Mostlylucid.Ephemeral.Patterns.AnomalyDetector 1.7.1

Mostlylucid.Ephemeral.Patterns.AnomalyDetector

🚨🚨 WARNING 🚨🚨 - Though in the 1.x range of version THINGS WILL STILL BREAK. This is the lab for developing this concept when stabilized it'll becoe the first styloflow release 🚨🚨🚨

Moving-window anomaly detection based on signal pattern thresholds.

dotnet add package mostlylucid.ephemeral.patterns.anomalydetector

Quick Start

using Mostlylucid.Ephemeral.Patterns.AnomalyDetector;

var sink = new SignalSink();

var detector = new SignalAnomalyDetector(
    sink,
    pattern: "error.*",
    threshold: 10,
    window: TimeSpan.FromSeconds(30));

if (detector.IsAnomalous())
{
    Console.WriteLine("Too many errors in the last 30 seconds!");
}

All Options

new SignalAnomalyDetector(
    // Required: signal sink to monitor
    sink: signalSink,

    // Glob pattern to match signals
    // Default: "error.*"
    pattern: "error.*",

    // Number of matches to trigger anomaly
    // Default: 5
    threshold: 5,

    // Time window for counting matches
    // Default: 10 seconds
    window: TimeSpan.FromSeconds(10)
)

API Reference

// Check if anomaly threshold is exceeded
bool isAnomalous = detector.IsAnomalous();

// Get current count of matching signals in window
int matchCount = detector.GetMatchCount();

How It Works

Scans a SignalSink with a moving time window and flags anomalies when the pattern match count exceeds the threshold.

Window: [now - 30s] ────────────────────> [now]
        error.db  error.api  error.api  error.timeout  error.api
        ──────────────────────────────────────────────────────────
        Count: 5 signals matching "error.*"
        Threshold: 10
        Result: NOT anomalous (5 < 10)

Example: Error Monitoring

var sink = new SignalSink();

var detector = new SignalAnomalyDetector(
    sink,
    pattern: "error.*",
    threshold: 5,
    window: TimeSpan.FromMinutes(1));

// Monitor loop
while (true)
{
    if (detector.IsAnomalous())
    {
        await alertService.SendAlert(
            $"High error rate: {detector.GetMatchCount()} errors in last minute");
    }
    await Task.Delay(TimeSpan.FromSeconds(5));
}

Example: Multi-Pattern Monitoring

var sink = new SignalSink();

var errorDetector = new SignalAnomalyDetector(sink, "error.*", 10, TimeSpan.FromMinutes(1));
var timeoutDetector = new SignalAnomalyDetector(sink, "timeout.*", 5, TimeSpan.FromSeconds(30));
var apiDetector = new SignalAnomalyDetector(sink, "api.failure.*", 3, TimeSpan.FromSeconds(10));

// Check multiple anomaly conditions
if (errorDetector.IsAnomalous() || timeoutDetector.IsAnomalous())
    await TriggerCircuitBreaker();

if (apiDetector.IsAnomalous())
    await NotifyOnCall();

Related Packages

License

Unlicense (public domain)