Anomaly Detection

Anomaly detection identifies unusual patterns, outliers, and suspicious behaviors in graph data. Geode’s native graph model excels at detecting relationship-based anomalies, structural outliers, and behavioral deviations that would be difficult to spot in traditional databases. <h3 id="what-is-graph-based-anomaly-detection" class="position-relative d-flex align-items-center group"> What Is Graph-Based Anomaly Detection? <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="what-is-graph-based-anomaly-detection" aria-haspopup="dialog" aria-label="Share link: What Is Graph-Based Anomaly Detection?"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Graph-based anomaly detection leverages the structure and relationships in your data to identify entities or patterns that deviate from normal behavior. Unlike statistical methods that analyze individual attributes, graph-based approaches examine connectivity patterns, community membership, and relationship dynamics. <h4 id="types-of-anomalies" class="position-relative d-flex align-items-center group"> Types of Anomalies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="types-of-anomalies" aria-haspopup="dialog" aria-label="Share link: Types of Anomalies"> Share link </button> </h4>Point Anomalies: Individual nodes or edges with unusual properties (e.g., account with abnormally high transaction volume). Contextual Anomalies: Entities that are anomalous in a specific context but not globally (e.g., large transaction from a normally low-activity account). Collective Anomalies: Groups of entities that together form an unusual pattern (e.g., circular money transfer ring). <h3 id="statistical-anomaly-detection" class="position-relative d-flex align-items-center group"> Statistical Anomaly Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="statistical-anomaly-detection" aria-haspopup="dialog" aria-label="Share link: Statistical Anomaly Detection"> Share link </button> </h3> <h4 id="threshold-based-detection" class="position-relative d-flex align-items-center group"> Threshold-Based Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="threshold-based-detection" aria-haspopup="dialog" aria-label="Share link: Threshold-Based Detection"> Share link </button> </h4>Identify outliers using statistical thresholds: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Detect accounts with unusually high transaction counts MATCH (a:Account)-[t:TRANSACTION]->() WITH a, COUNT(t) AS tx_count WITH AVG(tx_count) AS avg_count, STDDEV(tx_count) AS stddev_count MATCH (suspicious:Account)-[t2:TRANSACTION]->() WITH suspicious, COUNT(t2) AS account_tx_count, avg_count, stddev_count WHERE account_tx_count > avg_count + (3 * stddev_count) // 3 sigma rule RETURN suspicious.account_id, account_tx_count, avg_count, stddev_count, (account_tx_count - avg_count) / stddev_count AS z_score ORDER BY z_score DESC; </code></pre></div> <h4 id="distribution-analysis" class="position-relative d-flex align-items-center group"> Distribution Analysis <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="distribution-analysis" aria-haspopup="dialog" aria-label="Share link: Distribution Analysis"> Share link </button> </h4>Detect outliers based on value distributions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Find transactions with unusual amounts WITH [100, 500, 1000] AS percentiles MATCH (t:Transaction) WITH t, percentile_cont(t.amount, 0.25) AS q1, percentile_cont(t.amount, 0.75) AS q3, percentile_cont(t.amount, 0.50) AS median WITH t, q1, q3, median, q3 - q1 AS iqr // Interquartile range WHERE t.amount < q1 - (1.5 * iqr) // Lower outliers OR t.amount > q3 + (1.5 * iqr) // Upper outliers RETURN t.transaction_id, t.amount, median, iqr, CASE WHEN t.amount > q3 + (1.5 * iqr) THEN 'high_outlier' ELSE 'low_outlier' END AS anomaly_type; </code></pre></div> <h3 id="pattern-based-detection" class="position-relative d-flex align-items-center group"> Pattern-Based Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="pattern-based-detection" aria-haspopup="dialog" aria-label="Share link: Pattern-Based Detection"> Share link </button> </h3> <h4 id="unusual-relationship-patterns" class="position-relative d-flex align-items-center group"> Unusual Relationship Patterns <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="unusual-relationship-patterns" aria-haspopup="dialog" aria-label="Share link: Unusual Relationship Patterns"> Share link </button> </h4>Detect suspicious connectivity patterns: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Find accounts with circular transaction patterns MATCH path = (a:Account)-[:TRANSACTION*2..5]->(a) WHERE ALL(r IN relationships(path) WHERE r.timestamp > datetime().minusDays(7)) WITH