Struct BehavioralBaseline 

#[repr(C)]
pub struct BehavioralBaseline {

    pub id: Uuid,
    pub account_id: u16,
    pub period_count: u16,
    pub _pad: u32,
    pub mean: f64,
    pub median: f64,
    pub std_dev: f64,
    pub mad: f64,
    pub q1: f64,
    pub q3: f64,
    pub iqr: f64,
    pub min_value: f64,
    pub max_value: f64,
    pub p5: f64,
    pub p95: f64,
    pub skewness: f64,
    pub kurtosis: f64,
    pub avg_transaction_count: f64,
    pub transaction_count_std_dev: f64,
    pub last_updated: HybridTimestamp,
    pub period_start: HybridTimestamp,
    pub period_end: HybridTimestamp,
}

Behavioral baseline for anomaly detection. Captures “normal” patterns for an account.

Fields

id: Uuid

Baseline identifier

account_id: u16

Account this baseline belongs to

period_count: u16

Number of historical periods used

_pad: u32

Padding

mean: f64

Arithmetic mean

median: f64

Median (50th percentile)

std_dev: f64

Standard deviation

mad: f64

Median Absolute Deviation (robust to outliers)

q1: f64

First quartile (25th percentile)

q3: f64

Third quartile (75th percentile)

iqr: f64

Interquartile range (Q3 - Q1)

min_value: f64

Minimum observed value

max_value: f64

Maximum observed value

p5: f64

5th percentile

p95: f64

95th percentile

skewness: f64

Skewness (0 = symmetric, >0 = right tail, <0 = left tail)

kurtosis: f64

Kurtosis (3 = normal, >3 = heavy tails)

avg_transaction_count: f64

Average transaction count per period

transaction_count_std_dev: f64

Std dev of transaction counts

last_updated: HybridTimestamp

When baseline was last computed

period_start: HybridTimestamp

Start of baseline period

period_end: HybridTimestamp

End of baseline period

Implementations

impl BehavioralBaseline

pub fn new(account_id: u16) -> Self

Create a new behavioral baseline for an account.

pub fn z_score(&self, value: f64) -> f64

Compute z-score for a value.

pub fn modified_z_score(&self, value: f64) -> f64

Compute modified z-score (robust, uses MAD).

pub fn is_iqr_outlier(&self, value: f64) -> bool

Check if value is an IQR outlier.

pub fn is_percentile_outlier(&self, value: f64) -> bool

Check if value is a percentile outlier.

pub fn is_anomaly(&self, value: f64) -> (bool, f32)

Multi-method anomaly check.

Trait Implementations

impl Archive for BehavioralBaseline

where Uuid: Archive, u16: Archive, u32: Archive, f64: Archive, HybridTimestamp: Archive,

type Archived = ArchivedBehavioralBaseline

The archived representation of this type.

type Resolver = BehavioralBaselineResolver

The resolver for this type. It must contain all the additional information from serializing needed to make the archived type from the normal type.

unsafe fn resolve( &self, pos: usize, resolver: Self::Resolver, out: *mut Self::Archived, )

Creates the archived version of this value at the given position and writes it to the given output.

impl Clone for BehavioralBaseline

fn clone(&self) -> BehavioralBaseline

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for BehavioralBaseline

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<__D: Fallible + ?Sized> Deserialize<BehavioralBaseline, __D> for Archived<BehavioralBaseline>

where Uuid: Archive, Archived<Uuid>: Deserialize<Uuid, __D>, u16: Archive, Archived<u16>: Deserialize<u16, __D>, u32: Archive, Archived<u32>: Deserialize<u32, __D>, f64: Archive, Archived<f64>: Deserialize<f64, __D>, HybridTimestamp: Archive, Archived<HybridTimestamp>: Deserialize<HybridTimestamp, __D>,

fn deserialize( &self, deserializer: &mut __D, ) -> Result<BehavioralBaseline, __D::Error>

Deserializes using the given deserializer

impl<__S: Fallible + ?Sized> Serialize<__S> for BehavioralBaseline

where Uuid: Serialize<__S>, u16: Serialize<__S>, u32: Serialize<__S>, f64: Serialize<__S>, HybridTimestamp: Serialize<__S>,

fn serialize(&self, serializer: &mut __S) -> Result<Self::Resolver, __S::Error>

Writes the dependencies for the object and returns a resolver that can create the archived type.