Beginning Anomaly Detection Using

 Pattern-Based  Anomalies

Pattern-based anomalies are patterns and trends that deviate from their historical 

counterparts. In the taxi cab example, the pickup counts for the month of April were 

pretty consistent with the rest of the year. However, once the polar vortex hit, the numbers 

tanked visibly, defining a huge drop in the graph that was labeled as an anomaly.

Similarly, when monitoring network traffic in the workplace, there are expected 

patterns of network traffic that are formed from constant monitoring of data over several 

months or even years for some companies. When an employee attempts to download 

or upload large volumes of data, it will generate a certain pattern in the overall network 

traffic flow that could be considered anomalous if it deviates from the employee’s usual 

behavior.

If an external hacker decided to DDOS the company’s website (

DDOS, or a 

distributed denial-of-service attack, is an attempt to overwhelm the server that handles 

network flow to a certain website in an attempt to bring the entire website down or 

stop its functionality), every single attempt would register as an unusual spike in 

network traffic. All of these spikes are clearly deviants from normal traffic and would be 

considered anomalous.