a, path, LENGTH(path) AS cycle_length, REDUCE(sum = 0, r IN relationships(path) | sum + r.amount) AS total_amount WHERE total_amount > 10000 // Significant amount in cycle RETURN a.account_id, cycle_length, total_amount, [n IN nodes(path) | n.account_id] AS cycle_accounts ORDER BY total_amount DESC; // Detect rapid-fire transactions (possible automation) MATCH (a:Account)-[t:TRANSACTION]->(b:Account) WITH a, b, COLLECT(t) AS transactions WHERE SIZE(transactions) >= 5 WITH a, b, transactions, transactions[0].timestamp AS first_tx, transactions[-1].timestamp AS last_tx WITH a, b, SIZE(transactions) AS tx_count, duration.between(first_tx, last_tx).seconds AS time_span_seconds WHERE time_span_seconds < 60 // 5+ transactions in under 1 minute RETURN a.account_id AS from_account, b.account_id AS to_account, tx_count, time_span_seconds, tx_count / time_span_seconds AS tx_per_second; </code></pre></div> <h4 id="structural-anomalies" class="position-relative d-flex align-items-center group"> Structural Anomalies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="structural-anomalies" aria-haspopup="dialog" aria-label="Share link: Structural Anomalies"> Share link </button> </h4>Identify unusual graph structures: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Find isolated cliques (potential fraud rings) MATCH (n:Account)-[r1:TRANSACTION]-(m:Account) WHERE r1.timestamp > datetime().minusDays(30) WITH n, COLLECT(DISTINCT m) AS neighbors WHERE SIZE(neighbors) >= 5 // Minimum clique size // Check if neighbors form a complete subgraph WITH n, neighbors WHERE ALL( n1 IN neighbors WHERE ALL( n2 IN neighbors WHERE n1 = n2 OR EXISTS((n1)-[:TRANSACTION]-(n2)) ) ) WITH n, neighbors, SIZE(neighbors) AS clique_size // Check if clique is isolated from the rest of the graph MATCH (member:Account) WHERE member IN neighbors OPTIONAL MATCH (member)-[:TRANSACTION]-(outside:Account) WHERE NOT outside IN neighbors WITH n, neighbors, clique_size, COUNT(DISTINCT outside) AS external_connections WHERE external_connections < clique_size * 0.1 // < 10% external connections RETURN n.account_id, [m IN neighbors | m.account_id] AS ring_members, clique_size, external_connections; </code></pre></div> <h3 id="behavioral-analysis" class="position-relative d-flex align-items-center group"> Behavioral Analysis <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="behavioral-analysis" aria-haspopup="dialog" aria-label="Share link: Behavioral Analysis"> Share link </button> </h3> <h4 id="deviation-from-normal-behavior" class="position-relative d-flex align-items-center group"> Deviation from Normal Behavior <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="deviation-from-normal-behavior" aria-haspopup="dialog" aria-label="Share link: Deviation from Normal Behavior"> Share link </button> </h4>Detect changes in user behavior patterns: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Compare recent activity to historical baseline MATCH (u:User)-[recent:TRANSACTION]->(merchant:Merchant) WHERE recent.timestamp > datetime().minusDays(7) WITH u, merchant.category AS category, COUNT(recent) AS recent_count // Get historical average for this user and category MATCH (u)-[historical:TRANSACTION]->(:Merchant {category: category}) WHERE historical.timestamp BETWEEN datetime().minusDays(90) AND datetime().minusDays(7) WITH u, category, recent_count, COUNT(historical) / 12.0 AS weekly_avg // 90 days = ~12 weeks WHERE recent_count > weekly_avg * 3 // 3x normal activity RETURN u.user_id, category, recent_count, weekly_avg, recent_count / weekly_avg AS activity_ratio ORDER BY activity_ratio DESC; </code></pre></div> <h4 id="velocity-checks" class="position-relative d-flex align-items-center group"> Velocity Checks <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="velocity-checks" aria-haspopup="dialog" aria-label="Share link: Velocity Checks"> Share link </button> </h4>Detect impossible or suspicious transaction sequences: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Detect geographically impossible transactions MATCH (a:Account)-[t1:TRANSACTION]->(m1:Merchant) MATCH (a)-[t2:TRANSACTION]->(m2:Merchant) WHERE t1.timestamp < t2.timestamp AND duration.between(t1.timestamp, t2.timestamp).minutes < 60 AND m1.merchant_id <> m2.merchant_id // Calculate distance between merchant locations WITH a, t1, t2, m1, m2, point.distance( point({latitude: m1.latitude, longitude: m1.longitude}), point({latitude: m2.latitude, longitude: m2.longitude}) ) / 1000.0 AS distance_km, duration.between(t1.timestamp, t2.timestamp).minutes AS time_minutes WITH a, t1, t2, m1, m2, distance_km, time_minutes, distance_km / (time_minutes / 60.0) AS required_speed_kmh WHERE required_speed_kmh > 800 // Faster than airplane RETURN