Apple interview question

How to go about developing a baseline for anomaly detection