---
title: System-Wide Anomaly Score (SWAS)
url: https://www.emergentmind.com/topics/system-wide-anomaly-score-swas
type: topic
---

# System-Wide Anomaly Score (SWAS)

Searching arXiv for the cited paper and directly related anomaly-scoring work to ground the article.
System-Wide Anomaly Score (SWAS) denotes a scalar anomaly signal intended to summarize the state of an entire system rather than that of an individual component. In its most explicit formulation, SWAS is introduced for quickest change point detection in multi-entity, multivariate time series, where it aggregates per-entity deviations from normality into a single time-indexed score that can be monitored for persistent or abrupt system-wide behavioral shifts [2509.18310]. Closely related constructions appear in multi-sensor industrial monitoring, event-level anomaly detection, and calibrated nonparametric scoring, where the same underlying objective recurs: reduce distributed anomaly evidence to a single interpretable and thresholdable quantity [2504.15225], [0910.5461], [2105.14027].

## 1. Definition and problem class

In the formulation of "On Multi-entity, Multivariate Quickest Change Point Detection" [2509.18310], the observed data are a tensor
\[
\mathcal{X} \in \mathbb{R}^{F \times T \times P},
\]
where \(F\) is the number of sensors or variables, \(T\) is the number of time steps, and \(P\) is the number of entities. At time \(t\), entity \(p\) produces an \(F\)-dimensional observation vector
\[
X_{t,p} = [x_{1,t,p}, x_{2,t,p}, \dots, x_{F,t,p}] \in \mathbb{R}^F.
\]

The changes of interest are system-wide rather than purely local. The motivating examples in the paper include panic in a crowd and regime shifts in coupled oscillators, where the salient event is not a single outlier but a collective behavioral transition. SWAS is therefore defined as a scalar time series that summarizes, at each time step, how abnormal the entire system appears after aggregating the deviations of all entities from learned normal behavior [2509.18310].

A recurrent misconception is that SWAS names a single fixed formula. In the cited quickest-change framework this is not the case: SWAS is a family of system-level scores obtained from the same pool of per-entity anomaly values but aggregated with different statistics, including mean, variance, and a KDE-plus-Wasserstein construction [2509.18310]. This suggests that SWAS is better understood as a design pattern—system-level scalarization of distributed anomaly evidence—than as one canonical equation.

## 2. Construction from entity-level deviations

The central building block of SWAS in the multi-entity change-point framework is the Individual Deviation from Normality (IDfN) [2509.18310]. The data are first z-score normalized per sensor over all entities and times:
\[
x_{s,t,p} \leftarrow \frac{x_{s,t,p} - \mu_s}{\sigma_s},
\]
with
\[
\mu_s = \frac{1}{PT} \sum_{p=1}^{P} \sum_{t=1}^{T} x_{s,t,p}, 
\qquad
\sigma_s = \sqrt{\frac{1}{PT} \sum_{p=1}^{P} \sum_{t=1}^{T} (x_{s,t,p} - \mu_s)^2 }.
\]

To capture temporal dependence, each entity’s trajectory is segmented into overlapping windows of length \(w\) with stride \(1\):
\[
W^{(t)}_p = [X_{t-w+1,p}, X_{t-w+2,p}, \dots, X_{t,p}] \in \mathbb{R}^{F \times w},
\]
using replication padding for \(t < w\). A multivariate time series anomaly detection model is then trained only on normal data. The paper explicitly lists simple Autoencoder, TranAD, USAD, and OmniAnomaly as examples of such models [2509.18310].

Given reconstructed values \(\hat{x}_{s,t,p}\), the per-entity deviation score is the mean squared reconstruction error
\[
\mathrm{IDfN}_{t,p} = \frac{1}{F} \sum_{s=1}^{F} \left(\hat{x}_{s,t,p} - x_{s,t,p}\right)^2.
\]
For online applicability, only the current-time score within the sliding window is retained, a strategy described as “last-point” scoring [2509.18310].