a.account_id, t1.transaction_id AS first_tx, t2.transaction_id AS second_tx, m1.city AS first_location, m2.city AS second_location, distance_km, time_minutes, required_speed_kmh; </code></pre></div> <h3 id="network-based-detection" class="position-relative d-flex align-items-center group"> Network-Based Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="network-based-detection" aria-haspopup="dialog" aria-label="Share link: Network-Based Detection"> Share link </button> </h3> <h4 id="community-outliers" class="position-relative d-flex align-items-center group"> Community Outliers <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="community-outliers" aria-haspopup="dialog" aria-label="Share link: Community Outliers"> Share link </button> </h4>Identify entities that don’t fit their community: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Find users with unusual connections for their community MATCH (u:User)-[:BELONGS_TO]->(c:Community) MATCH (u)-[:CONNECTED_TO]-(neighbor:User) // Calculate within-community vs. outside-community connections WITH u, c, COUNT(DISTINCT CASE WHEN (neighbor)-[:BELONGS_TO]->(c) THEN neighbor END) AS internal_connections, COUNT(DISTINCT CASE WHEN NOT (neighbor)-[:BELONGS_TO]->(c) THEN neighbor END) AS external_connections WITH u, c, internal_connections, external_connections, external_connections * 1.0 / (internal_connections + external_connections) AS external_ratio // Compare to community average WITH c, AVG(external_ratio) AS avg_external_ratio, STDDEV(external_ratio) AS stddev_external MATCH (outlier:User)-[:BELONGS_TO]->(c) MATCH (outlier)-[:CONNECTED_TO]-(n:User) WITH outlier, c, COUNT(DISTINCT CASE WHEN (n)-[:BELONGS_TO]->(c) THEN n END) AS user_internal, COUNT(DISTINCT CASE WHEN NOT (n)-[:BELONGS_TO]->(c) THEN n END) AS user_external, avg_external_ratio, stddev_external WITH outlier, c, user_external * 1.0 / (user_internal + user_external) AS user_external_ratio, avg_external_ratio, stddev_external WHERE user_external_ratio > avg_external_ratio + (2 * stddev_external) RETURN outlier.user_id, user_external_ratio, avg_external_ratio, (user_external_ratio - avg_external_ratio) / stddev_external AS z_score; </code></pre></div> <h4 id="bridge-detection" class="position-relative d-flex align-items-center group"> Bridge Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="bridge-detection" aria-haspopup="dialog" aria-label="Share link: Bridge Detection"> Share link </button> </h4>Find accounts that bridge normally disconnected communities (potential money mules): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Detect bridge nodes connecting separate clusters MATCH (bridge:Account)-[:TRANSACTION]-(neighbor:Account) WITH bridge, COLLECT(DISTINCT neighbor) AS neighbors WHERE SIZE(neighbors) >= 10 // Check if neighbors are disconnected from each other WITH bridge, neighbors WHERE NOT ANY( n1 IN neighbors[0..SIZE(neighbors)-1] WHERE ANY( n2 IN neighbors[1..] WHERE n1 <> n2 AND EXISTS((n1)-[:TRANSACTION*1..2]-(n2)) ) ) RETURN bridge.account_id, SIZE(neighbors) AS connected_clusters, [n IN neighbors | n.account_id] AS cluster_representatives; </code></pre></div> <h3 id="time-series-anomaly-detection" class="position-relative d-flex align-items-center group"> Time-Series Anomaly Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="time-series-anomaly-detection" aria-haspopup="dialog" aria-label="Share link: Time-Series Anomaly Detection"> Share link </button> </h3> <h4 id="change-point-detection" class="position-relative d-flex align-items-center group"> Change Point Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="change-point-detection" aria-haspopup="dialog" aria-label="Share link: Change Point Detection"> Share link </button> </h4>Identify sudden changes in activity patterns: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Detect sudden spikes in transaction volume MATCH (a:Account)-[t:TRANSACTION]->() WITH a, date.truncate('day', t.timestamp) AS day, COUNT(t) AS daily_count, SUM(t.amount) AS daily_amount ORDER BY a, day // Calculate moving average and detect deviations WITH a, day, daily_count, daily_amount, AVG(daily_count) OVER ( PARTITION BY a ORDER BY day ROWS BETWEEN 7 PRECEDING AND 1 PRECEDING ) AS avg_count_7d, STDDEV(daily_count) OVER ( PARTITION BY a ORDER BY day ROWS BETWEEN 7 PRECEDING AND 1 PRECEDING ) AS stddev_count_7d WHERE daily_count > avg_count_7d + (3 * stddev_count_7d) RETURN a.account_id, day, daily_count, avg_count_7d, (daily_count - avg_count_7d) / NULLIF(stddev_count_7d, 0) AS z_score ORDER BY z_score DESC; </code></pre></div> <h4 id="seasonal-anomalies" class="position-relative d-flex align-items-center group"> Seasonal Anomalies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="seasonal-anomalies" aria-haspopup="dialog" aria-label="Share