Which algorithm is best for anomaly detection?

Why There's No Single 'Best' Anomaly Detection Algorithm

If you came here hoping for one definitive winner, the honest answer is uncomfortable: there isn't one. The evidence consistently shows that the "best" anomaly detection algorithm depends on your data, your labels, and the problem you're actually solving.

IBM frames the choice around three learning paradigms, noting that "the use of supervised, unsupervised and semi-supervised learning algorithms will depend on the type of data being collected and the operational challenge being solved." Each paradigm has trade-offs:

• Supervised methods excel at catching known outliers, but they can't discover unknown anomalies or predict future issues.
• Unsupervised methods can surface anomalies nobody has labeled yet, but they may mislabel results because they're making assumptions about the input data.
• Semi-supervised approaches, when labeled and unlabeled data coexist, usually make predictions more accurate.

That middle path is where most teams get stuck. The scikit-learn documentation warns plainly: "In the absence of labelled data, the problem is completely unsupervised so model selection can be a challenge." Without ground truth, you can't easily score one algorithm against another — which is exactly why the question needs reframing from "which is best?" to "which fits my data and constraints?"

Even the most rigorous head-to-head comparison avoids crowning a universal champion. A NeurIPS 2024 study evaluated 33 unsupervised algorithms across 52 real-world multivariate tabular datasets and found that Extended Isolation Forest was the strongest overall performer — but k-nearest neighbors won on local anomalies while EIF won on global ones. The authors concluded that a two-algorithm toolbox suffices for most practical use, not a single winner.

Context narrows the field further. The same scikit-learn comparison found that Isolation Forest and Local Outlier Factor "seem to perform reasonably well for multi-modal data sets," while One-Class SVM "is known to be sensitive to outliers." A peer-reviewed manufacturing study found LOF and Isolation Forest combined with autoencoder-based feature reduction achieved F1-scores above 84% with precision near 99% — but that result is domain-specific, not a universal benchmark.

IBM adds a final wrinkle: "normal" is defined by your business functions and goals. High traffic might be a cyberattack or a successful marketing campaign — the same data point, different meaning.

The practical takeaway: benchmark candidates on your own data rather than trusting generic rankings. That same principle — measure actual lift, don't guess — is what SkillzBench is building for agent skills, testing each one in a sandbox and publishing the percentage-point Lift so users can see what actually helps before relying on it.

What the Largest Head-to-Head Study Found: EIF + kNN as the Default Toolbox

If you want evidence rather than opinion on which algorithm wins, the strongest data point available comes from NeurIPS 2024. A large-scale benchmark study evaluated 33 unsupervised anomaly detection algorithms across 52 real-world multivariate tabular datasets — the most comprehensive head-to-head comparison published to date.

The result is refreshingly concrete. Extended Isolation Forest (EIF) emerged as the strongest overall performer, outperforming most other algorithms across the full dataset collection. But the study's most useful insight is that performance splits along a line most practitioners intuitively sense but rarely articulate: global versus local anomalies.

A global anomaly deviates from the entire dataset's overall structure — an obvious spike, a point far from everything. A local anomaly looks normal in aggregate but sits oddly within its own neighborhood, a subtlety that density-based methods catch best. The study found k-nearest neighbor (kNN) wins on local anomalies, while EIF wins on global ones.

That distinction explains why so many algorithm debates go in circles. Two teams can compare results on the same data and both be "right," because they're implicitly optimizing for different anomaly types. The scikit-learn documentation echoes this nuance, noting that Isolation Forest and Local Outlier Factor perform reasonably well on multi-modal data, while One-Class SVM is sensitive to outliers and struggles with outlier detection.

The study's practical conclusion, though, is what makes it genuinely useful:

• EIF is the strongest overall performer across 52 real-world datasets
• kNN is the best choice when local anomalies dominate
• Accounting for computational complexity, the authors state that "a toolbox with these two unsupervised anomaly detection algorithms suffices" for most multivariate data
• That means most teams don't need 33 algorithms — they need two, chosen deliberately

For business owners and managers, this is good news: a defensible default exists, grounded in peer-reviewed evidence rather than vendor marketing. Start with EIF, add kNN when your use case involves clustered data with local deviations — fraud rings, sensor neighborhoods, regional patterns — and you've covered the majority of practical scenarios.

If you're extending this workflow with AI agents, the same benchmark-before-you-trust logic applies to the tools themselves. SkillzBench is building a free directory and MCP connector so you can independently test agent skills — data prep, alerting, model monitoring — and see their measured lift before relying on them.

Where Specific Algorithms Win: Multi-Modal Data, Feature Reduction, and the One-Class SVM Caveat

Beyond the headline benchmarks, the real question for practitioners is which algorithm wins under specific data conditions. The evidence points to clear winners for multi-modal data, high dimensionality, and constrained environments.

The scikit-learn team's own comparison of five detectors concludes that Isolation Forest and Local Outlier Factor perform reasonably well for multi-modal datasets — data with multiple clusters or "normal" behaviors, such as transactions from different customer segments. The same documentation notes LOF's local-density approach gives it an edge when the two modes have different densities.

The One-Class SVM caveat deserves attention. scikit-learn warns it is "known to be sensitive to outliers and thus does not perform very well for outlier detection" — a meaningful distinction, since it works better for novelty detection on clean training data than for contaminated datasets. This nuance matters: an algorithm that looks fine conceptually can fail quietly on real-world data.

