Our Methodology

We don't use black-box "AI". We use deterministic statistical modeling. Here is exactly how our engine works.

1. Baseline Generation (ARIMA)

To detect an anomaly, you must first define "normal". We ingest up to 90 days of historical data and apply an AutoRegressive Integrated Moving Average (ARIMA) model. This accounts for:

Trend: General upward or downward trajectory of the metric.
Seasonality: Day-of-week patterns (e.g., lower weekend B2B traffic).

This generates a predicted expected value for any given hour, along with a confidence interval.

2. Anomaly Detection (Z-Score & IQR)

When a new data point arrives, we calculate its distance from the predicted baseline. We trigger an anomaly flag if the data point falls outside the 99% confidence interval (roughly equivalent to a Z-score < -2.5 or > 2.5).

For highly volatile metrics with non-normal distributions, we fall back to Interquartile Range (IQR) outlier detection to prevent false positives.

3. Root Cause Isolation (Decision Trees)

Once a global anomaly is flagged, the isolation engine spins up. It calculates the anomaly score for every available sub-dimension (e.g., Browser=Chrome, Campaign=Q3_Launch). We use a modified ID3 decision tree algorithm to find the specific branch (combination of dimensions) that carries the highest information gain relative to the drop.

The result is a deterministic statement: "The drop is isolated to node X," which we output in the Slack alert.