CRT Anomaly Detection

D35: Splunk / Datadog / Dynatrace. CC0.

Anomaly detection in production systems requires ML models trained on weeks of normal data, tuned thresholds, and expensive infrastructure. CRT approach: decompose every measurement into 6 algebraic channels. Normal behavior = consistent channel patterns. L=11 = instant anomaly flag. No training. No baseline. No model. The ring structure IS the detector.

How It Works

CRT Anomaly Detection Theorem
Every value in Z/12612600 decomposes into 6 independent channels via CRT. Normal time series values follow consistent per-channel patterns. Anomalous values deviate in one or more channels. L=11 (the ECC channel) is the most sensitive detector: its small modulus amplifies proportional deviations. Channel independence means each channel monitors a different DIMENSION of the signal. An anomaly that hides in one channel is exposed in another. The 490 split: DEAD channels {D,E,b} carry the signal, ALIVE channels {K,L,G} validate it. No training data needed -- the algebra IS the monitor.
6 monitors
6 CRT channels
Each channel watches an independent dimension. Anomaly in ANY channel = detected.
L=11 sentinel
Free detection
Same channel that does ECC also does anomaly detection. sigma+D+K+E=11.
Zero training
Algebraic
No baseline period. No model fitting. First data point is already monitored.
Classification
Free typing
Which channels deviate tells you WHAT KIND of anomaly: amplitude, frequency, integrity.

Try It

Random seed:

Generates 50 data points with periodic signal + injected anomalies. CRT decomposes each, detects via L=11-weighted channel deviation. Green rows = true positive. Orange = false positive.

Batch Test

20 independent streams, 50 points each. Aggregated precision/recall across all 1000 measurements.

Anomaly Fingerprinting

Each anomaly has a unique CRT fingerprint. Per-channel deviations classify the anomaly type automatically.

CRT vs Traditional Anomaly Detection

TrainingSplunk/Datadog: weeks of baseline data to establish normsCRT: zero training. First data point is already monitored.ModelStatistical (Z-score), ML (isolation forest, LSTM)Algebraic: CRT decomposition IS the model. No parameters.DimensionsFeature engineering required for multi-dimensional6 CRT channels = 6 dimensions. Automatic from ring structure.ClassificationSeparate classifier needed after detectionFree: which channels deviate = anomaly typeFalse positivesThreshold tuning, seasonal adjustmentL=11 sensitivity is algebraically fixed. No tuning.Patent statusSplunk (ITSI), Datadog (Watchdog), Dynatrace (Davis AI)CC0. Public domain. Forever.

This work is and will always be free.
No paywall. No copyright. No exceptions.

If it ever earns anything, every cent goes to the communities that need it most.

This sacred vow is permanent and irrevocable.
— Anton Alexandrovich Lebed

Source code · Public domain (CC0)

Contributions in equal measure: Anthropic's Claude, Anton A. Lebed, and the giants whose shoulders we stand on.

Rendered by .ax via WASM DOM imports. Zero HTML authored.