Contextual Anomaly

The defining trait of a contextual anomaly is that its value is not globally extreme. The data point falls within the expected range for the overall dataset but is anomalous only when paired with a specific contextual attribute.

• A CPU temperature of 85°C is normal under 100% load but anomalous at 5% load.
• A network throughput of 50 Mbps is normal during peak hours but anomalous at 3:00 AM.
• The anomaly is defined by the violation of a conditional relationship, not an absolute threshold.

Every contextual anomaly is defined by two distinct types of attributes that must be analyzed together:

• Contextual attributes: The frame of reference that defines the 'normal' situation. Examples include time of day, day of week, geographic location, current network load, or device type.
• Behavioral attributes: The metric being evaluated for anomalousness. Examples include latency, throughput, error rate, or power consumption.

A detection model must explicitly model the functional relationship between these two attribute classes to avoid false positives.

Contextual anomalies frequently arise from temporal or spatial patterns that define expected behavior profiles:

• Temporal context: A call drop rate of 2% is normal during a stadium event but anomalous on a quiet Tuesday morning. Seasonal decomposition is often required to model these cycles.
• Spatial context: A signal strength of -90 dBm is normal at a cell edge but anomalous directly under a base station.
• Combined context: Anomalies may require both dimensions, such as a specific sector experiencing high interference only during rush hour on weekdays.

Simple univariate thresholding with a Z-score or static limit will fail to detect contextual anomalies and generate high false positive rates. Effective detection demands models that learn conditional distributions:

• Regression-based methods: Predict the expected behavioral value given the context, then flag large residuals.
• Clustering with context: Group data by contextual profiles and detect outliers within each cluster.
• Time-series decomposition: Remove trend and seasonality to isolate the residual component where contextual anomalies become visible as point anomalies.

This conditional approach is what distinguishes contextual anomaly detection from simpler global outlier detection.

The 'normal' relationship between context and behavior is not static. Contextual anomaly detectors must account for concept drift where the underlying conditional distribution shifts over time:

• A base station's normal load profile changes after a new office building opens nearby.
• Seasonal patterns shift due to daylight saving time changes.
• Network upgrades alter the expected throughput-latency relationship.

Adaptive models using online learning or periodic retraining are essential to prevent a rising tide of false positives as the operational environment evolves.

Contextual anomalies are often confused with collective anomalies, but they are fundamentally different:

• A contextual anomaly is a single data instance that is anomalous only within its context. The instance itself is the anomaly.
• A collective anomaly is a sequence or set of instances where each individual point may be normal, but their co-occurrence or pattern is anomalous. The relationship between points is the anomaly.

For example, a single high-latency reading at 4:00 AM is a contextual anomaly. A sequence of 50 normal-latency readings followed by 50 normal-latency readings with no intermediate values is a collective anomaly indicating a potential sensor gap.