Skip to content

Anomaly Detection Model

Detection model — instantiates Predictive Residual Processing

Holds a model of what normal looks like and screens the live stream against it, raising a hand only when an observation departs far enough to be worth a second look.

When most of a stream is predictable and gets summarized away, the events worth surfacing are the ones that don't fit. Anomaly Detection Model maintains a representation of expected patterns and scores each incoming observation for how far it departs, flagging the outliers that warrant investigation or a re-estimate of state. Its unit of work is a single observation: is this point surprising given what normal looks like? That is what distinguishes it from a drift monitor (which judges the model's health over time) and from a residual structure test (which judges whether the leftovers are patterned) — it operates per-observation on the live actual stream, and its purpose is to pull the rare, informative departure out from under the suppression layer before it's buried.

Example

A security team models the normal connection pattern of a fleet of servers — usual ports, peers, volumes, times of day. Routine traffic is otherwise rolled up as "as expected." At 3 a.m. one host opens an outbound connection to an unfamiliar address and pushes data at ≈40× its normal volume. Against the expected-behavior model this observation scores far outside the envelope, and it's flagged to the SOC for investigation. Nothing about the model changed — this isn't drift — but this single observation is a departure worth a human's eyes, and the detector's whole value is catching it in a stream engineered to stay quiet.

How it works

  • Model expected behavior — a statistical baseline, learned density, or reconstruction model of "normal," conditioned on context (time-of-day, segment).
  • Score the actual observation — distance, likelihood, or reconstruction error against that expectation.
  • Threshold to flag — depart far enough and the point is surfaced.
  • Route the flag — to investigation or to a re-estimation of state; the point that scored "surprising" is a candidate for either a real event or a hint the expected model is wrong.

Tuning parameters

  • Expected-model type — parametric baseline vs. learned density vs. autoencoder; richer models catch subtler anomalies but are harder to trust.
  • Departure score and threshold — the sensitivity dial, trading catch-rate against false alarms.
  • Contextual vs. global — conditioning "normal" on time and segment catches context-specific anomalies a global baseline misses.
  • Adaptation rate — how fast the "normal" model absorbs new data; too fast and a slow attack gets learned as normal.
  • Label feedback — whether confirmed flags refine the model.

When it helps, and when it misleads

Its strength is surfacing the rare, informative event the suppression layer would otherwise discard as unremarkable.

Its failure modes are governed by the base rate: when true events are rare, even an accurate detector produces mostly false positives, and the flood breeds alarm fatigue until real flags are ignored.[1] An adaptive baseline can also be poisoned — fed abnormal data slowly enough that it comes to accept the abnormal as normal. The classic misuse is cranking sensitivity to "catch everything," which drowns the true signal in noise and trains everyone to dismiss the alarm. The discipline: tune to base rates, weight flags by consequence, and wire them to a real triage path rather than a firehose.

How it implements the components

  • expected_behavior — it maintains the model of normal/expected patterns that each observation is judged against.
  • actual_behavior — it ingests and scores the live observed stream, point by point, for departure.

It does not quantify the model's own posterior uncertainty (that's Bayesian Model Update), set the escalation thresholds a flag is graded against (that's Confidence Threshold Table), or route a validated flag to a defined action (that's Surprise-to-Action Bridge).

Notes

A flagged point is genuinely ambiguous: it may be a real rare event or the first sign the expected-behavior model itself is wrong. The detector alone cannot tell which — resolving that is the job of Residual Comparison Test (is the miss structural?) and Prediction Error Review (what should change?).

References

[1] The base-rate fallacy explains why a detector with excellent per-observation accuracy still yields mostly false alarms when true anomalies are rare; unmanaged, this produces alarm fatigue. Weighting by consequence and calibrating to the base rate are the standard correctives. ↩