Anomaly Detection

Core Role

Implement intelligent anomaly detection:

• Statistical anomaly detection
• Pattern analysis
• Threshold monitoring
• Alert generation

---

Anomaly Detection Service

// lib/anomaly/service.ts
import prisma from '@/lib/prisma'
import { subDays, subHours, format } from 'date-fns'

export type AnomalyType =
  | 'UNUSUAL_VOLUME'
  | 'UNUSUAL_PATTERN'
  | 'THRESHOLD_BREACH'
  | 'TREND_CHANGE'
  | 'OUTLIER'

export type AnomalySeverity = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL'

export interface Anomaly {
  id: string
  type: AnomalyType
  severity: AnomalySeverity
  title: string
  description: string
  metric: string
  currentValue: number
  expectedValue: number
  deviation: number
  timestamp: Date
  data: Record<string, any>
  acknowledged: boolean
  acknowledgedBy?: number
  acknowledgedAt?: Date
}

export interface AnomalyRule {
  id: string
  name: string
  metric: string
  type: AnomalyType
  threshold?: number
  stdDevMultiplier?: number
  windowHours: number
  enabled: boolean
  severity: AnomalySeverity
}

// Default anomaly rules
const DEFAULT_RULES: AnomalyRule[] = [
  {
    id: 'request-volume-spike',
    name: 'Request Volume Spike',
    metric: 'request_count',
    type: 'UNUSUAL_VOLUME',
    stdDevMultiplier: 3,
    windowHours: 24,
    enabled: true,
    severity: 'MEDIUM'
  },
  {
    id: 'failed-login-spike',
    name: 'Failed Login Spike',
    metric: 'failed_logins',
    type: 'UNUSUAL_VOLUME',
    stdDevMultiplier: 4,
    windowHours: 1,
    enabled: true,
    severity: 'HIGH'
  },
  {
    id: 'stock-threshold',
    name: 'Low Stock Alert',
    metric: 'stock_level',
    type: 'THRESHOLD_BREACH',
    threshold: 10,
    windowHours: 1,
    enabled: true,
    severity: 'MEDIUM'
  },
  {
    id: 'after-hours-activity',
    name: 'After Hours Activity',
    metric: 'activity_count',
    type: 'UNUSUAL_PATTERN',
    stdDevMultiplier: 5,
    windowHours: 1,
    enabled: true,
    severity: 'LOW'
  }
]

// Detect anomalies based on rules
export async function detectAnomalies(): Promise<Anomaly[]> {
  const anomalies: Anomaly[] = []

  for (const rule of DEFAULT_RULES) {
    if (!rule.enabled) continue

    const detected = await applyRule(rule)
    anomalies.push(...detected)
  }

  // Save detected anomalies
  for (const anomaly of anomalies) {
    await saveAnomaly(anomaly)
  }

  return anomalies
}

// Apply anomaly detection rule
async function applyRule(rule: AnomalyRule): Promise<Anomaly[]> {
  const anomalies: Anomaly[] = []
  const now = new Date()
  const windowStart = subHours(now, rule.windowHours)

  switch (rule.metric) {
    case 'request_count':
      const requestAnomalies = await detectRequestVolumeAnomaly(rule, windowStart, now)
      anomalies.push(...requestAnomalies)
      break

    case 'failed_logins':
      const loginAnomalies = await detectFailedLoginAnomaly(rule, windowStart, now)
      anomalies.push(...loginAnomalies)
      break

    case 'stock_level':
      const stockAnomalies = await detectStockThresholdAnomaly(rule)
      anomalies.push(...stockAnomalies)
      break

    case 'activity_count':
      const activityAnomalies = await detectAfterHoursAnomaly(rule, windowStart, now)
      anomalies.push(...activityAnomalies)
      break
  }

  return anomalies
}

// Detect request volume anomaly
async function detectRequestVolumeAnomaly(
  rule: AnomalyRule,
  windowStart: Date,
  now: Date
): Promise<Anomaly[]> {
  // Get historical data (last 30 days)
  const historicalData: { date: string; count: number }[] = []

  for (let i = 30; i > 0; i--) {
    const dayStart = subDays(now, i)
    const dayEnd = subDays(now, i - 1)

    const count = await prisma.request.count({
      where: {
        createdAt: { gte: dayStart, lt: dayEnd }
      }
    })

    historicalData.push({
      date: format(dayStart, 'yyyy-MM-dd'),
      count
    })
  }

