I am attempting to find anomalies in accounting data (similar to this study: https://arxiv.org/pdf/1709.05254.pdf). I don't have any labeled data, so this attempt needs to be unsupervised. I am having trouble getting off the ground, because I have no baseline on what normal accounting data (i.e. journal entries) should look like.
I am primarily looking for local anomalies - anomalies that are dependent on the features (i.e. journal entry amount, GL account, number of lines, etc.) occurring in a specific combination that is different from the rest of the data.
I have thought of (and deployed some) clustering methods, but I have no way to know whether the clusters mean anything, because I don't know what normal behavior looks like. How do I determine the baseline of a new dataset without knowing what an anomaly looks like? Can anyone point me in the direction of an anomaly detection method that is unsupervised and works on existing data?