What is Anomaly Detection?
Anomaly detection is the identification of patterns in data that deviate significantly from expected behavior — used in crypto security to flag suspicious transactions, unusual agent behavior, and potential compromises in real-time.
WHY IT MATTERS
Fixed rules catch known threats. Anomaly detection catches unknown ones. If an agent normally makes 5-10 transactions per hour and suddenly starts making 100, that's anomalous regardless of whether each individual transaction passes policy checks.
Approaches include statistical (transactions outside normal distributions), machine learning (models trained on historical behavior), rule-based (velocity checks, time-based patterns), and comparative (this agent vs. fleet baseline). Each catches different types of anomalies.
For agent wallets, anomalies worth detecting include: spending velocity changes, new recipient addresses, unusual token interactions, gas price anomalies (suggesting unusual contract calls), and temporal patterns (activity outside normal hours).
HOW POLICYLAYER USES THIS
PolicyLayer uses anomaly detection to identify unusual agent spending patterns — sudden velocity increases, new recipients, or amounts that deviate from historical norms. Anomalies trigger alerts and can automatically pause agent spending for review.