Anomaly Detection

I. Formal Definition

The continuous monitoring of cost and usage signals against a learned or declared baseline, with alerting on deviations that exceed a threshold of statistical or operational significance. Anomaly detection is a Tier-2 federation control: it is required for production workloads but is not by itself sufficient for accreditation. The federation expects detection latency, false-positive rate, and time-to-acknowledgement to be measured and published. An anomaly programme without these three operating metrics is treated as undocumented under UFMS-001:2.4.

II. Etymology

Term in academic statistics since the 1960s; widely adopted in observability and finops tooling in the late 2010s.

III. Federation Usage

Federation members must report anomaly detection coverage as a percentage of variable spend monitored. The federation floor is eighty percent of Tier-1 spend. Below this floor, accreditation evidence is incomplete and remediation is required under MEV-Annex:3.2.

IV. Related Terms

• budget-variance
• observability
• metrics
• showback

V. Authoritative Citations

• UFMS-001:2.4UFMS Article II - Detection Coverage
• MEV-Annex:3.2MEV Annex III - Detection Operating Metrics

VI. Citation in BibTeX

@misc{ifo4_glossary_anomaly_detection,
  title        = {{Anomaly Detection}},
  author       = {{IFO4 Federation Editorial Board}},
  howpublished = {{IFO4 Federation Glossary, slug \texttt{anomaly-detection}}},
  year         = {2026},
  url          = {https://ifo4.org/glossary/anomaly-detection},
  note         = {Category: FinOps; key: AnomalyDetection}
}

VII. Challenge This Definition

Federation members and accredited practitioners may challenge any entry under TGS-002:1.7. Filed challenges are routed to the editorial board, triaged into the revision register, and resolved in writing on the public docket. The slug remains stable through any revision.