Anomaly detection uses an AI algorithm to identify unusual fluctuations in your spending. It provides automatic monitoring, detection, and alerting for unexpected costs, for timely insights into cost anomalies.
Enable anomaly detection
Anomaly detection is a free service provided "as-is" using algorithms to identify suspected usage anomalies. By using this feature, you acknowledge that detection may be inaccurate, incomplete, or delayed. Alibaba Cloud does not guarantee 100% stability and is not liable for any financial losses resulting from undetected anomalies or false alerts.
On the Anomaly Detection page, toggle Enable Detection.
After you enable detection, results are available the next day. Detection results appear only when an anomaly is found.
A management account can view anomaly detection results for member accounts within its organization. However, you can only view the results for one member account at a time.
Enabling detection or alerts applies only to the currently logged-in account. To use this feature for multiple accounts in an enterprise organization, you must enable it separately for each account.
Supported services
Set anomaly detection sensitivity
Click Detection Settings and drag the slider to adjust the sensitivity for anomaly detection. A higher sensitivity value makes the system more likely to detect an anomaly.
Cost Impact: The absolute difference between the actual cost and the boundary of the threshold.
Threshold: The range of normal cost fluctuations, calculated by the anomaly detection algorithm based on your set sensitivity and historical spending data. The shaded blue area in the cost trend chart represents this range.
NoteIf the actual cost falls within the threshold, the algorithm considers the fluctuation normal and does not report an anomaly. If the actual cost exceeds the upper or lower bounds of this range, the algorithm flags it as an anomaly.
The sensitivity setting affects the threshold. A higher sensitivity results in a narrower threshold, which makes detecting anomalies more likely.
Configure anomaly alerts
Toggle Enable Alerting to activate alerts. When a detected cost impact or severity level meets the configured threshold, the system automatically sends an alert notification.
Click Set Alert Threshold to configure alert thresholds and notification methods.
If you select Cost Impact as the Alert Condition, enter a specific cost amount as the threshold.
If you select Severity as the Alert Condition, you can choose Minor, Major, Critical, or Very Critical as the threshold. The definition of each severity level depends on the cost trend:
Severity
Definition
Minor
Major
Critical
Very Critical
Definition for an upward cost trend
Cost impact USD ≤ 20,
or cost impact ≤ 20% of the upper bound of the threshold
Cost impact USD > 20,
and 20% of the upper bound of the threshold < Cost impact ≤ 100% of the upper bound of the threshold
Cost impact USD > 20,
and 100% of the upper bound of the threshold < Cost impact ≤ 500% of the upper bound of the threshold
Cost impact USD > 20,
and cost impact > 500% of the upper bound of the threshold
Definition for a downward cost trend
Cost impact USD ≤ 20,
or cost impact ≤ 30% of the lower bound of the threshold
Cost impact USD > 20,
and 30% of the lower bound of the threshold < Cost impact ≤ 80% of the lower bound of the threshold
Cost impact USD > 20,
and cost impact > 80% of the lower bound of the threshold
-
Enable the alerting feature for critical anomalies: If you enable this option, you receive timely alerts for critical and very critical anomalies. Alerts can be sent as soon as 9 hours after the actual spending occurs. You cannot view the details of an anomaly on the same day it is detected; you can do so the next day on the details page.
Enabling early alerts for critical anomalies increases the frequency of alert notifications. If you find these notifications disruptive, disable this feature or reduce the number of recipients.
Evaluate detection results
When the system detects a cost anomaly, it displays the results in the Anomaly Details list.
In the Actions column, click View Details to see information such as the detection time, the affected product and account, and the cost trend before and after the anomaly. Click View Cost Analysis on an anomaly point to navigate to the Cost Analysis page and verify the detection result.
Provide feedback on the detection results to help train the algorithm. The more feedback you provide, the more accurate the detection becomes.
Accurate anomaly: This confirms that the detection identified a genuine business anomaly. The system will continue to flag similar patterns as anomalies.
Non-issue: This indicates the cost fluctuation was expected or had minimal impact.
False positive: This indicates the system's detection was incorrect and the event was not a real anomaly.
