Anomaly scoring before the baseline update
A single-page research infographic with the study context, methods, evidence and limitations. Why the ordering of an online anomaly detector changes its answer.
Download A2 poster (PDF)Research paper
This is a worked arithmetic example, not an anomaly benchmark or a fitted detector. This is one of four portfolio perspectives on the same paper.
The question
Should a new point help define the baseline used to score itself? Iterflow uses prior observations for its streaming z-score, so scoring precedes updating.
Worked result
The historical sequence 9, 10, 11, 10 has mean 10 and population variance 0.5. A new value of 14 receives z = (14 − 10) / √0.5 = 5.6569. If 14 enters the baseline first, the mean becomes 10.8 and variance 2.96, giving z ≈ 1.8600.
Practical reading
The score measures distance in units of historical standard deviation. It is not a probability or proof of a fault. Thresholds need to reflect the process, noise, and cost of false alarms.
Edge cases
The documented implementation yields NaN for its first two observations. A constant history has zero spread, so a production workflow must explicitly handle undefined or infinite scores. Missing values and nonstationary signals also require a deliberate policy.
Compare like with like
Both number lines use the same scale. Vertical markers show the mean, horizontal intervals span one standard deviation in each direction, and dots mark the same new value, 14. Including the point first reduces its score by about 67%. The intervals illustrate spread without assuming a normal distribution.
Source
Iterflow: Composable Streaming Statistics for JavaScript
Supporting source. Original visual explanation by Mathscapes. Research findings and illustrative calculations are identified above.