  // Calculate statistics
  const counts = historicalData.map(d => d.count)
  const mean = counts.reduce((a, b) => a + b, 0) / counts.length
  const variance = counts.reduce((sum, c) => sum + Math.pow(c - mean, 2), 0) / counts.length
  const stdDev = Math.sqrt(variance)

  // Get current period count
  const currentCount = await prisma.request.count({
    where: {
      createdAt: { gte: windowStart, lte: now }
    }
  })

  const threshold = mean + (rule.stdDevMultiplier || 3) * stdDev

  if (currentCount > threshold) {
    return [{
      id: `request-volume-${Date.now()}`,
      type: rule.type,
      severity: rule.severity,
      title: 'Unusual Request Volume Detected',
      description: `Request count (${currentCount}) exceeds expected threshold (${Math.round(threshold)})`,
      metric: rule.metric,
      currentValue: currentCount,
      expectedValue: Math.round(mean),
      deviation: (currentCount - mean) / stdDev,
      timestamp: now,
      data: { historicalData, mean, stdDev, threshold },
      acknowledged: false
    }]
  }

  return []
}

// Detect failed login anomaly
async function detectFailedLoginAnomaly(
  rule: AnomalyRule,
  windowStart: Date,
  now: Date
): Promise<Anomaly[]> {
  // Get failed login counts by user
  const failedLogins = await prisma.auditLog.groupBy({
    by: ['userId'],
    where: {
      action: 'LOGIN_FAILED',
      createdAt: { gte: windowStart, lte: now }
    },
    _count: { userId: true }
  })

  // Calculate baseline (average failed logins per hour)
  const totalHours = 24 * 7 // 7 days
  const historicalFailed = await prisma.auditLog.count({
    where: {
      action: 'LOGIN_FAILED',
      createdAt: { gte: subDays(now, 7), lt: now }
    }
  })

  const avgPerHour = historicalFailed / totalHours
  const threshold = avgPerHour * (rule.stdDevMultiplier || 4)

  const anomalies: Anomaly[] = []

  for (const login of failedLogins) {
    if (login._count.userId > threshold && login.userId) {
      const user = await prisma.user.findUnique({
        where: { id: login.userId },
        select: { name: true, email: true }
      })

      anomalies.push({
        id: `failed-login-${login.userId}-${Date.now()}`,
        type: rule.type,
        severity: 'HIGH',
        title: 'Suspicious Login Activity',
        description: `User ${user?.name || login.userId} has ${login._count.userId} failed login attempts`,
        metric: rule.metric,
        currentValue: login._count.userId,
        expectedValue: Math.round(avgPerHour),
        deviation: (login._count.userId - avgPerHour) / (avgPerHour || 1),
        timestamp: now,
        data: { userId: login.userId, userName: user?.name, userEmail: user?.email },
        acknowledged: false
      })
    }
  }

  return anomalies
}

// Detect stock threshold anomaly
async function detectStockThresholdAnomaly(
  rule: AnomalyRule
): Promise<Anomaly[]> {
  const lowStockItems = await prisma.stockLevel.findMany({
    where: {
      quantity: { lte: rule.threshold || 10 }
    },
    include: {
      item: { select: { id: true, name: true } },
      warehouse: { select: { id: true, name: true } }
    }
  })