Feature reduction is the other proven lever. A peer-reviewed manufacturing study found that LOF and Isolation Forest, combined with Autoencoder-based feature reduction, achieved an F1-score exceeding 84%, with precision close to 99% and recall at 74%. Compressing high-dimensional sensor data before detection measurably outperformed running the same detectors raw.

When each approach earns its place:

• Multi-modal data: Isolation Forest or LOF, per scikit-learn's guidance.
• High-dimensional data: Add Autoencoder feature reduction before density- or tree-based detection.
• Compute- or memory-constrained environments: Statistical techniques remain relevant, as market research notes for embedded controllers where model size is limited.
• Contaminated training data: Avoid One-Class SVM for outlier detection.

That last point deserves emphasis: the constraint isn't detection quality but deployment reality. Statistical methods don't win on sophistication — they win when the hardware can't support anything heavier.

If you're assembling this kind of pipeline, agent skills can automate the surrounding workflow — data prep, alerting, and model monitoring. SkillzBench is building a free directory and MCP connector to help you browse and test those skills, with benchmarking to show which ones actually deliver lift.

How to Choose and Benchmark on Your Own Data

The gap between a published benchmark and a working deployment is where most anomaly detection projects succeed or fail. The evidence points to a clear path: match the learning paradigm to your operational challenge, prepare your features deliberately, and validate everything on your own data.

Start with the paradigm. IBM frames the decision simply: the choice among supervised, unsupervised, and semi-supervised learning "will depend on the type of data being collected and the operational challenge being solved." Supervised methods excel at catching known outliers but cannot discover unknown anomalies; unsupervised methods find the unknown but may mislabel results; semi-supervised approaches, where labeled and unlabeled data coexist, typically sharpen predictions.

Then pick your detectors. The most rigorous comparison to date — a NeurIPS 2024 study evaluating 33 unsupervised algorithms across 52 real-world datasets — concluded that a two-algorithm toolbox suffices: Extended Isolation Forest for global anomalies, k-nearest neighbors for local ones. For multi-modal data, the scikit-learn documentation favors Isolation Forest and Local Outlier Factor, while warning that One-Class SVM "is known to be sensitive to outliers."

Before running tree- or density-based detectors, compress your feature space. A peer-reviewed manufacturing study found that LOF and Isolation Forest combined with autoencoder-based feature reduction achieved F1-scores above 84%, precision near 99%, and recall of 74%.

Benchmark on your own data, not toy datasets. The scikit-learn authors explicitly caution that intuition from simple examples "might not apply to very high dimensional data." The upside of getting it right is substantial:

• Google Vertex AI reached 94% precision on benchmark datasets.
• JPMorgan Chase cut false positives by 34% after deployment.
• Cisco reported a 62% reduction in mean time to remediation with integrated AIOps workflows.

But gains erode without maintenance. Analysts identify model drift (a -1.6% market impact), the skills shortage (-2.3% to -2.9%), and false positives paired with explainability gaps (-2.1%) as the restraints that quietly undo results. Data scientists must monitor unsupervised models, because assumptions about input data can cause incorrect anomaly labels.

Agent skills can automate parts of this workflow — data preparation, alerting, and model monitoring. SkillzBench is building a free directory and benchmarking platform that tests each skill in a sandbox and publishes its measured lift, so you can see which ones actually help before wiring them into your pipeline.

Where Agent Skills Fit: Automating the Benchmarking and Monitoring Workflow

Choosing the right algorithm is only half the battle — keeping an anomaly detection pipeline running well takes ongoing data prep, tuning, and monitoring that most teams underestimate. Model drift alone carries a -1.6% CAGR impact on the market, and industry research identifies the skills shortage (-2.3%) as an even bigger drag. That is where AI agents are starting to fill the gap.

Agent skills — instruction packages that extend coding agents like Claude Code, Codex, Cursor, and Gemini CLI — can automate the repetitive parts of the workflow. Instead of a data scientist hand-cleaning every dataset, an agent can handle the pipeline end to end.

• Data preparation — cleaning, normalizing, and applying feature reduction, which one peer-reviewed manufacturing study showed can lift detector performance to F1 scores above 84%
• Alerting and triage — routing flagged anomalies to the right team, echoing the AIOps workflows behind Cisco's reported 62% reduction in mean time to remediation
• Model monitoring — watching for drift as data patterns evolve, the exact failure mode IBM warns about when unsupervised models mislabel anomalies in changing environments

The catch: not every skill actually helps. Published research has found that roughly 26% of agent skills carry at least one vulnerability, and quality varies wildly. Before wiring a skill into a production pipeline, you want evidence it works — which is the problem SkillzBench is built to solve.

SkillzBench is a free, independent directory of agent skills that verifies, security-scans, and benchmarks every skill in a sandbox, testing each one with the same model, with and without the skill, and publishing the resulting Lift in percentage points. You can browse and test skills for free in the directory, or connect any agent via the free MCP connector and toggle only the skills you choose.

Everything — the directory, the MCP connector, the benchmarks, and the alerts — is free, and money never touches scores. If anomaly detection is on your roadmap, letting benchmarked agent skills handle the plumbing is a sensible way to go further.