Anomaly detection is often presented as a natural application of machine learning technology. Yes, it has its uses, but it’s not a magic solution. For example, we observe millions of single-request hosts in our daily traffic. (You probably have a ton, too.) By definition, each one is an anomaly. So what do you do with a million of them? Fortunately, there are some ideas that work.