link: Seasonal Anomalies"> Share link </button> </h4>Detect unusual patterns accounting for seasonality: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Compare current week to same week in previous periods WITH datetime() AS now MATCH (u:User)-[t:TRANSACTION]->() WHERE t.timestamp > now.minusDays(7) WITH u, COUNT(t) AS this_week_count // Get counts from same week in previous months MATCH (u)-[historical:TRANSACTION]->() WHERE historical.timestamp.weekOfYear = datetime().weekOfYear AND historical.timestamp.year < datetime().year WITH u, this_week_count, AVG(COUNT(historical)) AS historical_avg, STDDEV(COUNT(historical)) AS historical_stddev WHERE this_week_count > historical_avg + (2 * historical_stddev) RETURN u.user_id, this_week_count, historical_avg, (this_week_count - historical_avg) / historical_stddev AS z_score; </code></pre></div> <h3 id="real-time-anomaly-scoring" class="position-relative d-flex align-items-center group"> Real-Time Anomaly Scoring <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="real-time-anomaly-scoring" aria-haspopup="dialog" aria-label="Share link: Real-Time Anomaly Scoring"> Share link </button> </h3> <h4 id="composite-anomaly-score" class="position-relative d-flex align-items-center group"> Composite Anomaly Score <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="composite-anomaly-score" aria-haspopup="dialog" aria-label="Share link: Composite Anomaly Score"> Share link </button> </h4>Combine multiple signals into a risk score: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Calculate multi-factor anomaly score for transaction MATCH (a:Account)-[t:TRANSACTION {transaction_id: $tx_id}]->(m:Merchant) // Factor 1: Transaction amount vs. account history MATCH (a)-[hist:TRANSACTION]->() WHERE hist.timestamp > datetime().minusDays(30) WITH a, t, m, AVG(hist.amount) AS avg_amount, STDDEV(hist.amount) AS stddev_amount, COUNT(hist) AS tx_count WITH a, t, m, tx_count, CASE WHEN tx_count < 5 THEN 0.5 // New account penalty WHEN stddev_amount = 0 THEN 0 ELSE LEAST(ABS(t.amount - avg_amount) / stddev_amount / 3.0, 1.0) END AS amount_score // Factor 2: Merchant category vs. user history MATCH (a)-[:TRANSACTION]->(:Merchant {category: m.category}) WITH a, t, m, amount_score, COUNT(*) AS category_familiarity WITH a, t, m, amount_score, CASE WHEN category_familiarity = 0 THEN 0.8 // Never used this category WHEN category_familiarity < 3 THEN 0.4 // Rarely used ELSE 0.0 END AS category_score // Factor 3: Time of day WITH a, t, m, amount_score, category_score, CASE WHEN t.timestamp.hour BETWEEN 2 AND 5 THEN 0.6 // Late night WHEN t.timestamp.hour BETWEEN 9 AND 21 THEN 0.0 // Normal hours ELSE 0.3 END AS time_score // Factor 4: Velocity (transactions in last hour) MATCH (a)-[recent:TRANSACTION]->() WHERE recent.timestamp > t.timestamp.minusHours(1) WITH a, t, m, amount_score, category_score, time_score, COUNT(recent) AS recent_tx_count, CASE WHEN COUNT(recent) > 10 THEN 1.0 WHEN COUNT(recent) > 5 THEN 0.7 WHEN COUNT(recent) > 3 THEN 0.4 ELSE 0.0 END AS velocity_score // Combine scores with weights WITH t, (amount_score * 0.4 + category_score * 0.25 + time_score * 0.15 + velocity_score * 0.2) AS composite_score RETURN t.transaction_id, composite_score, CASE WHEN composite_score > 0.8 THEN 'CRITICAL' WHEN composite_score > 0.6 THEN 'HIGH' WHEN composite_score > 0.4 THEN 'MEDIUM' ELSE 'LOW' END AS risk_level; </code></pre></div> <h3 id="machine-learning-integration" class="position-relative d-flex align-items-center group"> Machine Learning Integration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="machine-learning-integration" aria-haspopup="dialog" aria-label="Share link: Machine Learning Integration"> Share link </button> </h3> <h4 id="feature-engineering" class="position-relative d-flex align-items-center group"> Feature Engineering <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="feature-engineering" aria-haspopup="dialog" aria-label="Share link: Feature Engineering"> Share link </button> </h4>Extract graph features for ML models: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Extract node features for anomaly detection model MATCH (a:Account) OPTIONAL MATCH (a)-[out:TRANSACTION]->() OPTIONAL MATCH (a)<-[in:TRANSACTION]-() WITH a, COUNT(DISTINCT out) AS out_degree, COUNT(DISTINCT in) AS in_degree, AVG(out.amount) AS avg_out_amount, AVG(in.amount) AS avg_in_amount, STDDEV(out.amount) AS stddev_out_amount, MAX(out.amount) AS max_out_amount, duration.between(MIN(out.timestamp), MAX(out.timestamp)).days AS account_age_days // Calculate network features OPTIONAL MATCH (a)-[:TRANSACTION*2]-(indirect:Account) WITH a, out_degree, in_degree, avg_out_amount, avg_in_amount, stddev_out_amount, max_out_amount, account_age_days, COUNT(DISTINCT