Anomaly Detection Atlas: Behavior to Signals

I authored Anomaly Detection Atlas as one integrated research and reference project. It brings the foundations of my statistical-anomaly article into a maintained, cross-linked website that connects unusual behavior to measurable investigation hypotheses.

My contribution combines statistical concepts, ATT&CK-aligned activity, security log sources, illustrated explanations and detection-rule references. Worked examples expose the hypothesis, normalized fields, query, fixture observations and interpretation limits. Third-party incident reporting and MITRE material remain credited to their original publishers.

The Atlas helps reviewers examine the reasoning and telemetry behind a detection approach. Anomaly labels and ATT&CK mappings do not prove maliciousness or validated coverage. Synthetic demonstrations do not establish production accuracy; operational use needs local collection checks, baselines, testing and analyst review.

Project · Portfolio and validation