At each time \(t\), SWAS aggregates the set \(\{\mathrm{IDfN}_{t,p}\}_{p=1}^P\). Three aggregation strategies are explored.

The mean-based SWAS is
\[
S_t^\mu = \frac{1}{P} \sum_{p=1}^{P} \mathrm{IDfN}_{t,p},
\]
which measures the central tendency of system deviation and rises when many entities deviate simultaneously.

The variance-based SWAS is
\[
S_t^{\sigma^2} = \frac{1}{P} \sum_{p=1}^{P} \left(\mathrm{IDfN}_{t,p} - S_t^\mu\right)^2,
\]
which measures heterogeneity across entities and is sensitive to subsets of entities changing earlier or more strongly than others.

The distributional version estimates a kernel density over entity-level deviations,
\[
\hat{f}_t(x) = \frac{1}{Ph} \sum_{p=1}^{P} K\!\left(\frac{x-\mathrm{IDfN}_{t,p}}{h}\right),
\]
with Gaussian kernel
\[
K(u)=\frac{1}{\sqrt{2\pi}} \exp\!\left(-\frac{u^2}{2}\right),
\]
and compares it with the reference density from normal training data,
\[
\hat{f}_{\mathrm{train}}(x) = \frac{1}{(PT)h} \sum_{t=1}^{T}\sum_{p=1}^{P} K\!\left(\frac{x-\mathrm{IDfN}^{\mathrm{train}}_{t,p}}{h}\right).
\]
The scalar score is then a Wasserstein-1 distance,
\[
f^{\mathrm{WD}}(t) = WD\big(\hat{f}_t,\hat{f}_{\mathrm{train}}\big).
\]

These constructions give SWAS three distinct semantics: aggregate deviation, aggregate dispersion, and distributional shift [2509.18310].

## 3. SWAS as a quickest change-point signal

In the cited framework, SWAS is not merely a descriptive statistic. It is the input to an online quickest change point detection pipeline [2509.18310]. Baseline quantities are estimated from normal training data:
\[
\mu_{\mathrm{train}} = \frac{1}{PT}\sum_{t=1}^{T}\sum_{p=1}^{P} \mathrm{IDfN}^{\mathrm{train}}_{t,p},
\]
\[
\sigma^2_{\mathrm{train}} = \frac{1}{PT}\sum_{t=1}^{T}\sum_{p=1}^{P}
\left(\mathrm{IDfN}^{\mathrm{train}}_{t,p} - \mu_{\mathrm{train}}\right)^2,
\]
together with the reference KDE \(\hat f_{\mathrm{train}}\).

Deviation scores are then defined as
\[
f^\mu(t)=|S_t^\mu-\mu_{\mathrm{train}}|,
\qquad
f^{\sigma^2}(t)=|S_t^{\sigma^2}-\sigma^2_{\mathrm{train}}|,
\qquad
f^{\mathrm{WD}}(t)=WD(\hat f_t,\hat f_{\mathrm{train}}).
\]
These are the quantities actually fed to CUSUM:
\[
C_t=
\begin{cases}
0, & t=0,\\
C_{t-1}+f^\alpha(t), & t\ge 1,
\end{cases}
\]
with \(\alpha \in \{\mu,\sigma^2,\mathrm{WD}\}\).

Thresholding is adaptive rather than fixed. The accumulated statistic is first log-transformed,
\[
\tilde C_i = \log(1+C_i),
\]
then a KDE is fit to past transformed CUSUM values,
\[
\hat p_{t-1}(x)=\frac{1}{(t-1)h}\sum_{i=1}^{t-1} K\!\left(\frac{x-\tilde C_i}{h}\right),
\]
and a change is declared if
\[
\hat p_{t-1}(\tilde C_t) < \delta,
\]
where \(\delta\) is chosen as an \(\alpha\)-quantile of density estimates computed from training CUSUM scores. The stopping rule is
\[
\hat t = \min\{t:\hat p_{t-1}(\tilde C_t)<\delta\}.
\]

The full pipeline is online: new observations arrive, windows are updated, reconstruction errors are computed, SWAS is aggregated, the deviation metric is updated, and CUSUM is checked in streaming mode. The paper also notes that mean and variance aggregation are \(O(P)\) per time step, whereas KDE-plus-Wasserstein is more computationally expensive; window size \(w\) trades off detection stability against latency, and \(w=50\) is reported as a good compromise on crowd data [2509.18310].

