All Products
Search

This Product

    Expenses and Costs:Anomaly detection

    Document Center

    Expenses and Costs:Anomaly detection

    Last Updated:May 15, 2026

    Anomaly detection uses an AI-powered algorithm to identify unusual cost fluctuations. It provides automatic monitoring, detection, and alerts for unexpected spending, helping you gain timely insights into cost anomalies.

    Enable detection

    Note

    The anomaly detection feature is free. It uses an algorithm to automatically identify suspected cost anomalies as you use cloud services. Note that this feature relies on algorithmic analysis, and its results are for reference only. Detection may be inaccurate, incomplete, or delayed. Alibaba Cloud is not liable for the cause of any anomaly or any resulting financial losses.

    On the Anomaly Detection > Anomaly Detection page, click Enable Detection.

    After you enable detection, results are available the following day. Results are displayed only when an anomaly is detected.

    image

    Note

    • A management account can view the detection results of member accounts within its organization.

    • For organizations with multiple accounts, you must enable this feature for each account individually.

    Supported products

    The anomaly detection feature supports the following products:

    Product code

    Product name

    ecs_intl

    ECS (pay-as-you-go)

    oss_intl

    Object Storage Service (OSS)

    slb_intl

    Server Load Balancer (SLB)

    yundisk_intl

    Elastic Block Storage (EBS) (pay-as-you-go)

    bards_intl

    ApsaraDB RDS (pay-as-you-go)

    eip_intl

    Elastic IP Address (EIP) (subscription)

    cbwp_intl

    Internet Shared Bandwidth (pay-as-you-go)

    vm_intl

    ECS (subscription)

    rords_intl

    ApsaraDB RDS read-only instance (pay-as-you-go)

    sls_intl

    Simple Log Service (SLS)

    vpn_flow_intl

    VPN Gateway

    nat_gw_intl

    NAT Gateway (pay-as-you-go)

    rds_intl

    ApsaraDB RDS (subscription)

    polardb_sub_intl

    ApsaraDB for PolarDB (subscription)

    kvstore_intl

    ApsaraDB for KVStore(Redis/Memcache)

    live_intl

    ApsaraVideo Live

    Note

    For subscription products, anomaly detection only supports their pay-as-you-go billable items.

    The Product Code is a product identifier. You can find it in your billing data.

    Set detection sensitivity

    Click Detection Settings and drag the slider to adjust the sensitivity for anomaly detection. A higher sensitivity makes the system more likely to detect an anomaly.image

    • Abnormal Cost: The absolute difference between the actual cost and the boundary of the threshold range.

    • Threshold: The expected range of normal cost fluctuations that the anomaly detection algorithm calculates based on your sensitivity settings and historical spending data. This range is represented by the blue shaded area in the cost trend chart.

      Note

      • If the actual cost falls within the threshold range, the algorithm considers the fluctuation normal and does not report an anomaly. If the actual cost exceeds the upper or lower bounds of the range, the algorithm flags it as an anomaly.

      • The threshold range is affected by the sensitivity setting. A higher sensitivity results in a narrower threshold range, making it easier to detect anomalies.

    Configure alerts

    Click Enable Alerting to activate the alerting feature. When a detected anomaly's cost impact or severity meets the configured threshold, the system automatically sends an alert.

    Click Set Alert Threshold to configure alert conditions and notification methods.

    image

    • If you select Cost Impact as the Alert Condition, you must enter a specific cost amount as the threshold.

    • If you select Severity as the Alert Condition, you can choose Minor, Major, Critical, or Very Critical as the threshold. The definition of each severity level varies based on the cost trend:

      Severity

      Minor

      Major

      Critical

      Very critical

      Definition for an upward cost trend

      cost impact ≤ 20 USD,

      or cost impact ≤ 20% of the upper bound of the threshold range

      cost impact > 20 USD,

      and 20% < cost impact ≤ 100% of the upper bound of the threshold range

      cost impact > 20 USD,

      and 100% < cost impact ≤ 500% of the upper bound of the threshold range

      cost impact > 20 USD,

      and cost impact > 500% of the upper bound of the threshold range

      Definition for a downward cost trend

      cost impact ≤ 20 USD,

      or cost impact ≤ 30% of the lower bound of the threshold range

      cost impact > 20 USD,

      and 30% < cost impact ≤ 80% of the lower bound of the threshold range

      cost impact > 20 USD,

      and cost impact > 80% of the lower bound of the threshold range

      -

    • Enable early alerts for severe anomalies: When enabled, the system provides more timely alerts for anomalies with a severity of Critical or Very Critical. Alerts can be sent as soon as nine hours after the cost is incurred. Anomaly details are not available on the day of detection. You can view them on the details page the following day.

      Enabling early alerts for severe anomalies increases notification frequency. If you find these notifications disruptive, you can disable this feature or reduce the number of recipients.

    Provide feedback on detection results

    When a cost anomaly is detected, the results are displayed in the Anomaly Details list.

    In the Actions column, click View Details to see information such as the detection time, the affected product and account, and the cost trend before and after the anomaly. Click View Cost Analysis on an anomaly point to go to the Cost Analysis page and verify the accuracy of the detection result.

    Provide feedback on the detection results to help train the algorithm. Your feedback improves detection accuracy over time.

    • Unexpected Exception: Confirms the system correctly identified a business anomaly. The system will continue to flag similar patterns.

    • Expected Fluctuation: The cost fluctuation was expected or had a minor impact. The system uses this feedback to improve detection accuracy.

    • False Positive: The system incorrectly flagged a normal cost fluctuation as an anomaly. The system uses this feedback to improve detection accuracy.

    image