Product Passport: Anomaly Detector

Anomaly Detector — ADGICX based on G-sim. For Windows computers and laptops, and Android phones.

1. What it is

Anomaly Detector is a program that monitors the health of a computer, laptop, or phone. It learns how this specific machine operates in its normal state and notices when its operation deviates from this normal. This way, unusual behavior is detected before a failure occurs.

The detector's core is G-sim, developed by ADGICX. G-sim reads each machine parameter individually and monitors not only its value but also how it changes over time: rhythm, growth, decay, spikes.

The detector can be installed on any Windows computer or laptop, regardless of manufacturer, and on Android phones.

2. How it works

• Calibration. For the first 5 minutes after launch, the detector observes the machine's normal operation and learns what is normal for it. During this time, simply work as usual.
• Monitoring. After calibration, the detector compares each parameter with the machine's norm. If a parameter deviates from the norm beyond the threshold (by default, 6 sigma — a measure of how much a value has deviated from the usual), it's an unusual moment.
• Unusual moment. The top bar of the panel turns amber, the moment is recorded in the log along with the three programs that were most heavily loading the machine at that second, and a quiet signal sounds.
• Norm adjusts. If the machine operates calmly in a new way for an extended period, the detector gradually accepts this new behavior as normal.

3. What the detector measures on a computer

Eighteen Windows parameters:

• CPU as a whole and each core individually, CPU frequency;
• RAM and swap (backup memory on disk);
• disk: read speed, write speed, how much space on drive C: is occupied;
• network: how much is received and how much is sent;
• number of running programs (processes) and threads, task switches and interrupts per second, uptime since last power-on.

Additionally, if available on the machine: NVIDIA graphics card, CPU temperature and fan speeds (read by the free program LibreHardwareMonitor, which is installed with the detector), laptop battery charge.

4. The detector's eight eyes

In addition to a value deviating from the norm, the detector monitors how the signal's character itself changes. For this, it has eight eyes — eight G-sim guardians. Each eye catches a specific behavior that we have tested experimentally and observes the machine parameter where this behavior is visible. After launch, the eyes first calibrate to the machine — the panel shows how many minutes remain.

• Harmonic disappearance — there was a constant rhythm in the signal, and it disappeared or weakened.
• Frequency drift — the usual rhythm slowly shifts: becoming more frequent or less frequent.
• New harmonic — a rhythm appeared in the signal that wasn't there before.
• Desynchronization — parameters that usually move in sync have stopped matching.
• Critical slowdown — after a surge, the machine takes longer and longer to return to normal. This is an early sign that operation might fail.
• Saturation — a parameter approaches its ceiling and hits it.
• Self-acceleration — growth that accelerates itself.
• Mode change — the machine transitioned to another stable state and remained in it.

The strictness of the eyes can be changed in the settings: stricter — eyes trigger earlier, softer — less often.

5. What is visible on the panel

The detector panel opens in a browser on the same machine at 127.0.0.1:8733. This is the machine's own address, not visible externally.

• Top line: “Calm — everything is within this machine's norm”, “Unusual moment” with the parameter name, or “Paused”.
• “Now” line — what the machine is doing right now in simple terms: “CPU under load”, “writing to disk”, “downloading from network”, “insufficient memory — swap initiated”. If all is quiet — “calm”.
• “Forecast” line — based on the current growth of values with a limit (memory, disk, swap, heat), it calculates how many minutes until the parameter reaches its limit. If less than 30 minutes to the limit, the line turns amber.
• “Health” line — direct limits: memory 90 % or more occupied, swap 80 % or more, disk C: 90 % or more, CPU or graphics card temperature 85 °C or higher.
• Tiles: machine status, CPU, performance, memory, disk now, network now, system activity, frequency, growth (memory leak), CPU temperature, battery, graphics card.
• Grid of all parameters — each shows current value, deviation from norm, and a graph for the last few minutes.
• Eight eyes — each shows its state (“calibrating”, “calm”, or “triggered”), the parameter it monitors, and a graph.

