A.3. How anomalies are judged
Z-Score, IQR, Isolation Forest, RCF, and the ensemble
This chapter covers what "different from normal" is judged by.
The four at a glance
| Method | Basis | Distribution assumed | What it catches well |
|---|---|---|---|
| Z-Score | Mean and standard deviation | Required (bell-shaped) | Values that clearly depart |
| IQR | Median and quartiles | Not required | Departing values in skewed data |
| Isolation Forest | How quickly a value ends up alone | Not required | Anomalies across several metrics at once |
| RCF | How much the structure changes when a point is added or removed | Not required | Departing values in continuously arriving data |
The default is Z-Score.
1. Z-Score
What it does
It counts how many standard deviations a value sits from the mean.
Z = (value − mean) ÷ standard deviation
What standard deviation is
A number expressing how spread out the values are around the mean.
The same "10 away from the mean" is a serious matter in A and an everyday occurrence in B. Because Z-Score measures against how spread out that metric usually is, it automatically applies a different yardstick to each metric.
The threshold
The default is |Z| > 3.
99.7% of normal data falls within ±3. Anything outside is taken as "different from normal".
In terms of response time
usual response time: mean 200 ms, standard deviation 20 ms
210 ms → Z = +0.5 normal
250 ms → Z = +2.5 borderline — worth a look
320 ms → Z = +6.0 anomalous
Limits
- It assumes a bell-shaped distribution. It fits less well for metrics with a long tail on one side, such as response time
- When there are many outliers, the mean itself moves towards them. Once badly departing values have pulled the mean up, those very values start to look normal
The second one catches people out in practice. Feed in a window covering a long incident and the incident becomes "normal".
2. IQR (interquartile range)
What it does
It sorts the values, divides them into four, and takes the range of the middle half as its basis.
Calculating the boundaries
lower = Q1 − 1.5 × IQR = 35 − 52.5 = −17.5
upper = Q3 + 1.5 × IQR = 70 + 52.5 = 122.5
Anything outside these is an outlier.
Why 1.5
It is the value chosen by the statistician John Tukey. About 99.3% of normal data falls inside it. It can be adjusted through the sensitivity setting.
How it differs from Z-Score
| Z-Score | IQR | |
|---|---|---|
| Basis | Mean and standard deviation | Median and quartiles |
| Effect of departing values | The basis itself moves | It barely moves |
| Distribution assumed | Bell shape required | None |
| Minimum data | 3 points | More |
The median barely moves however far a few values depart. That makes IQR the better choice for windows that already contain outliers, and for skewed metrics.
3. Isolation Forest
What it does
It splits the values at random, repeatedly, and counts how many splits it takes for each value to end up alone.
Ending up alone quickly makes it an outlier.
How it works
① build one tree repeatedly split the values in two at random points
② build a forest 100 such trees (a different random basis each time)
③ path length the average number of splits before each value is alone
④ score the sooner it is alone, the higher the score (0–1)
The reason for 100 trees is to avoid being at the mercy of one random outcome. A normal value can be split off early by bad luck, but averaging over 100 removes that effect.
Sensitivity and how much is flagged
| Sensitivity | Roughly what share is called anomalous | When to use it |
|---|---|---|
| 1.0 (high) | About 30% | You want to see everything suspicious |
| 3.0 (medium) | About 5% | Balanced |
| 5.0 (low) | About 1% | Only the clear-cut cases |
It decides in advance what share is anomalous and flags that much. Which means it flags something even on a window that is entirely normal, so being flagged does not by itself mean there is a problem.
How it differs from the other two
| Z-Score · IQR | Isolation Forest | |
|---|---|---|
| Approach | Statistical formula | Machine learning |
| Distribution assumed | Required for Z-Score | Not required |
| Several metrics at once | Difficult | Possible |
It catches cases that look normal one metric at a time but are anomalous together, such as "CPU is high and memory is high and response time is long."
4. RCF (Random Cut Forest)
It rests on the same idea as Isolation Forest but differs in three ways. Amazon published it in 2016.
| Isolation Forest | RCF | |
|---|---|---|
| Splitting axis | Chosen at random | Chooses widely spread axes more often |
| Score | The path length until a value is alone | How much the structure changes when a point is added or removed |
| Processing | All at once (batch) | As data arrives (streaming) |
Difference one — it splits the wide axis first
The more widely spread an axis is, the more information a split on it carries. That divides the data more meaningfully than choosing purely at random.
Difference two — it scores by structural change
If the shape of the tree changes a lot when a value is added, that value is unlike the existing ones. The same applies when one is removed.
Rather than "how many splits until it is alone", it looks at the effect on everything around it.
Difference three — it suits continuously arriving data
Adding and removing a single point is cheap, which suits metrics that keep arriving over time. It can hold a recent window while pushing older data out.
5. The ensemble — using several methods together
Why it is needed
Each method has its own blind spots.
| Situation | Method that misses it | Method that catches it |
|---|---|---|
| A skewed distribution | Z-Score | IQR |
| Outliers already mixed in | Z-Score | IQR · Isolation Forest |
| An anomaly across several metrics | Z-Score · IQR | Isolation Forest · RCF |
| A window that is entirely normal | Isolation Forest (flags something regardless) | Z-Score · IQR |
The last row matters. Because Isolation Forest flags by proportion, it produces something even when everything is normal. Used alone it becomes a false positive.
How the results are combined
| Mode | Verdict |
|---|---|
| Voting (default) | Anomalous only when at least a set number agree |
| Union | Anomalous if any one says so |
The default threshold is two thirds of the methods used (rounded up).
2 methods → 2 must agree
3 methods → 2 must agree
4 methods → 3 must agree
Anything flagged by only one method is not treated as an anomaly. Even what Isolation Forest flagged by proportion is excluded when Z-Score and IQR disagree.
Sensitivity and direction
Sensitivity
Adjustable between 1.0 and 5.0. The lower it is, the more is flagged.
The builder screen has no field for this. Ask for it in a free-form question if you need it.
"Look again, a bit more sensitively" "Cross-check it with several methods"
Direction
This decides which way a departure has to go to be flagged.
| Setting | What is flagged | Suitable metrics |
|---|---|---|
both | Both directions | Traffic — both a surge and a collapse are problems |
upper | Upwards only | Error rate · CPU · response time |
lower | Downwards only | Apdex · throughput |
The scenario sets this to suit the metric (Chapter 404).
Further detail
The formulas for Z-Score, IQR and Isolation Forest are in §2 of the algorithm guide
(600-algorithm_guide.md) in the Forecast MCP server documentation. RCF is not in that document; the implementation (pkg/engine/detector/rcf.go) is the reference.
Next
- Criteria for reading results — Appendix: How to read the results
- Anomaly detection scenarios — Anomaly detection
- How far it can be trusted — Appendix: Can you trust it