About anomaly detection
This section describes anomaly detection. For a complete list of topics on detecting anomalies, finding and removing outliers, detecting patterns, and time series forecasting see About advanced statistics, in this manual.
Overview of anomaly detection
An anomaly is a deviation from the expected behavior of the system. An anomaly can be:
- A single event
- A sequence of events
- A sequence of transactions
- Complex patterns
Examples of common use cases for anomaly detection include:
| Industry | Use case example |
|---|---|
| IT | Identifying a distributed denial of service (DDoS) attack from IP address ranges. |
| Marketing | Rare but high-value customer purchase patterns. |
| Product | Rare or previously unknown method of using a product that yields better results or yields results more efficiently than known methods. |
| Security | Faster-than-human transactions. Detecting when transactions are being performed much more quickly by one user than by others. This could indicate a bot or an attempt to probe security measures. |
Effective anomaly detection
To perform effective anomaly detection, put all of the data in one place. If you do not have your machine and business data in the same place, you cannot perform a comprehensive analysis.
Begin tracking IT and business performance metrics. Additionally, create a baseline data image which shows the current state of your system.