Preserve First Detection Timestamp and Mitigate Historical Spike Bias in Anomaly Detection

Currently, Cloudability’s anomaly detection algorithm re-evaluates and regenerates anomalies for the previous seven days each time it runs. As a result, anomalies identified earlier may change or disappear over time as new cost data becomes available.

However, this approach introduces a potential limitation in scenarios where a significant cost spike occurs. A large historical spike can disproportionately influence the baseline, making the algorithm less sensitive to subsequent gradual cost increases. In such cases, a progressive upward trend—while potentially anomalous—may not be detected, or previously flagged anomalies may be removed due to the recalculation logic.

To improve the effectiveness and transparency of anomaly detection, I suggest the following enhancements:

1. Preserve the first occurrence of an anomaly

Even if anomalies are re-evaluated or later removed, the system should retain and display the initial timestamp when the anomaly was first detected. This provides better traceability and supports root cause analysis.

2. Reduce the influence of historical extreme spikes

The algorithm could introduce a decay factor or weighting adjustment for prior extreme spikes, ensuring that they do not overly distort future anomaly detection.

These improvements would help capture gradual cost increases more effectively and provide users with better visibility into anomaly evolution over time.