Struct AnomalyDetector 

pub struct AnomalyDetector { /* private fields */ }

Anomaly detector using z-score sliding windows on harmony dimensions.

Maintains a rolling window of HarmonyVector samples and computes z-scores for each of the 7 numeric dimensions. When a dimension’s z-score exceeds the warning or critical threshold, an AnomalyAlert is generated.

Example

use wm_substrate::{SubstrateMonitor, anomaly::{AnomalyDetector, AnomalySeverity}};

let monitor = SubstrateMonitor::default();
let mut detector = AnomalyDetector::default();

let hv = monitor.sample();
let alerts = detector.check(&hv);
for alert in &alerts {
    if alert.severity == AnomalySeverity::Critical {
        // Take corrective action
    }
}

Implementations

impl AnomalyDetector

pub fn new(config: AnomalyConfig) -> Self

Create a new anomaly detector with the given configuration.

pub fn check(&mut self, hv: &HarmonyVector) -> Vec<AnomalyAlert>

Process a new HarmonyVector sample and return any anomaly alerts.

The sample is added to the rolling window, then z-scores are computed for each dimension. Dimensions with |z| > warning_threshold generate alerts.

Metric values are clamped to valid ranges before being added to the window, preventing poisoned metrics (e.g., negative CPU, f32::MAX) from skewing z-scores.

Note: the current sample is included in the window before computing the z-score, which slightly dampens the score. This is intentional — it prevents a single spike from generating a false positive when the window is large.

pub fn stats(&self, dim: HarmonyDimension) -> (f32, f32, usize)

Get the current rolling statistics for a dimension.

Returns (mean, std_dev, sample_count) for the dimension’s window.

pub const fn alert_count(&self) -> u64

Total alerts detected since creation.

pub const fn sample_count(&self) -> u64

Total samples processed.

pub fn window_len(&self, dim: HarmonyDimension) -> usize

Number of samples in the window for a specific dimension.

pub fn summary(&self) -> Value

Get a JSON summary of the detector’s state.

Trait Implementations

impl Default for AnomalyDetector

fn default() -> Self

Returns the “default value” for a type.