Anomaly Detection
An unusual value is not yet an anomaly. Anomaly detection compares an observation with a declared expectation, tests whether the deviation survives uncertainty and determines whether it represents noise, error, event or structural change.
An anomaly violates an expectationinside a declared reference system.
The claim is relational: an observation is unusual relative to a baseline, peer group, context and uncertainty model—not unusual in isolation.
An anomaly is an observation or sequence whose distance from a valid expected state is too large, structured or persistent to dismiss without investigation.
Detection is triage, not explanation. A flag says “inspect this deviation”; it does not establish cause, harm, manipulation or future recurrence.
Build expectation first.Then measure surprise.
A credible baseline combines the right time window, comparable peers, relevant context and measurement continuity.
Historical expectation
Compare the unit with its own aligned prior states after trend and seasonality are separated.
RISK / STALE REGIMEComparable units
Compare structurally similar pages, queries, assets or markets observed under the same conditions.
RISK / FALSE PEERSConditional expectation
Ask what is normal for this device, market, intent, page class, cycle position or event state.
RISK / HIDDEN CONTEXTMeasurement continuity
Verify that collection, definitions, coverage and transformations did not change at the flagged point.
RISK / ARTIFACTDifferent shapes requiredifferent investigations.
Classification determines the comparison window, evidence needed and whether one point or the generating system is under review.
Point anomaly
One observation is distant from the expected distribution.
TEST / VALUE DISTANCEContextual anomaly
The value is ordinary globally but unexpected for its time, class or condition.
TEST / CONDITIONAL BASELINECollective anomaly
Individual values appear normal while their sequence or joint pattern is unexpected.
TEST / WINDOW STRUCTURERegime anomaly
A sustained change in level, slope, variance or relationships indicates a new state.
TEST / CHANGE POINTDistance attracts attention.Persistence earns priority.
Adjust the illustrative signal. Severity increases with standardized deviation, confidence and repeated occurrence.
HIGH DEVIATION / LIMITED RECURRENCE
The observation is sufficiently distant to verify immediately, but the short persistence window does not support a structural-change claim.
Severity and confidenceare separate decisions.
A dramatic deviation with weak evidence may deserve verification, while a moderate but repeated deviation can justify escalation.
Log or watch
Retain the record and seek recurrence.
ACTION / MONITORInspect and prioritize
Validate context, source and peer comparison.
ACTION / INVESTIGATEVerify immediately
Repeat measurement before interpreting impact.
ACTION / ESCALATETest structural change
Determine whether the expected state has shifted.
ACTION / NEW BASELINE TESTThree systems.Three bounded anomalies.
Each example names the unit, expectation, deviation, verification and strongest permissible finding.
Sudden collapse in indexed-page coverage
One directory falls from its stable discovery band while comparable directories remain unchanged.
Before escalating,try to explain the surprise.
An anomaly becomes decision-relevant only after measurement errors, expected cycles, composition changes and multiple-testing noise are challenged.
Repeat measurement
Confirm that the deviation survives another observation.
TEST / REPRODUCIBILITYSource integrity
Check missing records, altered coverage and definition changes.
TEST / ARTIFACTSeason and event
Compare equivalent cycle positions and known event windows.
TEST / EXPECTED CONTEXTPeer recurrence
Determine whether similar units moved together.
TEST / LOCAL OR SYSTEMICComposition
Verify that the measured population did not silently change.
TEST / DENOMINATORMultiple tests
Account for false alarms created by scanning many measures.
TEST / ERROR CONTROLPersistence
Separate a transient point from a repeated sequence.
TEST / WINDOW LENGTHImpact boundary
Connect deviation magnitude to a real decision threshold.
TEST / MATERIALITYReport the deviation.Do not invent the cause.
The finding must expose the expected range, observed value, baseline, uncertainty, verification state, class and next test.
For [unit and context], value X was [distance] outside [expected range]; it survived [verification] and warrants [next action], without yet establishing [cause].
One root.Twelve analytical nodes.
Anomaly Detection is the eighth node: it locates deviations from a declared expectation and routes them toward verification, explanation or monitoring.