BehavioralBaseline

ringkernel_accnet::models

Struct BehavioralBaseline 

Source 
#[repr(C)]
pub struct BehavioralBaseline {
Show 22 fields
    pub id: Uuid,
    pub account_id: u16,
    pub period_count: u16,
    pub _pad: u32,
    pub mean: f64,
    pub median: f64,
    pub std_dev: f64,
    pub mad: f64,
    pub q1: f64,
    pub q3: f64,
    pub iqr: f64,
    pub min_value: f64,
    pub max_value: f64,
    pub p5: f64,
    pub p95: f64,
    pub skewness: f64,
    pub kurtosis: f64,
    pub avg_transaction_count: f64,
    pub transaction_count_std_dev: f64,
    pub last_updated: HybridTimestamp,
    pub period_start: HybridTimestamp,
    pub period_end: HybridTimestamp,

}
Expand description

Behavioral baseline for anomaly detection. Captures “normal” patterns for an account.

Fields§

§id: Uuid

Baseline identifier

§account_id: u16

Account this baseline belongs to

§period_count: u16

Number of historical periods used

§_pad: u32

Padding

§mean: f64

Arithmetic mean

§median: f64

Median (50th percentile)

§std_dev: f64

Standard deviation

§mad: f64

Median Absolute Deviation (robust to outliers)

§q1: f64

First quartile (25th percentile)

§q3: f64

Third quartile (75th percentile)

§iqr: f64

Interquartile range (Q3 - Q1)

§min_value: f64

Minimum observed value

§max_value: f64

Maximum observed value

§p5: f64

5th percentile

§p95: f64

95th percentile

§skewness: f64

Skewness (0 = symmetric, >0 = right tail, <0 = left tail)

§kurtosis: f64

Kurtosis (3 = normal, >3 = heavy tails)

§avg_transaction_count: f64

Average transaction count per period

§transaction_count_std_dev: f64

Std dev of transaction counts

§last_updated: HybridTimestamp

When baseline was last computed

§period_start: HybridTimestamp

Start of baseline period

§period_end: HybridTimestamp

End of baseline period

Implementations§

Source§

impl BehavioralBaseline

Source

pub fn new(account_id: u16) -> Self

Create a new behavioral baseline for an account.

Source

pub fn z_score(&self, value: f64) -> f64

Compute z-score for a value.

Source

pub fn modified_z_score(&self, value: f64) -> f64

Compute modified z-score (robust, uses MAD).

Source

pub fn is_iqr_outlier(&self, value: f64) -> bool

Check if value is an IQR outlier.

Source

pub fn is_percentile_outlier(&self, value: f64) -> bool

Check if value is a percentile outlier.

Source

pub fn is_anomaly(&self, value: f64) -> (bool, f32)

Multi-method anomaly check.

Trait Implementations§

Source§

impl Archive for BehavioralBaseline
where Uuid: Archive, u16: Archive, u32: Archive, f64: Archive, HybridTimestamp: Archive,

Source§

type Archived = ArchivedBehavioralBaseline

The archived representation of this type. Read more
Source§

type Resolver = BehavioralBaselineResolver

The resolver for this type. It must contain all the additional information from serializing needed to make the archived type from the normal type.
Source§

unsafe fn resolve( &self, pos: usize, resolver: Self::Resolver, out: *mut Self::Archived, )

Creates the archived version of this value at the given position and writes it to the given output. Read more
Source§

impl Clone for BehavioralBaseline

Source§

fn clone(&self) -> BehavioralBaseline

Returns a duplicate of the value. Read more
1.0.0§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more
Source§

impl Debug for BehavioralBaseline

Source§

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more
Source§

impl<__D: Fallible + ?Sized> Deserialize<BehavioralBaseline, __D> for Archived<BehavioralBaseline>
where Uuid: Archive, Archived<Uuid>: Deserialize<Uuid, __D>, u16: Archive, Archived<u16>: Deserialize<u16, __D>, u32: Archive, Archived<u32>: Deserialize<u32, __D>, f64: Archive, Archived<f64>: Deserialize<f64, __D>, HybridTimestamp: Archive, Archived<HybridTimestamp>: Deserialize<HybridTimestamp, __D>,

Source§

fn deserialize( &self, deserializer: &mut __D, ) -> Result<BehavioralBaseline, __D::Error>

Deserializes using the given deserializer
Source§

impl<__S: Fallible + ?Sized> Serialize<__S> for BehavioralBaseline
where Uuid: Serialize<__S>, u16: Serialize<__S>, u32: Serialize<__S>, f64: Serialize<__S>, HybridTimestamp: Serialize<__S>,

Source§

fn serialize(&self, serializer: &mut __S) -> Result<Self::Resolver, __S::Error>

Writes the dependencies for the object and returns a resolver that can create the archived type.

