The execution of anomaly detection on counting the occurrence of things with respect to an entity's own history is clearly useful. But, as we introduced conceptually in Chapter 1, Machine Learning for IT, the idea of comparing the behavior of something against its peers is also informative, especially in cases where we assess the number of times something happens. Counting the occurrence of things across a population to find individual outliers has a variety of important use cases. Some of these use cases include the following:
- Finding machines that are logging more (or less) than similarly configured machines. Here are some example scenarios:
- Incorrect configuration changes that have caused more errors to suddenly occur in the log file for the system or application.
- A system that might be compromised by malware may actually be instructed...