indirect) AS two_hop_neighbors RETURN a.account_id, out_degree, in_degree, out_degree + in_degree AS total_degree, avg_out_amount, avg_in_amount, stddev_out_amount, max_out_amount, account_age_days, two_hop_neighbors, two_hop_neighbors * 1.0 / NULLIF(out_degree + in_degree, 0) AS network_expansion; </code></pre></div> <h4 id="label-propagation-for-anomaly-detection" class="position-relative d-flex align-items-center group"> Label Propagation for Anomaly Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="label-propagation-for-anomaly-detection" aria-haspopup="dialog" aria-label="Share link: Label Propagation for Anomaly Detection"> Share link </button> </h4>Propagate known fraud labels through the graph: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">// Initialize known fraudulent accounts MATCH (fraud:Account {is_fraud: true}) SET fraud.fraud_score = 1.0; // Propagate fraud score to connected accounts MATCH (fraud:Account {is_fraud: true})-[:TRANSACTION]-(neighbor:Account) WHERE neighbor.is_fraud IS NULL WITH neighbor, AVG(fraud.fraud_score) AS avg_neighbor_score, COUNT(fraud) AS fraud_neighbor_count SET neighbor.fraud_score = avg_neighbor_score * 0.7, // Decay factor neighbor.fraud_neighbor_count = fraud_neighbor_count; // Flag high-risk accounts MATCH (suspicious:Account) WHERE suspicious.fraud_score > 0.5 AND suspicious.is_fraud IS NULL RETURN suspicious.account_id, suspicious.fraud_score, suspicious.fraud_neighbor_count ORDER BY suspicious.fraud_score DESC; </code></pre></div> <h3 id="best-practices" class="position-relative d-flex align-items-center group"> Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices" aria-haspopup="dialog" aria-label="Share link: Best Practices"> Share link </button> </h3><ol> <li>Combine Multiple Signals: Use both statistical and graph-based features for robust detection</li> <li>Set Context-Aware Thresholds: Different rules for different account types, regions, or time periods</li> <li>Handle False Positives: Implement feedback loops to reduce false alarms over time</li> <li>Monitor Model Drift: Regularly retrain models as normal behavior patterns evolve</li> <li>Real-Time Processing: Flag high-risk transactions immediately for review</li> <li>Explainability: Provide clear reasons why something was flagged as anomalous</li> <li>Incremental Updates: Update anomaly scores as new data arrives</li> <li>Historical Analysis: Backtest detection rules on labeled historical data</li> <li>Multi-Layer Defense: Use both rule-based and ML-based approaches</li> <li>Privacy-Preserving: Aggregate patterns without exposing individual behaviors</li> </ol> <h3 id="integration-with-geode-features" class="position-relative d-flex align-items-center group"> Integration with Geode Features <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="integration-with-geode-features" aria-haspopup="dialog" aria-label="Share link: Integration with Geode Features"> Share link </button> </h3>Anomaly detection leverages: <ul> <li>Graph Algorithms: PageRank, community detection, centrality measures</li> <li>Real-Time Analytics: Stream processing for immediate threat detection</li> <li>Vector Embeddings: Learn behavioral embeddings for similarity-based detection</li> <li>Temporal Queries: Analyze time-series patterns and trends</li> <li>Row-Level Security: Control access to sensitive anomaly detection results</li> </ul> Browse the tagged content below to discover documentation, tutorials, and guides for implementing anomaly detection in your Geode applications. <h3 id="statistical-methods-for-anomaly-detection" class="position-relative d-flex align-items-center group"> Statistical Methods for Anomaly Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="statistical-methods-for-anomaly-detection" aria-haspopup="dialog" aria-label="Share link: Statistical Methods for Anomaly Detection"> Share link </button> </h3> <h4 id="z-score-analysis" class="position-relative d-flex align-items-center group"> Z-Score Analysis <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="z-score-analysis" aria-haspopup="dialog" aria-label="Share link: Z-Score Analysis"> Share link </button> </h4>Detect outliers using standard deviation: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Multi-dimensional z-score anomaly detection MATCH (a:Account)-[t:TRANSACTION]->() WITH a, COUNT(t) AS tx_count, AVG(t.amount) AS avg_amount, STDDEV(t.amount) AS stddev_amount, MAX(t.amount) AS max_amount WITH AVG(tx_count) AS global_avg_count, STDDEV(tx_count) AS global_stddev_count, AVG(avg_amount) AS global_avg_amount, STDDEV(avg_amount) AS global_stddev_amount, COLLECT({account: a, tx_count: tx_count, avg_amount: avg_amount}) AS