Auto Trait Implementations§

Blanket Implementations§

§

impl<T> Any for T
where T: 'static + ?Sized,

§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> ArchivePointee for T

Source§

type ArchivedMetadata = ()

The archived version of the pointer metadata for this type.
Source§

fn pointer_metadata( _: &<T as ArchivePointee>::ArchivedMetadata, ) -> <T as Pointee>::Metadata

Converts some archived metadata to the pointer metadata for itself.
Source§

impl<T> ArchiveUnsized for T
where T: Archive,

Source§

type Archived = <T as Archive>::Archived

The archived counterpart of this type. Unlike Archive, it may be unsized. Read more
Source§

type MetadataResolver = ()

The resolver for the metadata of this type. Read more
Source§

unsafe fn resolve_metadata( &self, _: usize, _: <T as ArchiveUnsized>::MetadataResolver, _: *mut <<T as ArchiveUnsized>::Archived as ArchivePointee>::ArchivedMetadata, )

Creates the archived version of the metadata for this value at the given position and writes it to the given output. Read more
Source§

unsafe fn resolve_unsized( &self, from: usize, to: usize, resolver: Self::MetadataResolver, out: *mut RelPtr<Self::Archived, <isize as Archive>::Archived>, )

Resolves a relative pointer to this value with the given from and to and writes it to the given output. Read more
§

impl<T> Borrow<T> for T
where T: ?Sized,

§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
§

impl<T> BorrowMut<T> for T
where T: ?Sized,

§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
§

impl<T> CloneToUninit for T
where T: Clone,

§

unsafe fn clone_to_uninit(&self, dest: *mut u8)

🔬This is a nightly-only experimental API. (clone_to_uninit)
Performs copy-assignment from self to dest. Read more
Source§

impl<F, W, T, D> Deserialize<With<T, W>, D> for F
where W: DeserializeWith<F, T, D>, D: Fallible + ?Sized, F: ?Sized,

Source§

fn deserialize( &self, deserializer: &mut D, ) -> Result<With<T, W>, <D as Fallible>::Error>

Deserializes using the given deserializer
Source§

impl<T> Downcast for T
where T: Any,

Source§

fn into_any(self: Box<T>) -> Box<dyn Any>

Convert Box<dyn Trait> (where Trait: Downcast) to Box<dyn Any>. Box<dyn Any> can then be further downcast into Box<ConcreteType> where ConcreteType implements Trait.
Source§

fn into_any_rc(self: Rc<T>) -> Rc<dyn Any>

Convert Rc<Trait> (where Trait: Downcast) to Rc<Any>. Rc<Any> can then be further downcast into Rc<ConcreteType> where ConcreteType implements Trait.
Source§

fn as_any(&self) -> &(dyn Any + 'static)

Convert &Trait (where Trait: Downcast) to &Any. This is needed since Rust cannot generate &Any’s vtable from &Trait’s.
Source§

fn as_any_mut(&mut self) -> &mut (dyn Any + 'static)

Convert &mut Trait (where Trait: Downcast) to &Any. This is needed since Rust cannot generate &mut Any’s vtable from &mut Trait’s.
Source§

impl<T> DowncastSync for T
where T: Any + Send + Sync,

Source§

fn into_any_arc(self: Arc<T>) -> Arc<dyn Any + Send + Sync>

Convert Arc<Trait> (where Trait: Downcast) to Arc<Any>. Arc<Any> can then be further downcast into Arc<ConcreteType> where ConcreteType implements Trait.
§

impl<T> From<T> for T

§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T> Instrument for T

Source§

fn instrument(self, span: Span) -> Instrumented<Self>

Instruments this type with the provided Span, returning an Instrumented wrapper. Read more
Source§

fn in_current_span(self) -> Instrumented<Self>

Instruments this type with the current Span, returning an Instrumented wrapper. Read more
§

impl<T, U> Into<U> for T
where U: From<T>,

§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T> LayoutRaw for T

Source§

fn layout_raw(_: <T as Pointee>::Metadata) -> Result<Layout, LayoutError>

Gets the layout of the type.
Source§

impl<T> Pointee for T

Source§

type Metadata = ()

The type for metadata in pointers and references to Self.
Source§

impl<T> Same for T

Source§

type Output = T

Should always be Self
Source§

impl<T, S> SerializeUnsized<S> for T
where T: Serialize<S>, S: Serializer + ?Sized,

Source§

fn serialize_unsized( &self, serializer: &mut S, ) -> Result<usize, <S as Fallible>::Error>

Writes the object and returns the position of the archived type.
Source§

fn serialize_metadata(&self, _: &mut S) -> Result<(), <S as Fallible>::Error>

Serializes the metadata for the given type.
Source§

impl<SS, SP> SupersetOf<SS> for SP
where SS: SubsetOf<SP>,

Source§

fn to_subset(&self) -> Option<SS>

The inverse inclusion map: attempts to construct self from the equivalent element of its superset. Read more
Source§

fn is_in_subset(&self) -> bool

Checks if self is actually part of its subset T (and can be converted to it).
Source§

fn to_subset_unchecked(&self) -> SS

Use with care! Same as self.to_subset but without any property checks. Always succeeds.
Source§

fn from_subset(element: &SS) -> SP

The inclusion map: converts self to the equivalent element of its superset.
§

impl<T> ToOwned for T
where T: Clone,

§

type Owned = T

The resulting type after obtaining ownership.
§

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more
§

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more
§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

§

type Error = Infallible

The type returned in the event of a conversion error.
§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
Source§

impl<V, T> VZip<V> for T
where V: MultiLane<T>,

Source§

fn vzip(self) -> V

Source§

impl<T> WithSubscriber for T

Source§

fn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self>
where S: Into<Dispatch>,

Attaches the provided Subscriber to this type, returning a WithDispatch wrapper. Read more
Source§

fn with_current_subscriber(self) -> WithDispatch<Self>

Attaches the current default Subscriber to this type, returning a WithDispatch wrapper. Read more