# McCatch: Scalable Microcluster Detection in Dimensional and Nondimensional Datasets

arXiv: https://arxiv.org/abs/2403.08027 · HTML: https://mlsanity.com/paper/2403.08027/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 53 references that are in the map.
- First posted on arXiv 12 Mar 2024.

## Builds on (most cited first, 5 of 5)

- [UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction](https://mlsanity.com/paper/1802.03426/) (2018)
- [Data-Efficient and Interpretable Tabular Anomaly Detection](https://mlsanity.com/paper/2203.02034/) (2022)
- [gen2Out: Detecting and Ranking Generalized Anomalies](https://mlsanity.com/paper/2109.02704/) (2021)
- [Sparx: Distributed Outlier Detection at Scale](https://mlsanity.com/paper/2206.01281/) (2022)
- [D.MCA: Outlier Detection with Explicit Micro-Cluster Assignments](https://mlsanity.com/paper/2210.08212/) (2022)

## Built on by (most cited first, 1 of 1)

- [FRAUDGUESS: Spotting and Explaining New Types of Fraud in Million-Scale Financial Data](https://mlsanity.com/paper/2509.15493/) (2025)

## Abstract (arXiv)

How could we have an outlier detector that works even with nondimensional data, and ranks together both singleton microclusters ('one-off' outliers) and nonsingleton microclusters by their anomaly scores? How to obtain scores that are principled in one scalable and 'hands-off' manner? Microclusters of outliers indicate coalition or repetition in fraud activities, etc.; their identification is thus highly desirable. This paper presents McCatch: a new algorithm that detects microclusters by leveraging our proposed 'Oracle' plot (1NN Distance versus Group 1NN Distance). We study 31 real and synthetic datasets with up to 1M data elements to show that McCatch is the only method that answers both of the questions above; and, it outperforms 11 other methods, especially when the data has nonsingleton microclusters or is nondimensional. We also showcase McCatch's ability to detect meaningful microclusters in graphs, fingerprints, logs of network connections, text data, and satellite imagery. For example, it found a 30-elements microcluster of confirmed 'Denial of Service' attacks in the network logs, taking only ~3 minutes for 222K data elements on a stock desktop.