Anomaly detection research and engineering

Malicious Activity as a Statistical Signal, integrated with the Anomaly Detection Atlas.

Atlas home · Research path · Operational families · Anomaly models · Visual index

Illustrative cover artwork, not measured telemetry. Malicious activity can resemble ordinary behavior; an anomaly alone does not establish an intrusion.

Use the research to decide what a deviation means, the catalogs to select a measurable model, and the linked workspaces to inspect collection and validation requirements. An unusual observation is a lead—not proof of compromise, attribution, or permission to contain a system.

Start with a question

• What looks unusual? Choose one of the 14 operational families and the correlation pattern.
• What should be measured? Inspect the activity-to-anomaly models, 118 statistical concepts, and 175 source categories. These are different, overlapping taxonomies.
• Can I collect it? Verify the telemetry contracts and the configuration-oriented Telemetry Library.
• Can I test it? Read the maintained queries and validation limits, then open an authorized simulation workspace.

Figure 1. From anomaly to investigation. A detection-engineering workflow, not a chronological attack lifecycle. Validation and analyst judgment are required before operational action.CONCEPTUAL MODELSources: NIST SP 800-94.

Text equivalent and full-size diagram

An anomaly is a lead, not an intrusion verdict or actor attribution.

1. Observe. Collect an event or change.
2. Compare. Use a defined baseline.
3. Corroborate. Check entity and context.
4. Investigate. Test competing explanations.

• Scope. 14 operational families + multi-event correlation. These are overlapping analytical views.
• Evidence boundary. Incident reports, functional tests and synthetic statistics answer different questions.

Open original full-size asset · Open narrow-layout SVG

Research chapters

• Foundations: from unusual activity to evidence
• Incident register and evidence boundaries
• ATT&CK mapping and version boundaries
• Documented campaigns and detection interpretations
• Telemetry contracts and collection requirements
• Credential-access detection engineering
• Visibility limits and competing explanations
• Detection patterns and maintained KQL examples
• Validation, baselines, and operational decisions
• Sources, provenance, and further research

Evidence and publication history

The 55 active figures retain their original captions, source links, text equivalents, evidence labels, and full-size assets. Browse every figure in context. Superseded original illustrations remain only in the historical publication appendix, not as current guidance.

The full-length article remains a publication snapshot for citations and old anchors. The Atlas is the integrated navigation and engineering reference. Read import provenance and the bounded consolidation audit. This consolidation does not claim new incident fact-checking or new detector execution.