Anomaly detection uses artificial intelligence (AI) algorithms to identify cost fluctuations. This feature automatically monitors, detects, and sends alerts for unexpected costs, which helps you gain timely insights into cost anomalies.
Enable detection
Using the anomaly detection feature, you understand and agree to the following terms. Anomaly detection is a free service that uses algorithms to find suspected anomalies in your service usage. Alibaba Cloud cannot guarantee that this free feature is 100% stable. Issues such as inaccurate or incomplete detection or delayed alert notifications may occur. Alibaba Cloud is not responsible for the actual cause of any anomaly or any financial loss that results from it.
On the Anomaly Detection page in Expenses and Costs, click the Enable Detection button.
After you enable detection, the results are available the next day. The system shows results only when it detects an anomaly.
An administrator account can query the detection results of other member accounts in the organization. Currently, you can query the results for only one account at a time.
Enabling detection and alerts applies only to the current account. If your enterprise has multiple organizations with different accounts, you must enable this feature for each account separately.
List of supported products
Set detection sensitivity
Click Detection Settings. You can drag the slider to set the detection sensitivity. A higher sensitivity value makes it easier to detect anomalies.
Cost Impact: The absolute value of the difference between the actual cost and the boundary of the expected value range.
Expected Value Range: The range of normal fluctuations that the anomaly detection algorithm predicts based on your sensitivity settings and historical cost data. This range is shown as a blue shaded area in the cost trend chart.
NoteIf the actual cost is within the expected value range, the algorithm considers the fluctuation normal and does not report an anomaly. If the actual cost is outside the upper or lower boundary of the range, the algorithm considers the fluctuation too large and detects an anomaly.
The expected value range is affected by the sensitivity setting. The higher the sensitivity, the smaller the expected value range, which makes it easier to detect anomalies.
Set up alerts
Click the Enable Alerting button to turn on the alert feature. When the cost impact or severity of a detected anomaly meets the specified alert threshold, the system automatically sends an alert notification.
Click Alert Settings to set alert thresholds and notification methods.
If you set Alert Condition to Cost Impact, you can enter a cost amount as the threshold.
If you set Alert Condition to Severity, you can select Suspected, Minor, Severe, or Critical as the threshold. The following table defines the severity levels for different cost trends:
Severity
Suspected
Minor
Severe
Critical
Definitions for a rising cost trend
Cost impact ≤ 20 USD,
or cost impact ≤ 20% of the upper boundary of the expected value range
Cost impact > 20 USD,
and 20% of the upper boundary of the expected value range < Cost impact ≤ 100% of the upper boundary of the expected value range
Cost impact > 20 USD,
and 100% of the upper boundary of the expected value range < Cost impact ≤ 500% of the upper boundary of the expected value range
Cost impact > 20 USD,
and cost impact > 500% of the upper boundary of the expected value range
Definitions for a falling cost trend
Cost impact ≤ 20 USD,
or cost impact ≤ 30% of the lower boundary of the expected value range
Cost impact > 20 USD,
and 30% of the lower boundary of the expected value range < Cost impact ≤ 80% of the lower boundary of the expected value range
Cost impact > 20 USD,
and cost impact > 80% of the lower boundary of the expected value range
-
Enable early alerts for severe anomalies: When enabled, the system sends alerts for severe or critical anomalies more promptly. An alert can be sent as soon as 9 hours after the cost is incurred. You cannot view the details of an anomaly on the day it occurs. You must wait until the next day to view the details on the anomaly details page.
If you enable early alerts for severe anomalies, you will receive alert notifications more frequently. If you find these notifications disruptive, you can disable this feature or reduce the number of alert contacts.
Provide evaluation feedback
When a cost anomaly is detected, the result is displayed in the anomaly details.
In the Actions column, click View Details to see the detection time, the products and accounts involved, and the cost trend before and after the anomaly. You can click View Cost Analysis for an anomaly point to go to the Cost Analysis page and verify the accuracy of the detection result.
You can evaluate the detection results. Your feedback helps train the algorithm. The more feedback you provide, the more the detection accuracy improves.
Accurate Anomaly: The detection result is correct and reflects a real business anomaly. The system will continue to detect similar situations as anomalies.
Not An Issue: The fluctuation was expected or had a minor impact. The system will continue to improve its detection accuracy.
False Positive: The detection result is incorrect. It is a false positive and not a real anomaly. The system needs to improve its detection accuracy.
