What metrics are used for anomaly detection performance?

Anomaly detection performance is typically evaluated using metrics like precision, recall, F1 score, and area-under-the-curve (AUC) measures. Precision measures the proportion of correctly identified anomalies out of all detected cases, helping quantify false positives. Recall calculates the fraction of true anomalies successfully detected, highlighting missed cases. The F1 score balances these two by taking their harmonic mean, which is useful when class imbalance exists (e.g., rare anomalies in a mostly normal dataset). For example, in fraud detection, a high recall ensures most fraudulent transactions are caught, even if some legitimate ones are mistakenly flagged. Precision, however, becomes critical in scenarios like manufacturing quality control, where false alarms could halt production unnecessarily.

Another common approach involves ROC-AUC (Receiver Operating Characteristic curve) and PR-AUC (Precision-Recall curve). ROC-AUC plots the true positive rate against the false positive rate across classification thresholds, providing an aggregate view of performance. PR-AUC focuses on precision and recall trade-offs, making it more informative for highly imbalanced datasets where anomalies are rare. For instance, in network intrusion detection, ROC-AUC might show strong overall performance, but PR-AUC could reveal weaknesses in detecting subtle attacks due to low precision. These metrics are especially useful when comparing models or tuning thresholds, as they account for varying decision boundaries.

Domain-specific metrics are also crucial. False Positive Rate (FPR) is critical in applications like medical diagnostics, where incorrectly flagging healthy patients as anomalies wastes resources. Mean Time to Detection (MTTD) measures how quickly anomalies are identified in time-series data, such as server monitoring. For example, a cybersecurity system might prioritize MTTD to minimize breach impact. Additionally, metrics like Matthews Correlation Coefficient (MCC) provide a balanced view for binary classification, especially when class distributions are skewed. Choosing the right metrics depends on the use case: optimizing for F1 might suit fraud detection, while minimizing FPR could matter more in industrial sensor systems.