A Comparative Analysis of Statistical Anomaly Detection Methods for Cloud Service Monitoring: A Simulation-Based Evaluation Framework

A Comparative Analysis of Statistical Anomaly Detection Methods for Cloud Service Monitoring: A Simulation-Based Evaluation Framework | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article A Comparative Analysis of Statistical Anomaly Detection Methods for Cloud Service Monitoring: A Simulation-Based Evaluation Framework Bhargav Nanekalva, Karthik Velou This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-6792432/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Cloud service reliability depends critically on effective anomaly detection in system metrics. This paper presents a comprehensive simulation-based evaluation framework for comparing statistical anomaly detection algorithms in cloud environments. We implement and evaluate four statistical detection methods (Z-Score, Modified Z-Score, EWMA, and Threshold-based) across four key cloud metrics (CPU usage, memory usage, network I/O, and response time) using five distinct anomaly patterns (spike, dip, level shift, trend change, and collective anomalies). Our experimental results reveal that Threshold-based detection achieves the highest overall F1-score (0.142), while Modified Z-Score detection demonstrates superior precision (0.209). The study provides empirical insights into algorithm performance trade-offs and introduces a reusable simulation framework for systematic evaluation of anomaly detection methods in cloud computing contexts. Anomaly Detection Cloud Computing Statistical Methods Performance Evaluation Time Series Analysis Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-6792432","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":465271066,"identity":"5247746a-7a9e-41ff-9e45-9f6fbad47475","order_by":0,"name":"Bhargav Nanekalva","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA9ElEQVRIiWNgGAWjYDAC9oYEhoQKCTl+9saGAww8ICHGBvxaeA48YEg4Y2Ms2XOw4cABorRIJD5gYGxLSzSYkcDAcIAYd8k7JCd+eMB2OMFA8nHj4Q8yDPL8DcxtD/BpMTxwLFkigedwnrl0IthhhjMOMLYb4NXS2JMgkSBxuNhyNkQL4wagOyXwamnm//wjweBw4oabEO/bE9Qiz8aQJpGQkJa44QYjWEsiQS0GPAxpFgkHQIEMdNgZHonkGYcJ2TL/QfLNn/9AUXn88YfKHhvb/vb2Z/htOYDMY+wBKmbGpx5kSwMK9wcB5aNgFIyCUTAiAQDGYlNG9brzzQAAAABJRU5ErkJggg==","orcid":"","institution":"Indian Institute of Technology Jodhpur","correspondingAuthor":true,"prefix":"","firstName":"Bhargav","middleName":"","lastName":"Nanekalva","suffix":""},{"id":465271067,"identity":"15193b52-e794-443b-8c08-aa376a705c2e","order_by":1,"name":"Karthik Velou","email":"","orcid":"","institution":"Indian Institute of Technology Jodhpur","correspondingAuthor":false,"prefix":"","firstName":"Karthik","middleName":"","lastName":"Velou","suffix":""}],"badges":[],"createdAt":"2025-05-31 18:08:13","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-6792432/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-6792432/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[],"financialInterests":"No competing interests reported.","formattedTitle":"A Comparative Analysis of Statistical Anomaly Detection Methods for Cloud Service Monitoring: A Simulation-Based Evaluation Framework","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":false,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Anomaly Detection, Cloud Computing, Statistical Methods, Performance Evaluation, Time Series Analysis","lastPublishedDoi":"10.21203/rs.3.rs-6792432/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-6792432/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Cloud service reliability depends critically on effective anomaly detection in system metrics. This paper presents a comprehensive simulation-based evaluation framework for comparing statistical anomaly detection algorithms in cloud environments. We implement and evaluate four statistical detection methods (Z-Score, Modified Z-Score, EWMA, and Threshold-based) across four key cloud metrics (CPU usage, memory usage, network I/O, and response time) using five distinct anomaly patterns (spike, dip, level shift, trend change, and collective anomalies). Our experimental results reveal that Threshold-based detection achieves the highest overall F1-score (0.142), while Modified Z-Score detection demonstrates superior precision (0.209). The study provides empirical insights into algorithm performance trade-offs and introduces a reusable simulation framework for systematic evaluation of anomaly detection methods in cloud computing contexts.","manuscriptTitle":"A Comparative Analysis of Statistical Anomaly Detection Methods for Cloud Service Monitoring: A Simulation-Based Evaluation Framework","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-06-03 05:34:24","doi":"10.21203/rs.3.rs-6792432/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"98e0c7cf-d028-4972-914c-bd30d75ec203","owner":[],"postedDate":"June 3rd, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2025-07-12T10:08:36+00:00","versionOfRecord":[],"versionCreatedAt":"2025-06-03 05:34:24","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-6792432","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-6792432","identity":"rs-6792432","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}