How do you evaluate anomaly detection?
medium- Usually severely imbalanced → don't use accuracy.
- Standard metrics: (1) ROC AUC (rank-based, threshold-free), (2) PR AUC (better under extreme imbalance), (3) precision@k and recall@k at operating threshold, (4) F1 for a chosen threshold.
- Cost-sensitive: business cost of false positive / false negative.
- Also: alert precision and MTTR (time to detect) in production ops contexts.