Anomaly Formula: Regression Residual

What it does:

This rule fits a simple linear regression model to your historical usage data (excluding the latest value) and checks how far the latest value deviates from the predicted trend line. If the residual (difference between actual and predicted value) exceeds your defined threshold, and the direction matches your selected change type, it’s flagged as an anomaly.

When to use it:

Use this when you want to detect values that break away from a predicted trend. This is ideal for identifying trend-breaking behavior that’s not captured by static thresholds.

Mathematical Formula:

Let:

• H = Historical Values (excluding L)
• L = Latest Value
• T = Threshold
• Ŷ = Predicted Value from linear regression model based on H
• R = Residual = |L − Ŷ|

Anomaly Condition
R = |L − Ŷ| ≥ T

Direction Validation (based on Change Type):

• If Change Type = Increased, condition is valid only if  L > Ŷ
• If Change Type = Decreased, condition is valid only if  L < Ŷ
• If Change Type = Any, direction check is not required

Outcomes:

Anomaly Detected  → R ≥ T and direction matches Change Type
Skipped → R ≥ T, but direction does not match Change Type
Normal → R < T

Examples:

Example 1

Change Type: Increased
Threshold: 10
History: 100, 110, 120, 130, 140

• If Latest Value = 145
  Result: Normal
  Explanation:
    Ŷ = 150 (predicted based on linear trend)
    Residual = |145 − 150| = 5
    Residual (5) < Threshold (10)

• If Latest Value = 170
  Result: Anomaly Detected
  Explanation:
    Ŷ = 150 → Residual = |170 − 150| = 20
    Residual (20) ≥ Threshold (10)

• If Latest Value = 130
  Result: Skipped
  Explanation:
    Ŷ = 150 → Residual = |130 − 150| = 20
    Residual (20) ≥ Threshold (10)
    But direction = Decrease → does not match “Increased”

Example 2
Change Type: Decreased
Threshold: 8
History: 200, 190, 180, 170, 160

• If Latest Value = 148
  Result: Normal
  Explanation:
    Ŷ = 150 → Residual = |148 − 150| = 2
    Residual (2) < Threshold (8)

• If Latest Value = 135
  Result: Anomaly Detected
  Explanation:
    Ŷ = 150 → Residual = |135 − 150| = 15
    Residual (15) ≥ Threshold (8)

• If Latest Value = 162
  Result: Skipped
  Explanation:
    Ŷ = 150 → Residual = |162 − 150| = 12
    Residual (12) ≥ Threshold (8)
    But direction = Increase → does not match “Decreased”

Example 3
Change Type: Any
Threshold: 12
History: 10, 20, 30, 40, 50

• If Latest Value = 45
  Result: Normal
  Explanation:
    Ŷ = 60 → Residual = |55 − 60| = 5
    Residual (5) < Threshold (12)

• If Latest Value = 75
  Result: Anomaly Detected
  Explanation:
    Ŷ = 60 → Residual = |75 − 60| = 15
    Residual (15) ≥ Threshold (12)