AI Behavioral Anomaly Detection

Agents drift. A tool that normally runs twice an hour suddenly runs two hundred times; a call pattern shifts. EVE detects these deviations with deterministic statistical detectors — rolling and robust z-score, EWMA, and CUSUM — against a window baseline, and summarizes behavior in signed monitoring envelopes.

The detectors

Rolling / robust z-score — flags values that deviate from the recent mean (robust variant resists outliers).
EWMA — exponentially weighted moving average catches gradual shifts.
CUSUM — cumulative-sum detection catches small, persistent changes that a single-point test would miss.
Signed monitoring envelopes — summarize agent behavior over a window, signed for later review.

Detectors are deterministic: the same series produces the same anomaly events.

Evidence example

anomaly event { detector: "cusum", z_score: 4.2, escalation: "review" }
monitoring envelope { window, summary, signature }

Readiness

Behavioral anomaly detection and signed monitoring envelopes are PILOT_READY, part of the pilot-validated core governance architecture (Python; embedded-service mode) and covered by the agent-governance test suite.

Limitations

Statistical detectors are advisory unless you wire a flagged anomaly to a deterministic enforcement action (for example, a BLOCK).
Monitoring is observational; enforcement decisions are made by CoreGuard, sequence, and budget controls, not by the detectors alone.
Detection quality depends on baseline configuration and window sizing for your workload.

Next step

Run monitoring in a pilot to establish baselines, then wire the anomalies that matter to an enforcement action.