How Avo Intelligence Detects Anomalies Across 37,000+ Symbols

Scanning tens of thousands of symbols for statistically meaningful deviations in real time. This is a non-trivial engineering and statistics problem. Most systems either cast too wide a net (surfacing hundreds of useless alerts) or tune so tightly that they miss the signals that matter. This post walks through how Avo Intelligence approaches anomaly detection at scale.

What Makes a Signal “Novel”?

The word “anomaly” is overloaded. In the Avo Intelligence framework, a signal is anomalous if and only if it is novelrelative to the symbol's own history. A 3% daily move in a normally quiet stock is an anomaly. The same 3% move in a crypto token with 8% average daily range is not.

This distinction matters enormously at scale. Naive z-score thresholding applied uniformly across asset classes would produce a signal list dominated by high-volatility crypto assets, burying the genuinely interesting equity signals beneath noise. Instead, Avo Intelligence normalizes each signal against that symbol's own empirical distribution.

The Detection Pipeline

Avo Intelligence uses a multi-test approach. No single statistical test is sufficient across asset classes and timeframes, so the pipeline layers several complementary methods:

Mahalanobis Distance

For each symbol, Avo Intelligence maintains a rolling feature vector that includes returns, normalized volume, intraday range, and momentum components. The Mahalanobis distance measures how far the current observation sits from the center of the historical distribution, accounting for correlations between features. Unlike raw Euclidean distance, Mahalanobis distance correctly identifies when volume and price move together in an unusual way, even if neither alone is extreme.

Kolmogorov-Smirnov (KS) Tests

The KS test compares the distribution of returns over a short lookback window (5 days) against the long-run empirical distribution. A significant KS statistic signals that the recent distribution has structurally shifted, not just that one data point is extreme. This catches sustained behavioral changes, like a stock quietly entering accumulation phase before a breakout.

Volume Divergence

Many of the most important price anomalies are preceded or confirmed by volume anomalies. Avo Intelligence maintains separate volume models and flags cases where volume deviates from price action in historically unusual ways. For instance, a large price move on abnormally low volume (often reverses) versus the same move on a volume spike (often continues).

Avoiding False Positives at Scale

Running three statistical tests across 37,000+ symbols daily would, by random chance alone, produce hundreds of spurious alerts. Avo Intelligence handles this in two ways.

First, multiple testing correction. Signals are scored and ranked, and a Benjamini- Hochberg false discovery rate correction is applied to the full universe before any alert is surfaced. This controls the expected proportion of false positives in the output list to under 5%.

Second, cross-market confirmation. An anomaly in a single symbol that has no correlation with movements in related symbols is more likely to be noise or data error. Avo Intelligence checks whether the anomaly is idiosyncratic or part of a broader pattern across the sector, market cap tier, or asset class. Idiosyncratic anomalies get a lower confidence score.

Real Examples from the Dataset

During the early 2025 crypto drawdown, Avo Intelligence flagged anomalous volume divergence across mid-cap altcoins 6-12 hours before the major exchanges showed elevated liquidation levels. The KS test on short-window returns had already shifted significantly. This was a genuine structural signal, not a single extreme print.

On the equity side, Avo Intelligence consistently identifies earnings-adjacent anomalies: stocks with unusual options volume / price action in the 3-5 days before a catalyst, with Mahalanobis scores in the 99th percentile of that symbol's history. The win rate on these signals as a statistical filter is meaningfully above chance.

What Happens After a Signal Is Flagged

Detection is only step one. Each flagged anomaly flows into Avo Intelligence's pattern matching layer, which compares the current multi-dimensional signature against the full historical database of similar events. The output is a distribution of outcomes: what happened in the 5, 10, and 20 days after similar conditions, broken out by direction, magnitude, and duration.

This is the intelligence layer that transforms a raw statistical flag into an actionable brief: “When this pattern appeared in the past 1.9B+ records, the symbol was up >5% in 10 days 67% of the time.”