Quick answer
Anomaly detection is the process of finding observations, such as a day of traffic or a single transaction, that differ so much from the expected pattern that they are unlikely to be normal variation and are worth investigating.
Formula: z = (observed − expected) / standard deviation of the baseline
What is anomaly detection?
Anomaly detection finds data points that differ so much from what you expected that they are unlikely to be normal variation. For a website or product, that might be a sudden drop in sign-ups, a spike in errors, or a traffic surge from one referrer.
The word that matters is expected. An anomaly is always relative to a baseline, so most of the work is in choosing a good one.
Three types of anomaly
| Type | What it is | Example |
|---|---|---|
| Point | One value is extreme | Today's checkouts are 40% below normal |
| Contextual | Normal in general, unusual for the context | 2,000 visitors is fine on Monday, odd on a Sunday |
| Collective | Each value looks fine, the sequence does not | Conversion slips 2% every day for a week |
Methods, from simple to advanced
- Fixed threshold. "Alert if errors > 50 per hour." Easy, but ignores cycles.
- Percent change. "Alert if visitors fall 30% versus last period." Simple; noisy on small numbers.
- Baseline band. Compare with the average of recent same weekdays and allow a band (±10%, ±30%).
- Statistical (z-score). Measure how many standard deviations today sits from the baseline.
- Models. Seasonal decomposition, forecasting models or machine-learning methods such as isolation forests, for many metrics at once.
Start with 3 or 4. They respect weekly cycles and are easy to explain when someone asks why the alert fired.
A worked example
Visitors on the last four Mondays (sample numbers): 1,180, 1,240, 1,210, 1,170.
- Baseline mean = 1,200
- Standard deviation = 31.6
- Today (Monday) = 1,020
- z = (1,020 − 1,200) / 31.6 = −5.7
A value more than 3 standard deviations from the baseline is very unlikely to be noise, so this is worth checking. With only four points the standard deviation is itself uncertain; a percent band (here −15%) is a useful second check.
When an alert fires: triage
- Is the data complete? A collection gap, a blocked script or a late batch looks exactly like a drop.
- Is it everywhere or in one segment? Split by device, country, source and page.
- Did something change? Releases, campaigns, holidays, outages. Check the annotations.
- Is it real but expected? A campaign spike is an anomaly you wanted.
- Record the cause so the next person does not investigate the same thing.
Anomaly detection in TapCub
TapCub monitors check a built-in measure (pageviews, visitors, sessions, bounce rate, average duration, errors, error rate) or a saved metric on an hour, day, week or month grain. The conditions map onto the methods above:
| Monitor condition | Method |
|---|---|
| Fixed threshold | Fixed threshold |
| Period change | Percent change vs the previous period |
| Forecast band | Mean of the last 7 days and the same weekday; strict about ±10%, medium ±30%, loose ±50%; needs 14 days of history |
| Anomaly | Mean and spread of the same weekday over 28 days; confidence 70–99; needs about 30 days by default |
| Collection gap | Minutes with no data, to catch broken tracking |
A dry run shows how many times the rule would have fired in the last 30 days, which is the quickest way to tune sensitivity. Repeat notifications are held back for about 60 minutes by default. See also monitor.
See also
Was this explanation clear?
We use your answers to fix and expand this page.
Couldn’t send. Please try again in a minute.
Thanks for the feedback. We’ll use it to improve this page.You’ve already sent feedback on this page. Thanks.
Product Experience Specialist
Writes about product experience, practical workflows, and growth, turning complex processes into clear steps for everyday decisions.