title: Recommended anomaly detection technique for simple, one-dimensional scenario?
body: <p>I have a scenario where I have several thousand instances of data. The data itself is represented as a single integer value. I want to be able to detect when an instance is an extreme outlier. </p>
  
  <p>For example, with the following example data:</p>
  
  <pre><code>a = 10
  b = 14
  c = 25
  d = 467
  e = 12
  </code></pre>
  
  <p><code>d</code> is clearly an anomaly, and I would want to perform a specific action based on this.</p>
  
  <p>I was tempted to just try an use my knowledge of the particular domain to detect anomalies. For instance, figure out a distance from the mean value that is useful, and check for that, based on heuristics. However, I think it's probably better if I investigate more general, robust anomaly detection techniques, which have some theory behind them.</p>
  
  <p>Since my working knowledge of mathematics is limited, I'm hoping to find a technique which is simple, such as using standard deviation. Hopefully the single-dimensioned nature of the data will make this quite a common problem, but if more information for the scenario is required please leave a comment and I will give more info.</p>
  
  <hr>
  
  <p>Edit: thought I'd add more information about the data and what I've tried in case it makes one answer more correct than another.</p>
  
  <p>The values are all positive and non-zero. I expect that the values will form a normal distribution. This expectation is based on an intuition of the domain rather than through analysis, if this is not a bad thing to assume, please let me know. In terms of clustering, unless there's also standard algorithms to choose a k-value, I would find it hard to provide this value to a k-Means algorithm.</p>
  
  <p>The action I want to take for an outlier/anomaly is to present it to the user, and recommend that the data point is basically removed from the data set (I won't get in to how they would do that, but it makes sense for my domain), thus it will not be used as input to another function.</p>
  
  <p>So far I have tried three-sigma, and the IQR outlier test on my limited data set. IQR flags values which are not extreme enough, three-sigma points out instances which better fit with my intuition of the domain.</p>
  
  <hr>
  
  <p>Information on algorithms, techniques or links to resources to learn about this specific scenario are valid and welcome answers.</p>
  
  <p>What is a recommended anomaly detection technique for simple, one-dimensional data?</p>