6. Buttons

• ▶ Start — unpauses, monitoring continues.
• ⏸ Pause — puts monitoring on hold: parameters are visible, but unusual moments are not counted. Useful when you intentionally do something unusual and don't want unnecessary alerts.
• ↻ Recalibrate — the detector forgets the previous norm and relearns it for 5 minutes. Needed if hardware has changed or the machine started operating differently.
• 📋 Log — a list of unusual moments: when, which parameter, how much it deviated from the norm, and who was loading the machine at that moment. While the log is closed, the button shows the number of new moments.
• 🕓 History — a feed of “what the machine was doing”: a mark appears every time its state changes.
• 🗄 Memory — everything recorded by the detector, eyes, and modules.
• 🧩 Modules — enabling additional features and their settings.
• ⚙ Settings — alert threshold, calibration time, norm adjustment speed, eye strictness.
• 🔔 Sound — turns on or off the quiet signal for a new unusual moment.

7. Modes

• Calibration — the first 5 minutes after launch and after the “Recalibrate” button. The detector learns the norm, no alerts.
• Monitoring — main mode: the detector catches deviations from the norm, writes a log and history.
• Pause — after the “Pause” button. Parameters are visible, deviations are not counted.

8. Settings

• Alert threshold — by default 6 sigma. Lower — the detector is more sensitive, higher — calmer.
• Calibration time — by default 300 seconds (5 minutes).
• Norm adjustment — by default 0.02. The higher the number, the faster the norm accepts new calm machine behavior as usual.
• Eye strictness — from 0 (stricter) to 1 (softer).

9. Modules

Core — the detector itself: health, unusual moments, forecast, tray icon. It is always enabled. There are four modules next to it, each can be enabled and disabled separately in the “Modules” section; if one is disabled, the others continue to work.

• Memory (cloud) — stores your machine's history on the ADGICX server. History is remembered longer and survives detector reinstallation.
• Protection — remembers which programs and autostart entries are normal for this machine and notices every new one. It does not block or delete anything, only records. It complements the built-in Windows antivirus (Microsoft Defender), rather than replacing it.
• Optimizer — every minute and a half, it inspects the machine: multiple antiviruses running simultaneously (they interfere with each other), the same program in autostart multiple times, who is currently consuming memory and CPU. It does not delete anything itself — the decision is yours.
• Secretary — once a day at the chosen hour, it sends a daily summary: how many unusual moments occurred, what Protection noticed, what Optimizer found. There is a “Report now” button.

10. Report to Telegram and email

• Via ADGICX: write the word Start to our bot @adgicx_detektor_bot — it will send a short key. Insert the key into the Secretary, choose the hour and where to receive the report: Telegram, email, or both.
• With your own bot: create a bot in @BotFather, insert its token and your recipient number (chat_id) into the Secretary. The report will go directly to Telegram, bypassing the ADGICX server.

11. Detector on Android phone

A separate application for the phone. It measures:

• CPU (number of cores), RAM, and storage space;
• battery: charge, temperature, voltage, and actual current consumption, what powers it (adapter, USB, wireless charging);
• system temperature, if the phone shows it;
• network (Wi-Fi or mobile) and phone movement;
• phone response speed — G-sim operates on this live signal: it learns the norm for about 7 seconds, then shows “calm” or “unusual moment”.

Protection on the phone remembers installed applications and notices every new one. Android does not allow any program to check the content of other applications — this is done by the built-in Google Play Protect.

Everything is calculated on the phone itself, nothing is sent anywhere.

12. Where data is stored

• Without the “Memory (cloud)” module enabled and without reporting via ADGICX, your machine's readings remain on it and are not sent anywhere.
• If “Memory (cloud)” is enabled, the machine's history is sent to the ADGICX server and stored under your key.
• If reporting via ADGICX is enabled, only the text of the daily summary is sent to the server — to forward it to you.

13. Requirements

• Computer or laptop: Windows 10 or Windows 11, 64 bits. During installation, Windows will ask for administrator permission — this is needed to read CPU temperature.
• Phone: Android 8.0 and newer. The application is installed from a file, so the phone will ask for permission to install from this source.

14. What the detector does not do

• It does not delete, stop, or block programs — it only shows and records.
• It does not replace antivirus.
• It does not measure computer electricity consumption in watts — a separate sensor is needed for that. On the phone, battery current consumption is visible.

15. Price

Monthly subscription: $5 per month for a computer or laptop, $2 per month for a phone.

16. Who makes it

ADGICX.com LLP, Kazakhstan, Almaty. Questions: zhomart@adgicx.com.