> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bizaxl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Anomaly Detection

> How LMS Proctor detects and responds to suspicious behavior during quizzes.

LMS Proctor monitors for suspicious behavior during quizzes and can automatically capture evidence, warn students, or terminate the quiz.

## Types of Anomalies

### Behavioral Anomalies

These are detected through browser events and interactions.

| Anomaly             | Detection Method                                        | Severity |
| ------------------- | ------------------------------------------------------- | -------- |
| **Tab Change**      | Visibility API detects when the quiz tab becomes hidden | Medium   |
| **Window Blur**     | Focus events detect when the browser loses focus        | Medium   |
| **Copy**            | Keyboard event listener for Ctrl/Cmd+C                  | High     |
| **Paste**           | Keyboard event listener for Ctrl/Cmd+V                  | High     |
| **Right Click**     | Context menu event listener                             | Low      |
| **Fullscreen Exit** | Fullscreen API detects mode changes                     | High     |
| **DevTools Open**   | Multiple detection methods (window size, console traps) | Critical |

### Environmental Anomalies

These are detected before or during the quiz.

| Anomaly               | Detection Method                 | Severity          |
| --------------------- | -------------------------------- | ----------------- |
| **Multiple Monitors** | Screen enumeration API           | Blocks quiz start |
| **No Face Detected**  | AI face detection in webcam feed | Medium            |
| **Multiple Faces**    | AI face detection counts faces   | High              |

## Face Detection

LMS Proctor uses AI-powered face detection to verify student presence.

### How It Works

1. The webcam feed is analyzed every 500 milliseconds
2. A lightweight AI model (TinyFaceDetector) identifies faces
3. Face count and position are recorded
4. Anomalies trigger if:
   * No face is visible for longer than the configured threshold
   * Multiple faces are detected for longer than the threshold

### Configuration

| Setting                     | Description                                | Default   |
| --------------------------- | ------------------------------------------ | --------- |
| **Detect Face Presence**    | Enable no-face detection                   | On        |
| **Detect Multiple Faces**   | Enable multiple-face detection             | On        |
| **No Face Threshold**       | Seconds without face before anomaly        | 5 seconds |
| **Multiple Face Threshold** | Seconds with multiple faces before anomaly | 3 seconds |

<Tip>
  Set reasonable thresholds to avoid false positives. A student might briefly look away or have someone walk behind them.
</Tip>

## Developer Tools Detection

Opening developer tools could allow students to inspect quiz answers or manipulate the page. LMS Proctor uses multiple methods to detect this:

1. **Window Size Detection**: DevTools often changes the window dimensions
2. **Console Property Getter**: Detects when the console is accessed
3. **Visual Inspection**: Checks for DevTools-related UI elements

When detected, this is treated as a Critical severity anomaly.

## Anomaly Responses

You can configure how LMS Proctor responds to detected anomalies.

### Silent Capture

* Records the anomaly and captures evidence
* Student is not notified
* Quiz continues normally
* Instructor reviews after submission

**Best for**: Low-stakes quizzes or when you want to gather data without interruption.

### Warning + Capture

* Records the anomaly and captures evidence
* Student sees a warning message
* Student can dismiss and continue
* After max warnings, escalates to termination

**Best for**: Most quizzes - provides feedback while allowing recovery from accidental triggers.

### Terminate Quiz

* Immediately ends the quiz
* Records termination as a Critical anomaly
* Student cannot continue
* Submission is marked as terminated

**Best for**: High-stakes exams where any violation should end the attempt.

## Warning System

When using Warning + Capture mode:

1. First anomaly triggers a warning dialog
2. Student must acknowledge and return to the quiz
3. Warning count increments
4. After reaching **Max Warnings**, the quiz terminates

<Warning>
  Configure Max Warnings thoughtfully. Too few warnings may penalize students for minor issues. Too many may reduce the deterrent effect.
</Warning>

## Anomaly Evidence

When an anomaly is detected:

1. A snapshot is immediately captured (regardless of interval)
2. The snapshot is marked as anomaly evidence
3. Additional context is recorded:
   * Anomaly type and code
   * Severity level
   * Timestamp
   * Browser and environment info

## Reviewing Anomalies

Instructors can review anomalies in the submission view:

* **Anomaly Summary**: Count and types of anomalies
* **Timeline View**: When each anomaly occurred
* **Evidence Snapshots**: Screenshots from anomaly moments
* **Anomaly Score**: Calculated severity score

### Anomaly Score Calculation

The anomaly score weighs violations by severity:

| Severity | Weight |
| -------- | ------ |
| Low      | 1      |
| Medium   | 2      |
| High     | 5      |
| Critical | 10     |

Higher scores indicate more suspicious activity and should be prioritized for review.

## Best Practices

<AccordionGroup>
  <Accordion title="Start with Warning + Capture">
    Use Warning + Capture for most quizzes. It provides feedback without harsh penalties for minor issues.
  </Accordion>

  <Accordion title="Set appropriate thresholds">
    Face detection thresholds of 3-5 seconds help avoid false positives from brief glances away.
  </Accordion>

  <Accordion title="Communicate expectations">
    Tell students what's being monitored. Clear expectations reduce accidental violations.
  </Accordion>

  <Accordion title="Review anomalies contextually">
    A single tab change might be accidental. Patterns of behavior are more meaningful.
  </Accordion>

  <Accordion title="Use termination sparingly">
    Reserve immediate termination for high-stakes situations where any violation is unacceptable.
  </Accordion>
</AccordionGroup>

## Limitations

* Face detection requires adequate lighting and camera quality
* Browser-based detection can be bypassed by sophisticated attempts
* Some legitimate activities may trigger false positives
* Detection depends on browser API support

For maximum security, combine anomaly detection with [Safe Exam Browser](/lms/proctoring/features/safe-exam-browser).