Anomaly detection
How many times do we have to flip a coin before we realize that it is counterfeit?
When detecting anomalies in known processes with expected results, we may be interested in analyzing the most recent data to detect atypical deviations that are worth analyzing and anticipate possible serious consequences. Is our wind turbine generating the expected average energy? Is our engine consuming the expected average fuel? Or, to simplify the explanation, does some roulette numbers come out significantly more than others, is our currency rigged?
Let’s look at the statistical basis with this last example. The experiment consists of tossing a coin and noting the result (heads or tails). It could happen that the coin we are tossing is tricked and this fact influences the number of times the toss results in heads or tails. Now, how can we know if we are being cheated, or, in other words, how can we identify such an anomaly in a series of events?
The first thing to clarify is that this question cannot be answered with 100% confidence and, therefore, we will have to define a confidence level (usually 95%) beforehand. Let’s look at this “confidence” in more detail. If we flip a coin 100 times and count the number of heads, we can get 101 possible values for the total number of heads: 0 heads in 100 flips, 1 head in 100 flips, or up to 100 heads in 100 flips. Now, if we were to get 100 heads in 100 tosses, we can reason in two ways:
- 1. What luck we have had! Even though the probability of getting 100 heads is (1/2)100 = 7.88 * 10-31, it happened!
- 2. Or, suspect and conclude the coin must be counterfeit!
So, is there any way to know if the coin we use in the toss is rigged or not? The answer is yes, and it is called Statistical Inference, which is defined as the study of different methods to obtain general conclusions of a whole population from the analysis of a sample, providing information on the degree of reliability or confidence of the results obtained.
There are numerous ways to reach the result we are interested in, but, in this case, we will use a method known as Bayesian approximation. This technique is fundamentally based on tossing the coin repeatedly and contrasting (or comparing) the results obtained with what should have happened if we had an ideal coin. In other words, we know what are the probabilities of the different ‘heads-crosses’ combinations and, therefore, which combinations are highly improbable (therefore, suspicious). Thus, if we select 95% as the “confidence level” for this experiment, we will conclude that the coin is rigged if any of the results of the other 5% of extreme (and highly unlikely) outcomes are obtained.
The following tables provide the ranges of values (% of heads in the first table or number of heads in the second table) for which we would not suspect the coin. A first conclusion, ‘the more tosses (data) the easier it is to detect the anomaly (the ranges become smaller as we toss the coin more times)’.
| Level of significance | |||||||
| 1% | 5% | 10% | |||||
| # of tosses | Min | Max | Min | Max | Min | Max | |
| 100 | 37,12 % | 62,88 % | 40,20 % | 59,80 % | 41,78 % | 58,22 % | |
| 500 | 44,24 % | 55,76 % | 45,62 % | 54,38 % | 46,32 % | 53,68 % | |
| 1000 | 45,93 % | 54,07 % | 46,90 % | 53,10 % | 47,40 % | 52,60 % | |
Table 1. Minimum and maximum ratio to accept that the coin is not gimmicked according to the desired significance level and the number of coin tosses performed.
The following table can be interpreted as follows. If we flip a coin 500 times, with a probability of 95 % we will obtain between 228 and 272 heads (45 of the 501 possible results accumulate 95 % of the probability). Any other value would make us suspect that the coin is tricked.
| Level of significance | |||||||
| 1% | 5% | 10% | |||||
| # of tosses | Min | Max | Min | Max | Min | Max | |
| 100 | 37 | 63 | 40 | 60 | 42 | 58 | |
| 500 | 221 | 279 | 228 | 272 | 232 | 268 | |
| 1000 | 459 | 541 | 469 | 531 | 474 | 526 | |
Table 2. Minimum and maximum number of faces to accept that the coin is not counterfeited according to the desired level of significance and the number of tosses performed
To visualize it better, an animation has been created in R. The toss of a coin 500 times has been simulated to record the number of heads obtained and to construct the distribution function associated with the probability of getting heads after each toss. If the coin being used in the experiment were ideal, i.e. not rigged, as more ‘flips’ are made, the distribution should be closer to the value 0.50 (dashed vertical line in the animation) and, likewise, the probability of the probability of getting heads should be higher and higher (between 0.45 and 0.55).
We observe that, for a total of 500 coin tosses, the number of faces was 258. This value is between the Min and Max in our previous table (even for the three levels of significance), so we would not suspect the virtual currency used.
If this were to occur in any process of our business, we would understand that everything would be in order since no relevant anomalies are seen in the process being carried out. For example, if it were an analysis of the average fuel consumption of the vehicles that make up our company’s fleet, it would be enough to analyze the consumption per km of the last N trips and analyze whether the average consumption is in the 95% confidence interval or, on the contrary, is in the 5% of the anomalous values.
At OGA we have experience in the development, exploitation and detection of these trends. If you are interested in their implementation, do not hesitate to contact us and we can help you analyze the business scenario in which you operate and detect possible anomalies that will help you improve your efficiency.
Latests articles
Acerca del autor
María José Silva
Graduated in Mathematics at the University of Seville (US) with experience in Data Analysis and Processing, Training of Econometric Models, Optimization and Artificial Intelligence.
In love with dance, my roots, and new experiences.