Anomaly detection
Methods that spot observations clearly departing from usual behavior, without needing labeled examples, useful against new frauds, data errors and intrusions.
Anomaly detection looks for observations that depart noticeably from the majority behavior of the data. Unlike supervised classification, it needs no labeled examples of what it seeks: it learns what is normal and flags what is not. Methods range from simple statistical rules, deviations from the mean, to more elaborate techniques: isolation by random trees, which spots points easy to separate from the rest, density estimation, distances to neighbors, autoencoders that flag what they reconstruct poorly. In insurance the value is threefold. Against fraud, it detects new patterns that supervised models, trained on past frauds, do not yet know. For data quality, it spots entry errors, outlandish amounts or inconsistent dates, before they distort a tariff or reserve. And in cybersecurity, it is at the core of intrusion detection, which spots unusual account or network behavior. Its main flaw is the number of false positives: an anomaly is not a wrongdoing, and an oversensitive signal buries analysts under alerts they end up ignoring.
Textbook case: an anomaly detection model applied to claims payments spots a handler whose settlements are concentrated on a small number of bank accounts and consistently just below his authority threshold. No rule had flagged it; the investigation reveals a 300,000 euro embezzlement over two years.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.