Anomaly Formula: Regression Residual

What it does:

This rule fits a simple linear regression model to your historical usage data (excluding the latest value) and checks how far the latest value deviates from the predicted trend line. If the residual (difference between actual and predicted value) exceeds your defined threshold, and the direction matches your selected change type, it’s flagged as an anomaly.

When to use it:

Use this when you want to detect values that break away from a predicted trend. This is ideal for identifying trend-breaking behavior that’s not captured by static thresholds.

Mathematical Formula:

Let:

• H = Historical Values (excluding L)
• L = Latest Value
• T = Threshold
• Ŷ = Predicted Value from linear regression model based on H
• R = Residual = |L − Ŷ|

Anomaly Condition
R = |L − Ŷ| ≥ T

Direction Validation (based on Change Type):

• If Change Type = Increased, condition is valid only if  L > Ŷ
• If Change Type = Decreased, condition is valid only if  L < Ŷ
• If Change Type = Any, direction check is not required

Outcomes:

❌ Anomaly Detected  → R ≥ T and direction matches Change Type
☑️ Skipped → R ≥ T, but direction does not match Change Type
✅ Normal → R < T

Examples:

Example 1

Change Type: Increased
Threshold: 10
History: 100, 110, 120, 130, 140

• If Latest Value = 145
  Result: Normal ✅
  Explanation:
    Ŷ = 150 (predicted based on linear trend)
    Residual = |145 − 150| = 5
    Residual (5) < Threshold (10)

• If Latest Value = 170
  Result: Anomaly Detected ❌
  Explanation:
    Ŷ = 150 → Residual = |170 − 150| = 20
    Residual (20) ≥ Threshold (10)

• If Latest Value = 130
  Result: Skipped ☑️
  Explanation:
    Ŷ = 150 → Residual = |130 − 150| = 20
    Residual (20) ≥ Threshold (10)
    But direction = Decrease → does not match “Increased”

Example 2
Change Type: Decreased
Threshold: 8
History: 200, 190, 180, 170, 160

• If Latest Value = 148
  Result: Normal ✅
  Explanation:
    Ŷ = 150 → Residual = |148 − 150| = 2
    Residual (2) < Threshold (8)

• If Latest Value = 135
  Result: Anomaly Detected ❌
  Explanation:
    Ŷ = 150 → Residual = |135 − 150| = 15
    Residual (15) ≥ Threshold (8)

• If Latest Value = 162
  Result: Skipped ☑️
  Explanation:
    Ŷ = 150 → Residual = |162 − 150| = 12
    Residual (12) ≥ Threshold (8)
    But direction = Increase → does not match “Decreased”

Example 3
Change Type: Any
Threshold: 12
History: 10, 20, 30, 40, 50

• If Latest Value = 45
  Result: Normal ✅
  Explanation:
    Ŷ = 60 → Residual = |55 − 60| = 5
    Residual (5) < Threshold (12)

• If Latest Value = 75
  Result: Anomaly Detected ❌
  Explanation:
    Ŷ = 60 → Residual = |75 − 60| = 15
    Residual (15) ≥ Threshold (12)