Real-Time Endpoint Anomaly Detection Using Adaptive Statistical Methods for Baseline Deviations

Real-time anomaly detection is an important part of endpoint security, which offers a promising alternative to traditional security and monitoring methods. This paper introduces a framework based on adaptive statistical methods for real-time endpoint anomaly detection and investigates six different statistical methods and their effectiveness in detecting anomalies in three anomaly scenarios. The framework approach is based on collecting detailed telemetry metrics that include major endpoint metrics categories such as CPU usage, network activity, disk operations to establish a baseline of normal behavior. Deviations from this baseline are flagged as anomalies. Methods are tested using hyperparameter optimization and evaluated using performance metrics such as F1-score, accuracy, and precision. This study demonstrates the potential of statistical methods for scalable, interpretable, and efficient anomaly detection in endpoint security.