Anomaly Formula: Trend Deviation

What it does:
This rule fits a linear regression line to your historical usage data (excluding the latest value) and computes how much the latest value deviates from that trend, as a fraction of the predicted value. If the absolute deviation exceeds your threshold, and the direction matches your Change Type, it’s flagged as an anomaly.

When to use it:

Use this to catch values that stray from an established upward or downward trend. This is ideal for spotting sudden shifts in usage patterns that break your normal trajectory.

Mathematical Formula:

Let:

• H = Historical Values (excluding L)
• L = Latest Value
• T = Threshold (fraction, e.g. 0.1 = 10%)
• Ŷ = Predicted Value from linear regression on H
• δ = (L − Ŷ) / Ŷ

Anomaly Condition:

|δ| ≥ T

Direction Validation (based on Change Type):

• If Change Type = Increased, valid only if δ > 0
• If Change Type = Decreased, valid only if δ < 0
• If Change Type = Any, direction check not required

Outcomes:

❌ Anomaly Detected → |δ| ≥ T and direction matches Change Type
☑️ Skipped → |δ| ≥ T but direction does not match Change Type
✅ Normal → |δ| < T

Examples:

Example 1

Change Type: Increased
Threshold: 0.10
History: 100, 120, 140, 160, 180

• If Latest Value = 190
  Result: Normal ✅
  Explanation:
    Ŷ ≈ 200 → δ = (190 − 200)/200 = −0.05 → |\δ| = 0.05 < 0.10

• If Latest Value = 230
  Result: Anomaly Detected ❌
  Explanation:
    Ŷ ≈ 200 → δ = (230 − 200)/200 = 0.15 → |\δ| = 0.15 ≥ 0.10 and δ > 0

• If Latest Value = 160
  Result: Skipped ☑️
  Explanation:
    Ŷ ≈ 200 → δ = (160 − 200)/200 = −0.20 → |\δ| = 0.20 ≥ 0.10 but δ < 0

Example 2
Change Type: Decreased
Threshold: 0.20
History: 300, 280, 260, 240, 220

• If Latest Value = 200
  Result: Normal ✅
  Explanation:
    Ŷ ≈ 200 → δ = (200 − 200)/200 = 0 → |\δ| = 0 < 0.20

• If Latest Value = 150
  Result: Anomaly Detected ❌
  Explanation:
    Ŷ ≈ 200 → δ = (150 − 200)/200 = −0.25 → |\δ| = 0.25 ≥ 0.20 and δ < 0

• If Latest Value = 260
  Result: Skipped ☑️
  Explanation:
    Ŷ ≈ 200 → δ = (260 − 200)/200 = 0.30 → |\δ| = 0.30 ≥ 0.20 but δ > 0

Example 3
Change Type: Any
Threshold: 0.15
History: 50, 60, 70, 80, 90

• If Latest Value = 95
  Result: Normal ✅
  Explanation:
    Ŷ ≈ 100 → δ = (95 − 100)/100 = −0.05 → |\δ| = 0.05 < 0.15

• If Latest Value = 115
  Result: Anomaly Detected ❌
  Explanation:
    Ŷ ≈ 100 → δ = (115 − 100)/100 = 0.15 → |\δ| = 0.15 ≥ 0.15