Explainable anomaly detection: baselines, cohorts, provenance
Cernity ships a native anomaly detector for outbound-bytes behavior. Its defining property is that it is explainable: every anomaly finding carries the evidence for why it fired, so an analyst is never handed a bare score to trust or ignore. It leads with robust statistics, not opaque ML.
Two baselines, not one
A single baseline is easy to fool. A host that has always been quiet looks anomalous the day it does its first real backup; a host in a chatty cohort looks fine even when it individually spikes. Cernity scores each entity against both:
- The entity’s own rolling baseline — what this specific asset normally sends over time.
- A deterministic peer-cohort baseline — what comparable assets send. The cohort is derived deterministically, so the same inputs produce the same cohort; the comparison is reproducible and auditable, not a black box.
The finding reports both comparisons — how far the entity departed from its own history, and how far it departed from its peers. What that means for a case is the analyst’s call against the attached evidence; the detector scores, it does not render a verdict.
Robust statistics first
Outbound-bytes distributions are skewed and full of legitimate outliers. The detector uses robust statistics — resistant to the occasional large-but-benign transfer — rather than assuming a tidy normal distribution or reaching for an opaque model. The goal is a score an analyst can reason about, and a threshold an operator can defend.
Every finding carries its explanation
The anomaly finding is never just a number. It carries:
| Element | What it tells the analyst |
|---|---|
| Features | The measured inputs that produced the score (e.g. observed outbound bytes for the window) |
| Entity baseline | The entity’s own rolling expectation it was compared against |
| Cohort baseline | The peer-cohort expectation, and how far the entity departed from it |
| Cohort | Which peers the entity was compared against |
| Model & version | The scorer and version that produced the result, for provenance |
Because the explanation travels with the finding, an analyst can immediately ask the right question — is this entity unusual for itself, for its peers, or both? — instead of reverse-engineering a score. It also means a disposition on this finding is a disposition on a specific, reproducible computation.
It feeds the tuning loop
Anomaly findings are first-class citizens of the feedback loop:
an analyst’s disposition (disposition.v1) becomes anomaly ground-truth that the feedback-service
uses to inform future scoring. Ground-truth is owner-attributed, justified, and audited — the loop
improves the detector with evidence, not with silent, unattributable retraining.
Honest boundaries
- The shipped detector targets outbound-bytes anomaly. It is not a general “detect any anomaly” claim — it is one well-specified, explainable detector, by design.
- It complements, not replaces, the signature and behavioral detection layers. An explainable statistical anomaly is a lead with its reasoning attached, still subject to the analyst workflow.