# Abnormal behavior of anomaly detection found - Elastic ML Stack

**URL:** <https://discuss.elastic.co/t/abnormal-behavior-of-anomaly-detection-found-elastic-ml-stack/317948>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [November 2, 2022, 6:07am UTC](https://discuss.elastic.co/t/abnormal-behavior-of-anomaly-detection-found-elastic-ml-stack/317948 "2022-11-02T06:07:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sreeja1](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@Sreeja1](https://discuss.elastic.co/u/Sreeja1)\
**Post date:** [November 2, 2022, 6:07am UTC](https://discuss.elastic.co/t/abnormal-behavior-of-anomaly-detection-found-elastic-ml-stack/317948/1 "2022-11-02T06:07:56Z")

</div>

Hi

I have created a multi metric Anomaly Detection Job with High Mean Response Time as detector, bucket span was 4h and Training data was for 1year.

![Picture1](https://us1.discourse-cdn.com/elastic/original/3X/2/0/200ba1b9c02161c16d099bde4a3bf56532d60690.png)

After a certain span the Upper Bound of the model has increased abruptly. Refer to the screenshot attached below:

![Picture2](https://us1.discourse-cdn.com/elastic/original/3X/7/4/74a106c9fe893b765124a8f7a394e471c18047d7.png)

_Can you help me to understand why this abrupt increase of upper bound happened?_

In the second row in the anomalies table (refer to the attached screenshot below) where Severity is 85 and it is having a high multi bucket effect there the typical value is abnormally high from the actual value. I observed that, this is happening for all the anomaly points which is having multi bucket effect, but the anomaly points without multi bucket effect is not showing any abnormal value. But in my data, I don’t have such abnormal value, the Maximum Response Time = 400 and Minimum Response Time = 0 in my time series.

![Picture3](https://us1.discourse-cdn.com/elastic/original/3X/1/2/121be5ca18d67a2c9fa4259f0bb575e98fe63497.png)

_It will be helpful if you can help me to understand why this typical value is so high? What do this Multi Bucket effect signifies? Does this Multi Bucket Effect has any correlation with the abnormally high typical value?_

_I would also like to know what is the difference between “High Mean Response Time” and “Mean Response Time” in the detector field of the anomaly job?_

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [November 3, 2022, 5:47pm UTC](https://discuss.elastic.co/t/abnormal-behavior-of-anomaly-detection-found-elastic-ml-stack/317948/2 "2022-11-03T17:47:34Z")

</div>

> [@Sreeja1](#):
>
> After a certain span the Upper Bound of the model has increased abruptly. Refer to the screenshot attached below:

To be clear - you're not looking at the model but the actual data. The data's behavior changed abruptly on or around April 30th. You should inspect what the text of Annotation #1 is telling you.

> _It will be helpful if you can help me to understand why this typical value is so high?_

The typical value is high in the second anomaly in the table because that is long after the data's behavior changed abruptly on or around April 30th.

> _Does this Multi Bucket Effect has any correlation with the abnormally high typical value?_

Not in this case, but you should understand what a Multi-bucket anomaly is: [Interpreting multi-bucket impact anomalies using Elastic machine learning features | Elastic Blog](https://www.elastic.co/blog/interpreting-multi-bucket-impact-anomalies-using-elastic-machine-learning-features)

> > _I would also like to know what is the difference between “High Mean Response Time” and “Mean Response Time” in the detector field of the anomaly job?_

The `high_mean` detector function only flags anomalies on the "high side" (i.e. spikes) of the mean of a field value. `mean` will do both (spikes and dips). If you have a multi-bucket anomaly, however, that can show up regardless of the use of a "one-sided" detector function. This is explained in the above blog.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2022, 5:48pm UTC](https://discuss.elastic.co/t/abnormal-behavior-of-anomaly-detection-found-elastic-ml-stack/317948/3 "2022-12-01T17:48:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.