Anomaly Formula: Z-Score

What it does:

This formula identifies how many standard deviations the latest value is away from the historical mean. If the absolute Z-Score exceeds your defined threshold, and the direction matches your chosen change type, an alert is triggered.

When to use it:

Use this formula to catch outliers based on statistical deviation. It’s useful when your usage patterns are noisy but still follow a consistent range.

Mathematical Formula:

Let:

• L = Latest Value
• H = Historical Values (excluding L)
• μ = Mean of H
• σ = Standard Deviation of H
• Z = Z-Score
• T = Threshold (number of standard deviations)
• Z = (L − μ) / σ

Anomaly Condition:

|Z| ≥ T

Direction Validation (based on Change Type):

• If Change Type = Increased, condition is valid only if  L > μ
• If Change Type = Decreased, condition is valid only if  L < μ
• If Change Type = Any, direction check is not required

Outcomes:

❌ Anomaly Detected → |Z| ≥ T and direction matches Change Type
☑️ Skipped → |Z| ≥ T but direction does not match Change Type
✅ Normal → |Z| < T

Examples:

Example 1

Change Type: Increased
Threshold: 2
History: 100, 120, 130, 110

• If Latest Value = 125
  Result: Normal ✅
  Explanation:
    μ = 115, σ ≈ 12.91
    Z = (125 − 115) / 12.91 ≈ 0.77
    |Z| = 0.77 < Threshold (2)

• If Latest Value = 150
  Result: Anomaly Detected ❌
  Explanation:
    μ = 115, σ ≈ 12.91
    Z = (150 − 115) / 12.91 ≈ 2.71
    |Z| = 2.71 ≥ Threshold (2)

• If Latest Value = 80
  Result: Skipped ☑️
  Explanation:
    μ = 115, σ ≈ 12.91
    Z = (80 − 115) / 12.91 ≈ -2.71
    |Z| = 2.71 ≥ Threshold (2)
    But direction = Decrease → does not match “Increased”

Example 2
Change Type: Decreased
Threshold: 1.5
History: 200, 220, 210, 230

• If Latest Value = 215
  Result: Normal ✅
  Explanation:
    μ = 215, σ ≈ 12.91
    Z = (215 − 215) / 12.91 = 0
    |Z| = 0 < Threshold (1.5)

• If Latest Value = 180
  Result: Anomaly Detected ❌
  Explanation:
    μ = 215, σ ≈ 12.91
    Z = (180 − 215) / 12.91 ≈ -2.71
    |Z| = 2.71 ≥ Threshold (1.5)

• If Latest Value = 250
  Result: Skipped ☑️
  Explanation:
    μ = 215, σ ≈ 12.91
    Z = (250 − 215) / 12.91 ≈ 2.71
    |Z| = 2.71 ≥ Threshold (1.5)
    But direction = Increase → does not match “Decreased”

Example 3
Change Type: Any
Threshold: 2
History: 50, 60, 70, 80

• If Latest Value = 75
  Result: Normal ✅
  Explanation:
    μ = 65, σ ≈ 12.91
    Z = (75 − 65) / 12.91 ≈ 0.77
    |Z| = 0.77 < Threshold (2)

• If Latest Value = 30
  Result: Anomaly Detected ❌
  Explanation:
    μ = 65, σ ≈ 12.91
    Z = (30 − 65) / 12.91 ≈ -2.71
    |Z| = 2.71 ≥ Threshold (2)