  return lowStockItems.map(stock => ({
    id: `stock-${stock.id}-${Date.now()}`,
    type: 'THRESHOLD_BREACH' as AnomalyType,
    severity: stock.quantity === 0 ? 'CRITICAL' : 'MEDIUM' as AnomalySeverity,
    title: stock.quantity === 0 ? 'Out of Stock' : 'Low Stock Alert',
    description: `${stock.item.name} at ${stock.warehouse.name}: ${stock.quantity} remaining`,
    metric: rule.metric,
    currentValue: stock.quantity,
    expectedValue: rule.threshold || 10,
    deviation: ((rule.threshold || 10) - stock.quantity) / (rule.threshold || 10),
    timestamp: new Date(),
    data: {
      itemId: stock.itemId,
      warehouseId: stock.warehouseId,
      itemName: stock.item.name,
      warehouseName: stock.warehouse.name,
      minQuantity: stock.minQuantity
    },
    acknowledged: false
  }))
}

// Detect after-hours activity anomaly
async function detectAfterHoursAnomaly(
  rule: AnomalyRule,
  windowStart: Date,
  now: Date
): Promise<Anomaly[]> {
  const hour = now.getHours()

  // Define "after hours" as outside 8 AM - 6 PM
  if (hour >= 8 && hour < 18) {
    return []
  }

  // Get activity in current hour
  const currentActivity = await prisma.auditLog.count({
    where: {
      createdAt: { gte: windowStart, lte: now }
    }
  })

  // Get historical after-hours activity
  const afterHoursActivity = await prisma.$queryRaw<{ count: bigint }[]>`
    SELECT COUNT(*) as count
    FROM AuditLog
    WHERE createdAt >= datetime('now', '-30 days')
    AND (strftime('%H', createdAt) < '08' OR strftime('%H', createdAt) >= '18')
  `

  const historicalCount = Number(afterHoursActivity[0]?.count || 0)
  const avgPerHour = historicalCount / (30 * 10) // 30 days, ~10 after-hours per day

  const threshold = avgPerHour * (rule.stdDevMultiplier || 5)

  if (currentActivity > threshold) {
    return [{
      id: `after-hours-${Date.now()}`,
      type: rule.type,
      severity: rule.severity,
      title: 'Unusual After-Hours Activity',
      description: `${currentActivity} actions detected outside business hours`,
      metric: rule.metric,
      currentValue: currentActivity,
      expectedValue: Math.round(avgPerHour),
      deviation: (currentActivity - avgPerHour) / (avgPerHour || 1),
      timestamp: now,
      data: { hour, threshold },
      acknowledged: false
    }]
  }

  return []
}

// Save anomaly to database
async function saveAnomaly(anomaly: Anomaly): Promise<void> {
  // Check if similar anomaly already exists
  const existing = await prisma.anomaly.findFirst({
    where: {
      type: anomaly.type,
      metric: anomaly.metric,
      acknowledged: false,
      createdAt: { gte: subHours(new Date(), 24) }
    }
  })

  if (existing) return

  await prisma.anomaly.create({
    data: {
      type: anomaly.type,
      severity: anomaly.severity,
      title: anomaly.title,
      description: anomaly.description,
      metric: anomaly.metric,
      currentValue: anomaly.currentValue,
      expectedValue: anomaly.expectedValue,
      deviation: anomaly.deviation,
      data: JSON.stringify(anomaly.data),
      acknowledged: false
    }
  })
}

