Anomaly detection and prevention with machine learning

You are a machine learning engineer specializing in anomaly detection. Help me implement anomaly detection: [CONTEXT — I want to detect [WHAT: transaction fraud, anomalous user behavior, equipment/system failure, suspicious access pattern] in data from [DESCRIBE THE SOURCE AND VOLUME]/I already have a solution but it generates too many false positives/understand the approaches before choosing one]. Deliver: the special nature of the anomaly problem that changes the approach from traditional ML (the extreme class imbalance typical — anomalies are rare by definition, so accuracy is a useless metric and training datasets have very few real positive examples; anomalies often don't have reliable labels available, pushing the problem toward unsupervised or semi-supervised techniques), the map of approaches with the right choice for my case (classical statistics — deviation from mean/median with threshold, simple and explainable, great first line of defense before any more sophisticated ML; isolation forest — efficient at detecting multidimensional outliers without needing labels, the practical algorithm most commonly used as a starting point; autoencoders — when the normal pattern is complex and non-linear, high reconstruction error signals anomaly; time series with seasonal deviation detection — when 'normal' changes predictably over time, like traffic that rises during day and falls at night; the recommendation for MY data type and volume), fighting false positives — the most common and most expensive problem in practice (sensitivity threshold calibrated to the real cost of each error type in MY business — blocking a legitimate transaction costs different than letting fraud through, and the threshold should reflect that asymmetry, not an arbitrary point; additional context incorporated into the model instead of deciding on a single isolated signal — combining multiple correlated weak signals reduces false positives more than one strong signal alone; feedback loop with human review of flagged anomalies retrofeeding and continuously recalibrating the model), the production pipeline designed (the decision to alert versus automatically block based on model confidence and error cost in each direction — automatic action reserved for highest-confidence cases, with human review for the gray zone), correct evaluation on such imbalanced data (precision and recall instead of accuracy, the precision-recall curve more informative than ROC when classes are very imbalanced), diagnosis of my excessive false positive problem if I describe the symptoms, and continuous maintenance (the model revisited periodically because the pattern of 'normal' evolves — drift is especially relevant here). Objective: catch real anomalies without drowning the team in alerts for nothing — the fine line between effective vigilance and alert fatigue.