Training

The deployed Gaussian mixture and deep autoencoder models were fitted on requests recorded from August 2025 through February 2026. Each request is represented by features describing account and source address history, endpoint rarity, response patterns and recent request bursts. For example, a successful response for a resource that an account was previously denied contributes to its anomaly score.

Benchmarks

Average precision summarizes precision and recall across score thresholds; higher values indicate better separation of the annotated requests. Recall@50 counts how many of the 22 annotated requests appear in the first 50 results. The 95% intervals were estimated from 1,000 bootstrap samples. These results describe one annotated incident, and the overlapping intervals for GMM and the deep ensemble do not demonstrate a clear performance difference.

The benchmark compares how effectively each method ranks unusual requests in the challenge dataset. Models were fitted on traffic from August 2025 through January 2026, with settings selected using simulated anomalies in February. March traffic was reserved for evaluation against 22 manually annotated requests, including two contextual records.

The table shows the research comparison used to assess the detection methods. The deployed models were subsequently fitted on the full history from August 2025 through February 2026. CTX uses contextual features from earlier account behavior; RAW uses the access log fields directly.