal airplane engines, and 15 examples of anomalous engines. How would you use the 15 examples of anomalous engines to evaluate your anomaly detection algorithm?

Use it during training by fitting one Gaussian model to the normal engines, and a different Gaussian model to the anomalous engines.
You cannot evaluate an anomaly detection algorithm because it is an unsupervised learning algorithm.
Put the data of anomalous engines (together with some normal engines) in the cross-validation and/or test sets to measure if the learned model can correctly detect anomalous engines. ✓
Because you have data of both normal and anomalous engines, don’t use anomaly detection. Use supervised learning instead.

Answer found in: Section 4 (Developing and evaluating an anomaly detection system) - The small number of anomalous examples should be used in cross-validation and test sets for evaluation and parameter tuning, not for training the model.

Question 4

Anomaly detection flags a new input x as an anomaly if p(x) < ε. If we reduce the value of ε, what happens?

The algorithm is more likely to classify new examples as an anomaly.
The algorithm is less likely to classify new examples as an anomaly. ✓
The algorithm is more likely to classify some examples as an anomaly, and less likely to classify some examples as an anomaly. It depends on the example x.
The algorithm will automatically choose parameters μ and σ to decrease p(x) and compensate.

Answer found in: Section 3 (Anomaly detection algorithm) - A smaller ε means a lower threshold for flagging anomalies, so fewer examples will have p(x) < ε, making the algorithm less likely to flag examples as anomalous.

Question 5

You are monitoring the temperature and vibration intensity on newly manufactured aircraft engines. You have measured 100 engines and fit the Gaussian model described in the video lectures to the data. The measurements on the latest engine you are testing have a temperature of 17.5 and a vibration intensity of 48. These are shown in magenta on the figure below. What is the probability of an engine having these two measurements?

0.0738 + 0.02288 = 0.0966
0.0738 * 0.02288 = 0.00169 ✓
17.5 * 48 = 840
17.5 + 48 = 65.5

Answer found in: Section 3 (Anomaly detection algorithm) - The probability model assumes independence, so p(x) = p(x₁) × p(x₂). From the figure, p(temperature = 17.5) ≈ 0.0738 and p(vibration = 48) ≈ 0.02288, so the combined probability is their product.