## 4. Related global-scoring formulations

Functionally equivalent system-level scores appear in several neighboring literatures, although the term SWAS is not always used explicitly.

| Setting | Aggregated evidence | Scalar score |
|---|---|---|
| Multi-entity qCPD | Per-entity IDfN values | Mean, variance, or Wasserstein-based SWAS |
| M\(^2\)AD | Per-sensor residual p-values | \(S_t = -2\sum_{k=1}^{d}\lambda_k \log p(e_t^k)\) |
| NN-graph anomaly detection | Neighborhood statistics of a test sample | \(\hat p_K(\eta)\) or \(\hat p_\epsilon(\eta)\) |
| Dark Machines | Event-level unsupervised detector output | Event anomaly score used to define signal regions |

In M\(^2\)AD, the asset-level global anomaly score
\[
S_t = -2 \sum_{k=1}^{d} \lambda_k \log p(e_t^k)
\]
aggregates sensor-wise p-values derived from residual models and is then Gamma-calibrated using training scores, with anomaly decisions made by thresholding either \(S_t\) directly or its calibrated tail probability [2504.15225]. This is structurally close to SWAS: heterogeneous local evidence is mapped to a single scalar through calibrated aggregation.

In nearest-neighbor-graph anomaly detection, the score
\[
\hat p_K(\eta)=\frac{1}{n}\sum_{i=1}^{n}\mathbb{I}_{\{R_S(\eta)\le R_S(x_i)\}}
\]
or its \(\epsilon\)-graph analogue estimates a multivariate p-value for the test sample and is thresholded at a desired false alarm level \(\alpha\) [0910.5461]. Here the global scalar is not built from multiple entities at a single time, but it serves the same role: a calibrated single-number summary of system atypicality.

In the Dark Machines challenge, each LHC event is assigned a scalar anomaly score by an unsupervised model, and model-independent signal regions are defined by thresholding this score event by event [2105.14027]. The paper also uses background-efficiency normalization when combining heterogeneous scores, effectively mapping them to a common operational scale before aggregation.

A plausible interpretation of MAD-EN is that a system-wide energy trace processed by a CNN can be converted into a scalar anomaly score through the model’s predicted probability of the anomalous classes, for example \(1-p(c_0\mid x)\), where \(c_0\) denotes the benign class [2206.00101]. Because this formulation is an interpretation rather than the paper’s explicit terminology, it is better viewed as an SWAS-like reading of energy-based security monitoring than as a canonical definition.

## 5. Calibration, stability, and semantic meaning

A technically useful SWAS is not defined solely by aggregation. It also depends on calibration, statistical stability, and the meaning attached to high scores.

Calibration takes several forms in the cited literature. The quickest-change framework calibrates via baseline statistics and an adaptive KDE threshold on transformed CUSUM values [2509.18310]. M\(^2\)AD calibrates via a fitted Gamma distribution on training-time global scores [2504.15225]. NN-graph methods produce scores that are asymptotically p-values under the nominal distribution [0910.5461]. Dark Machines normalize detector outputs to background survival probabilities before combining them [2105.14027]. These approaches differ operationally, but all turn raw anomaly evidence into thresholdable quantities with interpretable false-alarm behavior.

Stability is a separate issue. "COGNOS: Universal Enhancement for Time Series Anomaly Detection via Constrained Gaussian-Noise Optimization and Smoothing" argues that reconstruction-based methods’ reliance on MSE leads to statistically flawed residuals and noisy, unstable anomaly scores with poor signal-to-noise ratio; it proposes Gaussian-White Noise Regularization and a Kalman Smoothing Post-processor, reporting an average F-score uplift of \(57.9\%\) across \(12\) backbone models [2511.06894]. This suggests that any SWAS built on residuals inherits the statistical quality of those residuals.

