Implement ML-based anomaly detection for device behavior monitoring

README.md

@@ -53,6 +53,13 @@ Interactive Chart.js visualizations showing compliance trends and deployment sta
 - **Dual Storage**: EF Core with SQL Server or file-based JSON storage
 - **Queue Processing**: Background service for Azure Queue consumption
 
+### 📈 Statistical Anomaly Detection
+- **Automatic Detection**: Background service runs hourly to identify unusual patterns
+- **Statistical Analysis**: Uses 2.5σ thresholds to detect anomalies in device behavior
+- **Multiple Detection Types**: Reporting frequency, deployment state, and inactivity anomalies
+- **Interactive Dashboard**: View, investigate, and resolve detected anomalies
+- **Severity Scoring**: Prioritized alerts (High/Medium/Low) for efficient triage
+
 ### 🔒 Enterprise Security
 - **Managed Identity**: Azure AD authentication for database and storage access
 - **Certificate-based Auth**: Client certificate authentication for Azure Queue
@@ -294,6 +301,7 @@ Comprehensive documentation is available in the [`docs/`](docs/) directory:
 - **[Device List Separation](docs/DEVICE_LIST_SEPARATION.md)** - UI reorganization details
 - **[Certificate Enumeration](docs/CERTIFICATE_ENUMERATION.md)** - UEFI certificate tracking
 - **[Logo & Banner Implementation](docs/LOGO_BANNER_IMPLEMENTATION.md)** - Branding assets
+- **[Anomaly Detection](docs/ANOMALY_DETECTION.md)** - ML-powered anomaly detection system
 
 ### Operations & Troubleshooting
 - **[Logging Guide](docs/LOGGING_GUIDE.md)** - Serilog configuration and best practices
@@ -493,7 +501,8 @@ For questions, issues, or support:
 ### v2.0 (Q3 2025)
 - [ ] Linux client support (.NET 8)
 - [ ] API v2 with GraphQL
-- [ ] Machine learning anomaly detection
+- [x] **Statistical anomaly detection** ✨ *Completed in Nov 2025*
+- [ ] **Machine learning anomaly detection (ML.NET)** *Planned for future release*
 - [ ] Integration with ServiceNow/Jira
 
 See [GitHub Projects](https://github.com/robgrame/Nimbus.BootCertWatcher/projects) for detailed roadmap.

SecureBootDashboard.Api.Tests/AnomalyDetectionServiceTests.cs

@@ -0,0 +1,221 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using Moq;
+using SecureBootDashboard.Api.Data;
+using SecureBootDashboard.Api.Services;
+using SecureBootWatcher.Shared.Models;
+using Xunit;
+
+namespace SecureBootDashboard.Api.Tests;
+
+public class AnomalyDetectionServiceTests
+{
+    private SecureBootDbContext CreateInMemoryContext()
+    {
+        var options = new DbContextOptionsBuilder<SecureBootDbContext>()
+            .UseInMemoryDatabase(databaseName: Guid.NewGuid().ToString())
+            .Options;
+
+        return new SecureBootDbContext(options);
+    }
+
+    [Fact]
+    public async Task DetectAnomaliesAsync_WithNoData_ReturnsEmptyList()
+    {
+        // Arrange
+        using var context = CreateInMemoryContext();
+        var logger = new Mock<ILogger<AnomalyDetectionService>>();
+        var service = new AnomalyDetectionService(context, logger.Object);
+
+        // Act
+        var result = await service.DetectAnomaliesAsync();
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Empty(result);
+    }
+
+    [Fact]
+    public async Task DetectAnomaliesAsync_WithInactiveDevice_DetectsInactivityAnomaly()
+    {
+        // Arrange
+        using var context = CreateInMemoryContext();
+        var deviceId = Guid.NewGuid();
+        var device = new DeviceEntity
+        {
+            Id = deviceId,
+            MachineName = "TestDevice",
+            LastSeenUtc = DateTimeOffset.UtcNow.AddDays(-20),
+            CreatedAtUtc = DateTimeOffset.UtcNow.AddDays(-30)
+        };
+
+        var report = new SecureBootReportEntity
+        {
+            Id = Guid.NewGuid(),
+            DeviceId = deviceId,
+            CreatedAtUtc = DateTimeOffset.UtcNow.AddDays(-20),
+            RegistryStateJson = "{}"
+        };
+
+        context.Devices.Add(device);
+        context.Reports.Add(report);
+        await context.SaveChangesAsync();
+
+        var logger = new Mock<ILogger<AnomalyDetectionService>>();
+        var service = new AnomalyDetectionService(context, logger.Object);
+
+        // Act
+        var result = await service.DetectAnomaliesAsync();
+
+        // Assert
+        Assert.NotEmpty(result);
+        Assert.Contains(result, a => a.Type == AnomalyType.DeviceBehavior);
+        Assert.Contains(result, a => a.DeviceId == deviceId);
+    }
+
+    [Fact]
+    public async Task DetectAnomaliesAsync_WithDeviceStuckInPending_DetectsDeploymentAnomaly()
+    {
+        // Arrange
+        using var context = CreateInMemoryContext();
+        var deviceId = Guid.NewGuid();
+        var device = new DeviceEntity
+        {
+            Id = deviceId,
+            MachineName = "TestDevice",
+            LastSeenUtc = DateTimeOffset.UtcNow,
+            CreatedAtUtc = DateTimeOffset.UtcNow.AddDays(-30)
+        };
+
+        // Add 4 reports with Pending state
+        for (int i = 0; i < 4; i++)
+        {
+            context.Reports.Add(new SecureBootReportEntity
+            {
+                Id = Guid.NewGuid(),
+                DeviceId = deviceId,
+                CreatedAtUtc = DateTimeOffset.UtcNow.AddDays(-i),
+                RegistryStateJson = "{}",
+                DeploymentState = "Pending"
+            });
+        }
+
+        context.Devices.Add(device);
+        await context.SaveChangesAsync();
+
+        var logger = new Mock<ILogger<AnomalyDetectionService>>();
+        var service = new AnomalyDetectionService(context, logger.Object);
+
+        // Act
+        var result = await service.DetectAnomaliesAsync();
+
+        // Assert
+        Assert.NotEmpty(result);
+        Assert.Contains(result, a => a.Type == AnomalyType.DeploymentState);
+        Assert.Contains(result, a => a.Description.Contains("Pending"));
+    }
+
+    [Fact]
+    public async Task GetActiveAnomaliesAsync_ReturnsOnlyActiveAnomalies()
+    {
+        // Arrange
+        using var context = CreateInMemoryContext();
+        var deviceId = Guid.NewGuid();
+        var device = new DeviceEntity
+        {
+            Id = deviceId,
+            MachineName = "TestDevice",
+            LastSeenUtc = DateTimeOffset.UtcNow,
+            CreatedAtUtc = DateTimeOffset.UtcNow
+        };
+
+        context.Devices.Add(device);
+
+        var activeAnomaly = new AnomalyEntity
+        {
+            Id = Guid.NewGuid(),
+            DeviceId = deviceId,
+            AnomalyType = "DeviceBehavior",
+            Description = "Test anomaly",
+            Severity = 0.5,
+            DetectedAtUtc = DateTimeOffset.UtcNow,
+            Status = "Active"
+        };
+
+        var resolvedAnomaly = new AnomalyEntity
+        {
+            Id = Guid.NewGuid(),
+            DeviceId = deviceId,
+            AnomalyType = "DeviceBehavior",
+            Description = "Resolved anomaly",
+            Severity = 0.5,
+            DetectedAtUtc = DateTimeOffset.UtcNow.AddDays(-1),
+            Status = "Resolved",
+            ResolvedBy = "Admin",
+            ResolvedAtUtc = DateTimeOffset.UtcNow
+        };
+
+        context.Anomalies.Add(activeAnomaly);
+        context.Anomalies.Add(resolvedAnomaly);
+        await context.SaveChangesAsync();
+
+        var logger = new Mock<ILogger<AnomalyDetectionService>>();
+        var service = new AnomalyDetectionService(context, logger.Object);
+
+        // Act
+        var result = await service.GetActiveAnomaliesAsync();
+
+        // Assert
+        Assert.Single(result);
+        Assert.Equal(activeAnomaly.Id, result[0].Id);
+        Assert.Equal(AnomalyStatus.Active, result[0].Status);
+    }
+
+    [Fact]
+    public async Task ResolveAnomalyAsync_UpdatesAnomalyStatus()
+    {
+        // Arrange
+        using var context = CreateInMemoryContext();
+        var deviceId = Guid.NewGuid();
+        var device = new DeviceEntity
+        {
+            Id = deviceId,
+            MachineName = "TestDevice",
+            LastSeenUtc = DateTimeOffset.UtcNow,
+            CreatedAtUtc = DateTimeOffset.UtcNow
+        };
+
+        context.Devices.Add(device);
+
+        var anomaly = new AnomalyEntity
+        {
+            Id = Guid.NewGuid(),
+            DeviceId = deviceId,
+            AnomalyType = "DeviceBehavior",
+            Description = "Test anomaly",
+            Severity = 0.5,
+            DetectedAtUtc = DateTimeOffset.UtcNow,
+            Status = "Active"
+        };
+
+        context.Anomalies.Add(anomaly);
+        await context.SaveChangesAsync();
+
+        var logger = new Mock<ILogger<AnomalyDetectionService>>();
+        var service = new AnomalyDetectionService(context, logger.Object);
+
+        // Act
+        await service.ResolveAnomalyAsync(anomaly.Id, "TestUser");
+
+        // Assert
+        var updatedAnomaly = await context.Anomalies.FindAsync(anomaly.Id);
+        Assert.NotNull(updatedAnomaly);
+        Assert.Equal("Resolved", updatedAnomaly.Status);
+        Assert.Equal("TestUser", updatedAnomaly.ResolvedBy);
+        Assert.NotNull(updatedAnomaly.ResolvedAtUtc);
+    }
+}

SecureBootDashboard.Api.Tests/SecureBootDashboard.Api.Tests.csproj

@@ -11,7 +11,9 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="9.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
+    <PackageReference Include="Moq" Version="4.20.72" />
     <PackageReference Include="xunit" Version="2.5.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.5.3" />
   </ItemGroup>

SecureBootDashboard.Api/Controllers/AnomaliesController.cs

@@ -0,0 +1,130 @@
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using SecureBootDashboard.Api.Services;
+using SecureBootWatcher.Shared.Models;
+
+namespace SecureBootDashboard.Api.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public sealed class AnomaliesController : ControllerBase
+    {
+        private readonly IAnomalyDetectionService _anomalyService;
+        private readonly ILogger<AnomaliesController> _logger;
+
+        public AnomaliesController(
+            IAnomalyDetectionService anomalyService,
+            ILogger<AnomaliesController> logger)
+        {
+            _anomalyService = anomalyService;
+            _logger = logger;
+        }
+
+        /// <summary>
+        /// Get all active anomalies
+        /// </summary>
+        [HttpGet]
+        [ProducesResponseType(typeof(IReadOnlyList<AnomalyDetectionResult>), 200)]
+        public async Task<IActionResult> GetActiveAnomaliesAsync(CancellationToken cancellationToken)
+        {
+            try
+            {
+                var anomalies = await _anomalyService.GetActiveAnomaliesAsync(cancellationToken);
+                return Ok(anomalies);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Error retrieving active anomalies");
+                return StatusCode(500, "Error retrieving anomalies");
+            }
+        }
+
+        /// <summary>
+        /// Get a specific anomaly by ID
+        /// </summary>
+        [HttpGet("{id:guid}")]
+        [ProducesResponseType(typeof(AnomalyDetectionResult), 200)]
+        [ProducesResponseType(404)]
+        public async Task<IActionResult> GetAnomalyAsync(Guid id, CancellationToken cancellationToken)
+        {
+            try
+            {
+                var anomaly = await _anomalyService.GetAnomalyAsync(id, cancellationToken);
+                if (anomaly == null)
+                {
+                    return NotFound();
+                }
+                return Ok(anomaly);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Error retrieving anomaly {AnomalyId}", id);
+                return StatusCode(500, "Error retrieving anomaly");
+            }
+        }
+
+        /// <summary>
+        /// Trigger manual anomaly detection scan
+        /// </summary>
+        [HttpPost("scan")]
+        [ProducesResponseType(typeof(IReadOnlyList<AnomalyDetectionResult>), 200)]
+        public async Task<IActionResult> TriggerScanAsync(CancellationToken cancellationToken)
+        {
+            try
+            {
+                _logger.LogInformation("Manual anomaly detection scan triggered");
+                var anomalies = await _anomalyService.DetectAnomaliesAsync(cancellationToken);
+                return Ok(anomalies);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Error during manual anomaly detection scan");
+                return StatusCode(500, "Error during anomaly detection");
+            }
+        }
+
+        /// <summary>
+        /// Resolve an anomaly
+        /// </summary>
+        [HttpPost("{id:guid}/resolve")]
+        [ProducesResponseType(204)]
+        [ProducesResponseType(400)]
+        [ProducesResponseType(404)]
+        public async Task<IActionResult> ResolveAnomalyAsync(
+            Guid id, 
+            [FromBody] ResolveAnomalyRequest request, 
+            CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrWhiteSpace(request.ResolvedBy))
+            {
+                return BadRequest(new { error = "ResolvedBy is required" });
+            }
+            if (request.ResolvedBy != null && request.ResolvedBy.Length > 256)
+            {
+                return BadRequest(new { error = "ResolvedBy must not exceed 256 characters" });
+            }
+            try
+            {
+                var anomaly = await _anomalyService.GetAnomalyAsync(id, cancellationToken);
+                if (anomaly == null)
+                {
+                    return NotFound();
+                }
+
+                await _anomalyService.ResolveAnomalyAsync(id, request.ResolvedBy, cancellationToken);
+                return NoContent();
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Error resolving anomaly {AnomalyId}", id);
+                return StatusCode(500, "Error resolving anomaly");
+            }
+        }
+
+        public sealed record ResolveAnomalyRequest(string? ResolvedBy);
+    }
+}