Advanced Analytics anomaly models: Z-score vs time series vs paired t-tests

Verdict: Use the Time series Z-score model for spikes over a sliding window. Use paired t-tests to compare the same devices before and after a change. Both Z-score models use mean and standard deviation; the population one uses a fixed dataset.

Criterion	Population Z-score	Time series Z-score	Paired t-tests	Threshold-based heuristic
Method	Mean and stddev over a fixed dataset	Mean and stddev over a sliding window	Compares paired observations	Flags a fixed value breach
When to use	Compare a device against the population	Spikes adapting to temporal patterns	Before vs after on the same devices	Simple fixed-threshold alerts

Rules

The Time series Z-score model detects anomalies in time-ordered data such as Stop Error Restarts, calculating mean and standard deviation over a sliding window so it adapts to temporal patterns.
Paired t-tests compare pairs of observations, for example Stop Error Restarts on the same device before and after a policy change or OS update.
Both the Population Z-score and Time series Z-score models calculate standard deviation and mean to flag outlier data points.

Traps

The Population Z-score model uses one fixed dataset mean and does not adapt across a sliding time window.
The threshold-based heuristic flags a fixed value; it does not compare paired before-and-after observations.