Robustness to heterogeneous normal complexity is another recurrent concern. "Deep Generative Model using Unregularized Score for Anomaly Detection with Heterogeneous Complexity" shows that regularization terms in deep generative models can distort anomaly scores and proposes an unregularized score that is robust to inherent sample complexity [1807.05800]. In an SWAS context, this implies that aggregation can be misleading if local scores are biased upward for complex-but-normal subsystems.

Training procedures that reshape score distributions also matter. Batch uniformization was proposed to reduce disproportionately high anomaly scores for rare-normal sounds by minimizing a density-weighted average of per-sample scores in a mini-batch [1907.08338]. Score-guided networks, in turn, learn a scoring function that enlarges anomaly-score disparities between normal and abnormal data during training [2109.04684]. These results do not define SWAS directly, but they bear on a central requirement of any global score: local scores should be comparable before they are pooled.

Finally, severity and abnormality are not identical. MAD-Bench introduces Multilevel Anomaly Detection, where the anomaly score is expected to reflect severity rather than merely binary deviation from normal, and evaluates this using AUROC, C-index, and Kendall’s Tau-b [2411.14515]. A plausible implication is that a high-quality SWAS for operational systems may need to encode practical severity, not just statistical rarity.

## 6. Applications, limitations, and open questions

The clearest application of SWAS is online monitoring of collective dynamics. In the multi-entity qCPD setting, the method is evaluated on synthetic auto-regressive data, coupled Chen chaotic oscillators, and Unity crowd simulations, with the stated goal of detecting significant system-level changes in a scalable and privacy-preserving way [2509.18310]. The same scalarization logic appears in industrial asset monitoring, where global scores summarize evidence across heterogeneous sensors and systems [2504.15225]; in hardware security, where system-wide energy traces are used for anomaly detection [2206.00101]; and in collider physics, where event-level anomaly scores define model-independent signal regions [2105.14027].

Several limitations are explicit. In the multi-entity quickest-change framework, mean SWAS is strongest for collective shifts, whereas isolated anomalies may only weakly perturb the aggregate mean; variance and distributional SWAS are more sensitive to subset effects and tail changes, but the framework is tuned to detect sustained system-level shifts rather than sporadic spikes [2509.18310]. KDE-plus-Wasserstein aggregation is computationally more expensive than mean or variance. Performance depends on the quality of normal training data, and concept drift in normal behavior is an implicit challenge [2509.18310].

A second limitation concerns semantic interpretation. A scalar global score can be statistically well calibrated while still being poorly aligned with operational importance. MAD-Bench shows that models with strong binary anomaly detection can differ materially in severity alignment, and that area-based bias can inflate scores for visually large anomalies even when practical severity is defined differently [2411.14515]. This suggests that SWAS should not automatically be equated with risk without explicit validation.

A third issue is representational mismatch. The multi-entity qCPD paper states that, to the best of the authors’ knowledge, there was no publicly available dataset explicitly designed to evaluate change point detection in complex collective and interactive systems of the required type, motivating the introduction of Unity crowd-simulation and coupled nonlinear oscillator datasets [2509.18310]. Broader SWAS research therefore remains constrained by dataset design: the meaning of “system-wide” depends on whether the data expose interacting entities, correlated sensors, or merely pooled features.

The term SWAS is used explicitly in multi-entity quickest change point detection, but the underlying idea spans a wider technical landscape. Across these settings, the central principle is stable: a system-wide anomaly score is a scalar reduction of distributed anomaly evidence, useful only insofar as the local evidence is well modeled, the aggregation is aligned with the system’s structure, and the resulting score is properly calibrated for the operational decision it is meant to support.

Source: https://www.emergentmind.com/topics/system-wide-anomaly-score-swas