When a comprehensive training set is available, a supervised anomaly detection technique can typically outperform an unsupervised anomaly technique when performance is evaluated using measures such as the detection and false alarm rate. However, in some cases, such as fraud detection, new types of anomalies are always developing. Performance can be evaluated according to the detection and false alarm rates, because it is usually possible to determine upon investigation whether an object $($transaction$)$ is anomalous. Discuss the relative merits of supervised and unsupervised anomaly detection under such conditions.

Many statistical tests for outliers were developed in an environment in which a few hundred observations was a large data set. We explore the limitations of such approaches.

For a set of $1,000,000$ values, how likely are we to have outliers according to the test that says a value is an outlier if it is more than three standard deviations from the average? $($Assume a normal distribution.$)$

Does the approach that states an outlier is an object of unusually low probability need to be adjusted when dealing with large data sets? If so$,$ how?

Describe the potential time complexity of anomaly detection approaches based on the following approaches: model$-$based using clustering, proximity$-$based, and density. No knowledge of specific techniques is required. Rather, focus on the basic computational requirements of each approach, such as the time required to compute the density of each object.