accounts UNWIND accounts AS acc_data WITH acc_data, (acc_data.tx_count - global_avg_count) / NULLIF(global_stddev_count, 0) AS z_count, (acc_data.avg_amount - global_avg_amount) / NULLIF(global_stddev_amount, 0) AS z_amount WITH acc_data, SQRT(z_count ^ 2 + z_amount ^ 2) AS mahalanobis_distance WHERE mahalanobis_distance > 3.0 // 3-sigma threshold RETURN acc_data.account.account_id, acc_data.tx_count, acc_data.avg_amount, mahalanobis_distance AS anomaly_score ORDER BY mahalanobis_distance DESC; </code></pre></div> <h4 id="interquartile-range-iqr-method" class="position-relative d-flex align-items-center group"> Interquartile Range (IQR) Method <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="interquartile-range-iqr-method" aria-haspopup="dialog" aria-label="Share link: Interquartile Range (IQR) Method"> Share link </button> </h4>Robust to outliers: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- IQR-based outlier detection MATCH (t:Transaction) WITH t.amount AS amount ORDER BY amount WITH COLLECT(amount) AS amounts, percentile_cont(amount, 0.25) AS q1, percentile_cont(amount, 0.75) AS q3 WITH amounts, q1, q3, q3 - q1 AS iqr, q1 - 1.5 * (q3 - q1) AS lower_fence, q3 + 1.5 * (q3 - q1) AS upper_fence MATCH (t:Transaction) WHERE t.amount < lower_fence OR t.amount > upper_fence RETURN t.transaction_id, t.amount, lower_fence, upper_fence, CASE WHEN t.amount < lower_fence THEN 'LOW_OUTLIER' ELSE 'HIGH_OUTLIER' END AS outlier_type; </code></pre></div> <h3 id="graph-based-anomaly-scores" class="position-relative d-flex align-items-center group"> Graph-Based Anomaly Scores <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="graph-based-anomaly-scores" aria-haspopup="dialog" aria-label="Share link: Graph-Based Anomaly Scores"> Share link </button> </h3> <h4 id="local-outlier-factor-lof" class="position-relative d-flex align-items-center group"> Local Outlier Factor (LOF) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="local-outlier-factor-lof" aria-haspopup="dialog" aria-label="Share link: Local Outlier Factor (LOF)"> Share link </button> </h4>Density-based outlier detection: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Compute Local Outlier Factor MATCH (n:Node) CALL { WITH n MATCH (n)-[:CONNECTED*1..2]-(neighbor:Node) WITH n, neighbor, COUNT(*) AS path_count ORDER BY path_count DESC LIMIT 20 RETURN COLLECT(neighbor) AS k_neighbors } WITH n, k_neighbors, AVG([neighbor IN k_neighbors | SIZE((neighbor)-[:CONNECTED]-())]) AS avg_neighbor_density WITH n, k_neighbors, avg_neighbor_density, SIZE((n)-[:CONNECTED]-()) AS node_density WITH n, avg_neighbor_density / NULLIF(node_density, 0) AS lof_score WHERE lof_score > 1.5 // LOF > 1 indicates outlier RETURN n.id, lof_score, node_density ORDER BY lof_score DESC; </code></pre></div> <h4 id="isolation-forest-adaptation" class="position-relative d-flex align-items-center group"> Isolation Forest Adaptation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="isolation-forest-adaptation" aria-haspopup="dialog" aria-label="Share link: Isolation Forest Adaptation"> Share link </button> </h4>Random partitioning for anomaly detection: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Graph-based isolation scoring MATCH (n:Node) CALL { WITH n MATCH path = (n)-[:EDGE*1..5]-(other:Node) WITH n, COUNT(DISTINCT other) AS reachable_nodes, AVG(LENGTH(path)) AS avg_distance RETURN reachable_nodes, avg_distance } WITH AVG(reachable_nodes) AS global_avg_reach, STDDEV(reachable_nodes) AS global_stddev_reach MATCH (n:Node) CALL { WITH n MATCH path = (n)-[:EDGE*1..5]-(other:Node) WITH COUNT(DISTINCT other) AS node_reach RETURN node_reach } WITH n, node_reach, global_avg_reach, global_stddev_reach, (global_avg_reach - node_reach) / NULLIF(global_stddev_reach, 0) AS isolation_score WHERE isolation_score > 2.0 RETURN n.id, node_reach, isolation_score ORDER BY isolation_score DESC; </code></pre></div> <h3 id="time-series-anomaly-detection-1" class="position-relative d-flex align-items-center group"> Time-Series Anomaly Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="time-series-anomaly-detection-1" aria-haspopup="dialog" aria-label="Share link: Time-Series Anomaly Detection"> Share link </button> </h3> <h4 id="arima-style-forecasting" class="position-relative d-flex align-items-center group"> ARIMA-Style Forecasting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="arima-style-forecasting" aria-haspopup="dialog" aria-label="Share link: ARIMA-Style Forecasting"> Share link </button> </h4>Detect deviations from predicted values: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Simple moving average anomaly detection MATCH (a:Account)-[t:TRANSACTION]->() WHERE t.timestamp >= datetime().minusDays(30) WITH