Anomaly Detection
What Anomaly Detection Does
Anomaly detection is Repute’s first line of defense against manufactured signals. It identifies behavioral patterns that deviate from organic baselines and flags them for downstream model processing — either as inputs to TRI (risk) or as penalties to SIS (integrity).
Anomaly detection runs continuously on all monitored channels. Detected anomalies are not immediately deterministic — they are weighted evidence that feeds into the probabilistic model outputs.
Pattern Deviation Detection
Pattern deviation detection compares a channel’s current behavioral metrics against its established historical baseline and flags statistically significant deviations.
Method
For each metric M and channel C:
AnomalyScore_M = |CurrentValue_M − BaselineMean_M| / BaselineStdDev_MIf AnomalyScore_M exceeds the threshold (typically 2.5–3.0 standard deviations), the metric is flagged as anomalous.
What Gets Flagged
- Subscriber count change exceeding 3σ from 30-day daily delta distribution
- View count per message exceeding 3σ from 30-day message view distribution
- Reaction count exceeding 2.5σ from baseline reaction patterns
- Message frequency exceeding 3σ from baseline posting cadence
- Forward rate exceeding 3σ from baseline forward distribution
Symmetry Spike Detection
Symmetrical join spikes are the strongest single indicator of bot deployment. Human organic growth is structurally asymmetric — it builds gradually and tapers irregularly. Bot-driven joins are symmetric because bots execute join operations in programmatically regular batches.
Symmetry Analysis
For a join event window W, symmetry is computed as:
SymmetryScore = 1 − (|JoinsInFirstHalf − JoinsInSecondHalf| / TotalJoins)A SymmetryScore near 1.0 indicates near-perfect symmetry — the joins are distributed evenly across the window, which is highly atypical of organic behavior.
| SymmetryScore | Interpretation |
|---|---|
| > 0.85 | High symmetry — strong bot signal |
| 0.60–0.85 | Moderate symmetry — mixed or partially organic |
| < 0.60 | Low symmetry — consistent with organic growth patterns |
A high SymmetryScore alone is not a definitive verdict. Some organic events (large announcements, viral posts) can produce temporarily symmetric join patterns. Symmetry is evaluated in context with other signals.
Engagement Imbalance Detection
Engagement imbalance detects when the ratio of high-effort engagement (text replies, thread participation) to low-effort engagement (emoji reactions, views) falls outside organic norms.
Engagement Depth Ratio
EngagementDepthRatio = TextReplies / (EmojiReactions + ViewCount × ReactionWeight)Organic channels maintain an EngagementDepthRatio above a minimum threshold. Channels dominated by bots or coordinated fake engagement have ratios near zero because bots primarily generate views and emoji reactions, not substantive text replies.
Temporal Engagement Clustering
Engagement from organic humans follows the temporal patterns of human attention — peaks at certain times of day, gaps during sleep hours, gradual spread across a posting window. Bot engagement clusters at fixed intervals regardless of time of day.
Temporal clustering is detected by computing the inter-event time distribution of engagement events. Bot-driven engagement produces a bimodal or spike distribution; organic engagement produces a smoother, more irregular distribution.
Anomaly Aggregation
Individual anomaly signals are aggregated into the channel-level anomaly score A that feeds into SIS:
A = Σ(AnomalyWeight_i × AnomalyPresent_i)Where each detected anomaly type is assigned a weight based on its historical correlation with structural fragility. Symmetrical spikes carry the highest weight. Single-metric deviations carry lower weight.
The aggregated A score directly reduces SIS through the −δA term in the SIS formula.