In anomaly detection, that is, near real-time monitoring of system to see if it is sick or healthy, we collect data on the system and in nearly all practical, operational contexts, fundamentally, inescapably there are two ways for the detection effort to be wrong: (1) Saying that the system is sick when it is healthy and (2) saying that the system is healthy when it is sick.

Way (1) is a case of a false alarm or false positive or Type I error, and way (2) is a case of a missed detection, false negative, or Type II error.

Or, near real time anomaly detection is basically some continuously applied statistical hypothesis tests.

Under mild assumptions, over time there will be a rate of each of errors (1) and (2). We want both rates to be low.

We would like to be able to adjust the rate of false alarms and know in advance the rate we will be getting.

Moreover, since anomaly detectors differ, we want a detector that, for whatever rate of false alarms we are willing to tolerate, gives us the lowest rate we can get of the rate of missed detections.

For current relatively reliable systems in server farms and networks, likely we will have only a little data on the probability distribution of the data when a system is sick.

So, we need a detector that is good for zero day problems, that is, that assumes nothing about the sickness we are trying to detect.

For knowing the rate of false alarms, it can be very helpful to have the conditional probability distribution of the data we are using assuming that the system is healthy, but commonly computer systems are so complicated that knowing that probability distribution in useful detail is not reasonable. So, we would like a detector that is distribution-free, that is, makes no assumptions about probability distributions.

Further, especially for monitoring systems as complicated as current server farms and networks, we would like to be able to do well with input data on several variables, not just one. That is, we want a detector that is multi-variate.

So, we want to be able to adjust and know false alarm rate in advance, get for that false alarm rate a rate of missed detections, be distribution-free and multi-variate, and have essentially no data on the cases of sickness we are trying to detect.

From the OP, I was not able to evaluate their work on these criteria.