This is a subfield called anomaly detection.