Unsupervised anomaly detection in the S&P 500 : a comparative approach

This thesis presents a comprehensive comparative analysis of the Analytic Isolation and Distance-based Anomaly (AIDA) algorithm against established unsupervised methods, Isolation Forest (iForest) and LOF, for detecting anomalies in S&P 500 daily market data. The research addresses critical gaps in anomaly detection literature by evaluating algorithm performance, interpretability, and practical applicability in financial markets. The study employs a multi-level analytical framework examining anomalies at index, individual constituent, and collective constituent levels using both overlapping and non-overlapping 3- day subsequences. Daily price and volume data from January 2023 to March 2025 were analyzed, with detected anomalies validated against financial news events using semiautomated cross-referencing. Key findings reveal that σ = 1.5 represents a universal optimal threshold across all algorithms, suggesting fundamental statistical properties in financial time series. AIDA achieved 80% precision with minimal FPs, demonstrating superior price sensitivity revealed through its Tempered Isolation-based eXplanation (TIX) framework. iForest exhibited the highest detection sensitivity, identifying 40% more anomalies while maintaining balanced multi-dimensional feature utilization. LOF achieved 88.9% precision with pronounced volume-centric detection capabilities. Cross-algorithm agreement remained limited at 15-20%, indicating complementary rather than redundant detection capabilities. Feature importance analysis revealed distinct algorithmic philosophies: AIDA prioritized price features, iForest maintained balanced feature distribution, and LOF concentrated on volume metrics while preserving multi-dimensional awareness. Propagation analysis showed that 60-70% of index anomalies affected 5-13 constituent stocks, suggesting predominantly sector-specific rather than market-wide phenomena. The research demonstrates that effective financial anomaly detection requires leveraging complementary algorithmic strengths rather than pursuing a single, superior method. These findings have significant implications for investors seeking enhanced risk management tools, regulators requiring robust surveillance systems, and researchers advancing anomaly detection methodologies. The study establishes a foundation for ensemble approaches that capitalize on algorithmic diversity to achieve comprehensive market surveillance capabilities.