2.3  Anomaly Detection

import numpy as np
import pandas as pd
from sklearn.ensemble import IsolationForest
from sklearn.metrics import precision_score, recall_score, f1_score, roc_auc_score
from sklearn.preprocessing import StandardScaler

np.random.seed(42)

# ── Simulate Credit Card Transactions ─────────────────────────
n_normal, n_fraud = 9800, 200

normal = pd.DataFrame({
    'amount':   np.abs(np.random.normal(85, 60, n_normal)),
    'freq_day': np.random.poisson(3, n_normal).astype(float),
    'loc_dev':  np.abs(np.random.normal(5, 10, n_normal)),
    'hour':     np.random.randint(7, 23, n_normal).astype(float),
    'label':    0
})
fraud = pd.DataFrame({
    'amount':   np.abs(np.random.normal(1800, 800, n_fraud)),
    'freq_day': np.random.poisson(18, n_fraud).astype(float),
    'loc_dev':  np.abs(np.random.normal(900, 300, n_fraud)),
    'hour':     np.random.randint(0, 5, n_fraud).astype(float),
    'label':    1
})
df = pd.concat([normal, fraud]).sample(frac=1, random_state=42).reset_index(drop=True)

X = df[['amount','freq_day','loc_dev','hour']].values
y = df['label'].values

sc = StandardScaler()
X_sc = sc.fit_transform(X)

# ── Isolation Forest ──────────────────────────────────────────
# `contamination` is the ASSUMED anomaly rate and sets the flagging threshold.
# In deployment it is unknown — setting it to the true rate (here 0.02) would
# hand the model the answer it is supposed to estimate. Use 'auto', which
# applies the offset from the original paper, and inspect the operating
# point separately below.
iso = IsolationForest(n_estimators=200, contamination='auto',
                       max_samples='auto', random_state=42)
iso.fit(X_sc)

scores      = -iso.score_samples(X_sc)  # higher = more anomalous
predictions = iso.predict(X_sc)         # -1 = anomaly, +1 = normal
y_pred      = (predictions == -1).astype(int)

print("=== Isolation Forest — Credit Card Fraud ===")
print("Operating point: contamination='auto' — the true 2% rate is NOT supplied.")
print(f"Anomalies detected : {y_pred.sum()} / {len(y_pred)}")
print(f"Precision          : {precision_score(y, y_pred):.4f}")
print(f"Recall             : {recall_score(y, y_pred):.4f}")
print(f"F1-Score           : {f1_score(y, y_pred):.4f}")
print(f"AUC-ROC            : {roc_auc_score(y, scores):.4f}")

# ── Anomaly score distribution ────────────────────────────────
normal_scores = scores[y == 0]
fraud_scores  = scores[y == 1]
print(f"\nAnomaly Score — Normal: mean={normal_scores.mean():.4f}, std={normal_scores.std():.4f}")
print(f"Anomaly Score — Fraud : mean={fraud_scores.mean():.4f}, std={fraud_scores.std():.4f}")

# ── Effect of contamination parameter ────────────────────────
# This is the whole story: AUC-ROC above is threshold-free and stays perfect,
# while precision/recall swing wildly with an assumption you cannot verify
# without labels. Quote the sweep, never a single flattering F1.
print("\nEffect of contamination parameter:")
for cont in [0.005, 0.01, 0.02, 0.05, 0.10]:
    m = IsolationForest(n_estimators=100, contamination=cont, random_state=42)
    p = (m.fit_predict(X_sc) == -1).astype(int)
    print(f"  contamination={cont:.3f}: flagged={p.sum():5d}, F1={f1_score(y,p):.4f}")