Skip to content

PATTERN Cited by 1 source

Dual-threshold session anomaly detection

Pattern

Alert on a session only when it satisfies both a per-subject relative-deviation threshold and an organisation-wide absolute-materiality threshold. Recompute the personal baseline over a rolling window so it adapts to normal behavioral drift, but retain the absolute floor to stop tiny absolute events from becoming alerts solely because their percentage change is large.

Structure

session event
  → identify subject and aggregate session cost or usage
  → compare with subject's rolling percentile baseline
  → compare with organisation-wide materiality percentile or dollar floor
  → both conditions true? → review queue
                       no → retain as normal or low-priority evidence

For a cost signal, an implementation can express the rule as:

alert if session_cost > relative_multiplier × subject_p95_rolling
      and session_cost > organization_p99_floor
      and session_cost > minimum_dollar_floor

The exact percentile, window, and multiplier are workload-specific; they are not universal defaults.

Why two thresholds

A subject-relative detector finds changes that an organisation-wide dollar rule cannot see: an agent that normally costs $5 per session but suddenly costs $50 has changed materially even if $50 is common for a power user. An absolute detector prevents a trivial account from creating a noisy alert every time its baseline changes from one cent to ten cents. Requiring both trades sensitivity for an investigation queue that focuses on changes likely to matter.

Cloudflare realization

Cloudflare AI Gateway User Insights scores sessions against each account's rolling 30-day p95 cost. A session is a strong anomaly candidate above 2× that personal p95, but it alerts only when it also exceeds the account-level p99 cost ceiling. The source also names an additional dollar floor. Its $200 p99 example is internal illustrative data, not a customer configuration recommendation. (Source: sources/2026-08-05-cloudflare-catching-rogue-ai-behavior-with-identity-aware-analytics)

Operational guidance

  • Keep the alert monitor-only until operators can inspect enough examples to understand precision and false-positive cost.
  • Segment subjects with structurally different behavior where possible; periodic agents and interactive people have different session distributions.
  • Define a new-subject policy. A percentile baseline is unreliable with sparse history; suppress, use conservative defaults, or route cold-start cases to a separate review path.
  • Track baseline drift, alert volume, and promotion from anomaly to confirmed incident. A detector that alerts continuously after a legitimate usage migration needs recalibration, not more alert handling.
  • Do not equate an anomaly with malicious intent. Pair the output with anomaly-versus-incident separation and human investigation.

Seen in

Last updated · 622 distilled / 1,953 read