Anomaly detection is a behavioral defensive control, one of the detection methods a DDoS test is built to exercise before any filter can act. Instead of matching traffic against a list of known-bad patterns, it learns what normal looks like for a given service (the request rate, the protocol mix, the geographic spread, the ratio of new to returning clients) and flags traffic that departs from that learned baseline. The premise is simple: you cannot enumerate every attack in advance, but you can model normal and treat a large enough deviation from it as hostile.
How it learns normal
Anomaly detection builds a statistical model of baseline traffic over rolling time windows. It tracks features per window (requests per second, unique source counts, URI distribution, TCP flag ratios, DNS query entropy) and computes an expected range for each, often with an exponentially weighted moving average so the model follows daily and weekly seasonality rather than a fixed number.
When a live measurement falls outside the modeled range by more than a set number of standard deviations, the detector raises a signal. That signal is what a downstream control acts on: a rate limit tightens, a challenge is issued, or traffic is diverted to a scrubbing path. The detector itself usually enforces nothing. It decides that something is wrong.
Three levels of sophistication
Not every system that claims anomaly detection does the same thing, and the differences matter under attack. The simplest is a static threshold: alert if requests per second cross a fixed number. It is trivial to configure and trivial to evade, because a fixed ceiling has no notion of what is normal for a Tuesday at 3am versus a Friday at noon.
Above that sits adaptive statistical modeling: a moving average with a standard-deviation band that shifts with the daily and weekly cycle, so the same absolute rate can be normal at peak and anomalous at trough. The most involved approaches are unsupervised: clustering or density models that learn the joint distribution of many features at once and flag a point that is improbable across all of them, catching traffic that looks ordinary on any single axis but impossible in combination.
A test is indifferent to which one is deployed until it produces attack traffic that is normal on rate, normal on geography, and normal on user-agent, all at once. That is where a single-feature threshold waves it through and a joint model does not.
Sensitivity is a tax you pay in both directions
The one knob that matters is sensitivity, and it trades two errors against each other. Set the deviation threshold tight and the model flags ordinary surges (a product launch, a marketing email, a news mention) as attacks, driving the false-positive rate up and shedding real users.
Set it loose and a slow, careful attack stays inside the envelope. A low-and-slow attack is built to exploit exactly this: it raises load gradually enough that each window looks like plausible growth, and the baseline drifts to accommodate it. The model that adapts to seasonality also adapts to a patient adversary.
What a DDoS test actually measures
A test does not ask whether anomaly detection is enabled. It asks two questions the console cannot answer.
First, how long from the onset of a deviation to a raised signal: the detection latency, closely tied to mean time to detect. A model that averages over five-minute windows cannot flag a flood that saturates the origin in ninety seconds, no matter how sensitive its threshold.
Second, whether traffic engineered to look normal on every modeled feature still trips the detector, and whether an ordinary traffic spike does not. The gap between the moment a real attack becomes visible and the moment mitigation engages is pure exposure, and it is measurable.
Detection is the first link in the chain, and a chain that detects late fails late. Every stack claims to detect; the number that separates them is how long detection takes and how much legitimate traffic it burns to get there. For where detection sits inside a full defensive sequence, see DDoS resilience testing.