About anomaly detection

This section describes anomaly detection. For a complete list of topics on detecting anomalies, finding and removing outliers, detecting patterns, and time series forecasting see About advanced statistics, in this manual.

Overview of anomaly detection

An anomaly is a deviation from the expected behavior of the system. An anomaly can be:

• A single event
• A sequence of events
• A sequence of transactions
• Complex patterns

Examples of common use cases for anomaly detection include:

Industry	Use case example
IT	Identifying a distributed denial of service (DDoS) attack from IP address ranges.
Marketing	Rare but high-value customer purchase patterns.
Product	Rare or previously unknown method of using a product that yields better results or yields results more efficiently than known methods.
Security	Faster-than-human transactions. Detecting when transactions are being performed much more quickly by one user than by others. This could indicate a bot or an attempt to probe security measures.

Effective anomaly detection

To perform effective anomaly detection, put all of the data in one place. If you do not have your machine and business data in the same place, you cannot perform a comprehensive analysis.

Begin tracking IT and business performance metrics. Additionally, create a baseline data image which shows the current state of your system.

See also

• About advanced statistics
• Finding and removing outliers
• Detecting anomalies
• Detecting patterns