This seems like a statistics question that doesn't have much to do with JSON. A starting point: https://en.wikipedia.org/wiki/Anomaly_detection

You should probably start off trying the simplest thing that could possibly work for your use-case.