Incident Detection with Dynamic Thresholds

This article discusses the number of incidents you can expect to observe when using Dynamic Thresholds for your validator.

The number of incidents created by the Dynamic Thresholds depends on the window size, sensitivity, and number of segments. As the window size decreases and sensitivity increases, the algorithm identifies more anomalies. This behavior reflects the trade-off between the granularity and the sensitivity of the detection process: Larger windows and lower sensitivity yield fewer incidents, while smaller windows and higher sensitivity result in a greater number of detected anomalies.

The following tables show the number of detected incidents you can expect the Dynamic Threshold to generate for the next 7-day period. You can use these numbers to estimate how many incidents you will receive from your validators depending on different windows, sensitivities, and number of segments.

Expected Number of Incidents (next 7 days)

Tumbling Window Type	Segments=100 Sensitivity=2	Segments=200 Sensitivity=2	Segments=500 Sensitivity=2	Segments=1500 Sensitivity=2
daily	0	1	2	6
hourly	9	18	44	133
10 minute	53	106	265	800
5 minute	106	212	531	1600

Tumbling Window Type	Segments=100 Sensitivity=4	Segments=200 Sensitivity=4	Segments=500 Sensitivity=4	Segments=1500 Sensitivity=4
daily	13	26	65	194
hourly	310	621	1 552	4 655
10 minute	1 862	3 724	9 309	27 928
5 minute	3 724	7 448	18 610	55 856

For more information, see About Validator Incidents and About Thresholds.