Behavioral anomaly detection
Behavioral anomaly detection flags sessions that deviate from learned patterns of normal use: impossible speed, inhuman input cadence, paths no legitimate user takes, or sudden population-level shifts. Fraud, abuse, bots, and breakage all surface as anomalies first, differing only in what the deviant sessions turn out to contain.
How it works
Detection models normality from the recorded population, per flow and per segment, then scores sessions against it; the interesting design choice is the feature layer, and event streams offer richer features than page logs, including inter-event timing, input rhythm, mouse trajectory shape, and mutation patterns, which separate automation from humans far more reliably than user agents do. The triage property is what distinguishes session-level detection from score-only systems: every flagged anomaly is a watchable recording, so the analyst's question "what is this actually" costs ninety seconds rather than a data pull. The same mechanism serves operations, since a release that breaks a flow makes the affected population anomalous immediately, often before error rates move.
Where you encounter it
Fraud and trust-and-safety tooling, bot detection, and release monitoring built on session data.