How much the incoming value deviates from the historical distribution.
Computed as 1 – average(similarity(incoming, historical[i])) over all
history entries where both values are present. 0.0 = identical to history;
1.0 = completely different.
Dot-notation path of the anomalous field (e.g. "canvas", "screen.width").
How stable this field was across the device's historical snapshots.
1.0 = never changed; 0.0 = always different between consecutive visits.
Normalised anomaly score: deviation / (1 – historicalStability + ε).
A value of 1.0 means the field changed by exactly as much as expected
from its own historical variance. Values above 1.5 are flagged as
suspicious. Values above 3.0 indicate a near-impossible change for a
field that has historically been fully stable.
Describes an anomalous change in a single fingerprint field relative to a device's historical baseline.