a, date.truncate('day', t.timestamp) AS day, SUM(t.amount) AS daily_amount ORDER BY a, day WITH a, day, daily_amount, AVG(daily_amount) OVER ( PARTITION BY a ORDER BY day ROWS BETWEEN 7 PRECEDING AND 1 PRECEDING ) AS moving_avg_7d, STDDEV(daily_amount) OVER ( PARTITION BY a ORDER BY day ROWS BETWEEN 7 PRECEDING AND 1 PRECEDING ) AS moving_stddev_7d WHERE ABS(daily_amount - moving_avg_7d) > 3 * moving_stddev_7d RETURN a.account_id, day, daily_amount, moving_avg_7d, (daily_amount - moving_avg_7d) / NULLIF(moving_stddev_7d, 0) AS z_score ORDER BY ABS(z_score) DESC; </code></pre></div> <h4 id="seasonal-decomposition" class="position-relative d-flex align-items-center group"> Seasonal Decomposition <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="seasonal-decomposition" aria-haspopup="dialog" aria-label="Share link: Seasonal Decomposition"> Share link </button> </h4>Account for cyclic patterns: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Weekly seasonality-adjusted anomaly detection MATCH (u:User)-[t:TRANSACTION]->() WITH u, t.timestamp.dayOfWeek AS dow, t.timestamp.hourOfDay AS hour, COUNT(t) AS tx_count, SUM(t.amount) AS total_amount WITH dow, hour, AVG(tx_count) AS typical_count, STDDEV(tx_count) AS stddev_count, AVG(total_amount) AS typical_amount ORDER BY dow, hour MATCH (u:User)-[recent:TRANSACTION]->() WHERE recent.timestamp > datetime().minusDays(1) WITH u, recent.timestamp.dayOfWeek AS current_dow, recent.timestamp.hourOfDay AS current_hour, COUNT(recent) AS current_count // Join with historical patterns... WHERE current_count > typical_count + 3 * stddev_count RETURN u.user_id, current_count, typical_count, 'SEASONAL_ANOMALY' AS type; </code></pre></div> <h3 id="ensemble-anomaly-detection" class="position-relative d-flex align-items-center group"> Ensemble Anomaly Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="ensemble-anomaly-detection" aria-haspopup="dialog" aria-label="Share link: Ensemble Anomaly Detection"> Share link </button> </h3>Combine multiple detection methods: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Multi-method ensemble scoring MATCH (a:Account) CALL { WITH a // Method 1: Transaction volume anomaly MATCH (a)-[t:TRANSACTION]->() WITH a, COUNT(t) AS tx_count WITH a, tx_count, (tx_count - $global_avg_tx) / $global_stddev_tx AS z_volume RETURN CASE WHEN ABS(z_volume) > 2 THEN 0.3 ELSE 0.0 END AS volume_score } CALL { WITH a // Method 2: Unusual connection pattern MATCH (a)-[:TRANSACTED_WITH]-(other:Account) WITH a, COUNT(DISTINCT other) AS unique_connections WHERE unique_connections > 50 RETURN 0.4 AS pattern_score } CALL { WITH a // Method 3: Suspicious timing MATCH (a)-[t:TRANSACTION]->() WHERE t.timestamp.hour BETWEEN 2 AND 5 WITH a, COUNT(t) AS late_night_tx WHERE late_night_tx > 5 RETURN 0.3 AS timing_score } WITH a, volume_score + pattern_score + timing_score AS ensemble_score WHERE ensemble_score > 0.5 RETURN a.account_id, ensemble_score, 'ENSEMBLE_DETECTION' AS method ORDER BY ensemble_score DESC; </code></pre></div> <h3 id="real-time-streaming-anomaly-detection" class="position-relative d-flex align-items-center group"> Real-Time Streaming Anomaly Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="real-time-streaming-anomaly-detection" aria-haspopup="dialog" aria-label="Share link: Real-Time Streaming Anomaly Detection"> Share link </button> </h3> <h4 id="incremental-statistics-update" class="position-relative d-flex align-items-center group"> Incremental Statistics Update <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="incremental-statistics-update" aria-haspopup="dialog" aria-label="Share link: Incremental Statistics Update"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Update running statistics incrementally MATCH (stats:GlobalStats {metric: 'daily_transactions'}) MATCH (new_tx:Transaction {processed: false}) WITH stats, COUNT(new_tx) AS new_count, AVG(new_tx.amount) AS new_avg, STDDEV(new_tx.amount) AS new_stddev SET stats.count = stats.count + new_count, stats.mean = (stats.mean * stats.count + new_avg * new_count) / (stats.count + new_count), stats.M2 = stats.M2 + new_stddev ^ 2 * new_count, // Welford's algorithm stats.last_updated = datetime(); // Mark transactions as processed MATCH (new_tx:Transaction {processed: false}) SET new_tx.processed = true; </code></pre></div> <h4 id="sliding-window-anomaly-detection" class="position-relative d-flex align-items-center group"> Sliding Window Anomaly Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="sliding-window-anomaly-detection" aria-haspopup="dialog" aria-label="Share link: Sliding Window Anomaly Detection"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Fixed-size sliding window WITH datetime().minusHours(1) AS window_start MATCH (a:Account)-[t:TRANSACTION]->() WHERE t.timestamp >= window_start WITH a, COUNT(t) AS window_tx_count, SUM(t.amount) AS window_total WITH a, window_tx_count, window_total, window_tx_count * 1.0 / 3600 AS tx_per_second WHERE tx_per_second > 1.0 // More than 1 tx/second RETURN a.account_id, window_tx_count, window_total, tx_per_second, 'HIGH_VELOCITY' AS anomaly_type; </code></pre></div> <h3 id="domain-specific-anomaly-detection" class="position-relative d-flex align-items-center group"> Domain-Specific Anomaly Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="domain-specific-anomaly-detection" aria-haspopup="dialog" aria-label="Share link: Domain-Specific Anomaly Detection"> Share link </button> </h3> <h4 id="healthcare-patient-risk-scoring" class="position-relative d-flex align-items-center group"> Healthcare: Patient Risk Scoring <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="healthcare-patient-risk-scoring" aria-haspopup="dialog" aria-label="Share link: Healthcare: Patient Risk Scoring"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Detect high-risk patient patterns MATCH (p:Patient)-[v:VISIT]->(provider:Provider) WHERE v.date > date().minusMonths(12) WITH p, COUNT(DISTINCT v) AS visit_count, COUNT(DISTINCT provider) AS provider_count, SUM(v.cost) AS total_cost WITH p, visit_count, provider_count, total_cost, visit_count * 1.0 / 12 AS visits_per_month WHERE visits_per_month > 3 OR provider_count > 10 OR total_cost > 100000 WITH p, visits_per_month, provider_count, total_cost, CASE WHEN visits_per_month > 5 THEN 0.4 ELSE 0.0 END + CASE WHEN provider_count > 15 THEN 0.3 ELSE 0.0 END + CASE WHEN total_cost > 150000 THEN 0.3 ELSE 0.0 END AS risk_score WHERE risk_score > 0.5 RETURN p.patient_id, p.name, risk_score, visits_per_month, provider_count, total_cost ORDER BY risk_score DESC; </code></pre></div> <h4 id="cybersecurity-intrusion-detection" class="position-relative d-flex align-items-center group"> Cybersecurity: Intrusion Detection <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="cybersecurity-intrusion-detection" aria-haspopup="dialog" aria-label="Share link: Cybersecurity: Intrusion Detection"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Network intrusion anomaly detection MATCH (host:Host)-[conn:CONNECTION]->(target:Host) WHERE conn.timestamp > datetime().minusHours(24) WITH host, target.ip_address AS dest_ip, COUNT(conn) AS connection_count, SUM(conn.bytes_sent) AS total_bytes, COUNT(DISTINCT target.port) AS unique_ports WHERE connection_count > 1000 OR unique_ports > 100 OR total_bytes > 10000000000 // 10 GB WITH host, dest_ip, connection_count, unique_ports, total_bytes, CASE WHEN connection_count > 10000 THEN 'PORT_SCAN' WHEN unique_ports > 500 THEN 'RECONNAISSANCE' WHEN total_bytes > 100000000000 THEN 'DATA_EXFILTRATION' ELSE 'SUSPICIOUS_ACTIVITY' END AS threat_type RETURN host.hostname, dest_ip, connection_count, unique_ports, total_bytes, threat_type ORDER BY connection_count DESC; </code></pre></div> <h3 id="best-practices-and-optimization" class="position-relative d-flex align-items-center group"> Best Practices and Optimization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices-and-optimization" aria-haspopup="dialog" aria-label="Share link: Best Practices and Optimization"> Share link </button> </h3><ol> <li>Set Domain-Appropriate Thresholds: Financial fraud (3σ), network security (2σ), manufacturing QA (6σ)</li> <li>Combine Statistical and Graph Methods: Leverage both attribute-based and structural anomalies</li> <li>Handle False Positives: Implement feedback loops to tune detection sensitivity</li> <li>Use Incremental Updates: Update statistics without full recomputation</li> <li>Monitor Concept Drift: Periodically retrain models as normal behavior evolves</li> <li>Explainability: Provide clear reasons for anomaly flags</li> <li>Multi-Tier Alerting: Low/Medium/High/Critical based on composite scores</li> <li>Privacy Preservation: Aggregate statistics without exposing individual records</li> </ol> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li>Anomaly Detection: Theory and Practice in Large-Scale Systems</li> <li>Graph-Based Outlier Detection: LOF, Isolation Forest, and DBSCAN</li> <li>Time-Series Anomalies: ARIMA, Seasonal Decomposition, and Prophet</li> <li>Ensemble Methods: Combining Multiple Detection Algorithms</li> <li>Real-Time Anomaly Detection: Streaming Analytics and Incremental Learning</li> <li>Domain Applications: Fraud, Healthcare, Cybersecurity, Manufacturing</li> </ul> Browse the tagged content below to discover documentation, tutorials, and guides for implementing anomaly detection in your Geode applications.

Popular

Related Articles

Fraud and Anomaly Detection

Fraud Detection Guide