Here is a post I wrote at work about how the anomaly detection system I am working on works and some discussion around design choices etc.