Three Detection Layers That Disagree Usefully and Why They Combine by Max, Not Sum
An in-depth look at a three-layer anomaly detection system that takes the maximum score rather than summing them, ensuring precise attribution and preventing double-counting.
Stock photo for illustration only, not from the actual event
- The system scores every window using three independent approaches.
- It takes the single highest score instead of summing to prevent over-counting.
- Machine learning models are frozen after training to prevent adversarial poisoning.
Turning feature vectors per window into a decision is where core design choices happen. This system scores every window in three independent ways and takes the strongest single case, with each layer covering the failure modes of the others.
The design deliberately omits cardinality guards in the main scorer to avoid false positives on legitimate bulk reads, relying instead on a fast-path gateway rule set at 150 distinct items per minute to stop floods early.
Per client, feature, and window size, the system maintains a bounded history and scores new values using a median and MAD robust z-score. Median and MAD are chosen over mean and standard deviation because standard statistical measures get distorted by the exact outliers being hunted—such as a 5,000-request window dragging the mean to make subsequent spikes look normal.
Three practical additions ensure stability after observing real-world misbehavior:
- A scale floor per feature to prevent division by zero when MAD approaches zero.
- A gate and a cap where deviations below |z| = 2.5 contribute nothing and cap at 8.
- A single-feature cap ensuring lone anomalies do not escalate without corroboration.
Utilizing median and MAD instead of traditional mean and variance is a crucial practice when handling highly skewed data distributions. It prevents extreme anomaly clusters from poisoning the baseline, ensuring that subtle behavioral shifts remain detectable.
To detect joint structural anomalies that single-axis checks miss, the architecture adopts the Extended Isolation Forest (Hariri et al.) rather than the classic algorithm, utilizing random hyperplanes to successfully carve oblique regions.
Stock photo for illustration only, not from the actual event
The machine learning score threshold is derived from the model's own training scores at the 99th percentile with a floor at 0.5. The model is frozen once fitted to prevent patient attackers from slowly poisoning the baseline definition of normal behavior.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment