CDN Traffic Anomaly Analysis

Overview

This skill analyzes CDN domain traffic anomalies by querying billing mode and corresponding traffic/bandwidth metrics. It automatically determines the appropriate metric based on the account's billing mode (bw_95, flux, combine_flux, bw, bw_peak), queries historical data over a configurable time range, establishes a 3-month baseline for comparison, and identifies potential traffic theft or abuse using both absolute thresholds and relative baseline deviation.

Key Features:

• Automatic billing mode detection and metric selection
• Support for all billing modes: bw_95, flux, combine_flux, bw, bw_peak
• Domain validation and traffic analysis
• 3-month baseline analysis — detects relative traffic surges against historical norms
• Dual-threshold anomaly detection — absolute thresholds + relative baseline comparison
• Three-tier conclusions: Normal / Watch (relative surge) / Anomalous (absolute threshold exceeded)
• Comprehensive analysis reports with baseline comparison and daily breakdowns

Tool: hcloud CLI (KooCLI)
Timestamp Tool: scripts/cdn_timestamp.py (built-in)
Analysis Scope: Past 7 days for current window (configurable); past 3 months for baseline
Core Principle: Query only the metric corresponding to the billing mode; use API capabilities efficiently to cover both current and baseline windows with minimal API calls