Factor out anomaly detection, test coverage