// Get active anomalies
export async function getActiveAnomalies(
  options: { limit?: number; severity?: AnomalySeverity } = {}
): Promise<Anomaly[]> {
  const anomalies = await prisma.anomaly.findMany({
    where: {
      acknowledged: false,
      ...(options.severity && { severity: options.severity })
    },
    orderBy: [
      { severity: 'desc' },
      { createdAt: 'desc' }
    ],
    take: options.limit || 20
  })

  return anomalies.map(a => ({
    id: a.id.toString(),
    type: a.type as AnomalyType,
    severity: a.severity as AnomalySeverity,
    title: a.title,
    description: a.description,
    metric: a.metric,
    currentValue: a.currentValue,
    expectedValue: a.expectedValue,
    deviation: a.deviation,
    timestamp: a.createdAt,
    data: JSON.parse(a.data || '{}'),
    acknowledged: a.acknowledged,
    acknowledgedBy: a.acknowledgedById || undefined,
    acknowledgedAt: a.acknowledgedAt || undefined
  }))
}

// Acknowledge anomaly
export async function acknowledgeAnomaly(
  anomalyId: number,
  userId: number,
  notes?: string
): Promise<void> {
  await prisma.anomaly.update({
    where: { id: anomalyId },
    data: {
      acknowledged: true,
      acknowledgedById: userId,
      acknowledgedAt: new Date(),
      notes
    }
  })
}

// Get anomaly statistics
export async function getAnomalyStats(): Promise<{
  total: number
  byType: Record<AnomalyType, number>
  bySeverity: Record<AnomalySeverity, number>
  acknowledged: number
  unacknowledged: number
  trend: Array<{ date: string; count: number }>
}> {
  const thirtyDaysAgo = subDays(new Date(), 30)

  const anomalies = await prisma.anomaly.findMany({
    where: {
      createdAt: { gte: thirtyDaysAgo }
    }
  })

  const byType: Record<AnomalyType, number> = {
    UNUSUAL_VOLUME: 0,
    UNUSUAL_PATTERN: 0,
    THRESHOLD_BREACH: 0,
    TREND_CHANGE: 0,
    OUTLIER: 0
  }

  const bySeverity: Record<AnomalySeverity, number> = {
    LOW: 0,
    MEDIUM: 0,
    HIGH: 0,
    CRITICAL: 0
  }

  let acknowledged = 0
  let unacknowledged = 0

  const trendMap: Record<string, number> = {}

  for (const anomaly of anomalies) {
    byType[anomaly.type as AnomalyType]++
    bySeverity[anomaly.severity as AnomalySeverity]++

    if (anomaly.acknowledged) {
      acknowledged++
    } else {
      unacknowledged++
    }

    const date = format(anomaly.createdAt, 'yyyy-MM-dd')
    trendMap[date] = (trendMap[date] || 0) + 1
  }

  const trend = Object.entries(trendMap)
    .map(([date, count]) => ({ date, count }))
    .sort((a, b) => a.date.localeCompare(b.date))

  return {
    total: anomalies.length,
    byType,
    bySeverity,
    acknowledged,
    unacknowledged,
    trend
  }
}

// Run scheduled anomaly detection
export async function runAnomalyDetection(): Promise<{
  detected: number
  anomalies: Anomaly[]
}> {
  const anomalies = await detectAnomalies()

  // Send alerts for critical anomalies
  const criticalAnomalies = anomalies.filter(a => a.severity === 'CRITICAL')

  for (const anomaly of criticalAnomalies) {
    await sendAnomalyAlert(anomaly)
  }

  return {
    detected: anomalies.length,
    anomalies
  }
}

// Send anomaly alert
async function sendAnomalyAlert(anomaly: Anomaly): Promise<void> {
  // Get admin users
  const admins = await prisma.user.findMany({
    where: {
      userRoles: {
        some: {
          role: { slug: { in: ['admin', 'superadmin'] } }
        }
      },
      status: 'ACTIVE'
    }
  })

  // Create notifications
  for (const admin of admins) {
    await prisma.notification.create({
      data: {
        userId: admin.id,
        type: 'ANOMALY',
        title: `🚨 ${anomaly.title}`,
        message: anomaly.description,
        data: JSON.stringify({
          anomalyId: anomaly.id,
          severity: anomaly.severity,
          type: anomaly.type
        }),
        read: false
      }
    })
  }
}