Live demo
15 series in. 4 alerts out.
A marketplace, 60 days of behavioural signals, 15 series across four acquisition channels. On day 45 a scripted ring started registering through one of them. No transaction is labelled, no rule matches, and the chargeback rate has not moved and will not for weeks. Find the attack.
Every number on this page is computed in your browser right now, by the same CUSUM and Bayesian changepoint code that runs in production. Nothing here is a screenshot.
The comparison that matters
Against the rule most teams actually ship
The standard configuration is a percentage or sigma threshold against a trailing mean, evaluated per metric. Run it over the exact same 15 series and count what lands in the channel.
The false-alarm count is not a judgement call. The incident was injected at a known index, so every naive alert before that index is wrong by construction.
What the engine found
Detection run
| Metric | Trend | Baseline | Now | Change | Confidence | Method |
|---|---|---|---|---|---|---|
Device reuse rate channel=affiliate-b | 3.41% | 14.8% | +334% | 99.9% | CUSUM | |
Velocity score channel=affiliate-b | 1.149 | 2.638 | +130% | 99.9% | CUSUM | |
Time to first transaction channel=affiliate-b | 614.59s | 215.00s | −65.0% | 99.9% | CUSUM | |
Session duration channel=affiliate-b | 213.84s | 94.14s | −56.0% | 99.9% | CUSUM |
Show your work
Device reuse rate · channel=affiliate-b
Baseline mean μ = 0.0131 and σ = 0.1560, both computed from the first two thirds of the day-over-day percentage changes. The slack k = 0.0780 is half a sigma, and the decision boundary h = 0.6240 is four. The accumulator runs on percentage changes rather than raw levels so a healthy growing series cannot drift across the boundary on its own.
alert if |Δ| > 2.5σ vs 7-day mean fired 3 times across this one metric, including 2 before anything was actually wrong. The statistical pipeline sent one message, on the day the regime actually changed.
What lands in Slack
One message, with the work already done
- 1.Step up verification on affiliate-b registrations from Aug 13 forward.
- 2.Pull the reused device fingerprints and check for a shared ASN or emulator signature.
- 3.Confirm with the affiliate team that no promotion or traffic-source change landed on Aug 13.
- 4.Label the flagged cohort now so the supervised model has training data before the chargebacks arrive.
The written cause is generated only after the statistics confirm the change. The model never decides whether something is an anomaly — it explains one that has already been established. Getting that order backwards is how these products hallucinate.