Normalizing a site baseline for day-of-week activity

If you've ever flagged a parking lot as "lightly loaded" on a Tuesday and then watched the same count look completely normal the next Tuesday, you've already run into the core problem with day-of-week noise. A site baseline built off a flat 30-day average smears weekday and weekend activity into one number, and that number doesn't match what's actually on the ground any day of the week. You end up chasing false positives on Saturdays and missing real movement on Mondays because the average was never built to separate the two.

Why a flat average hides the pattern

Most sites worth watching don't run at a constant tempo. A logistics yard empties out on weekends. A motor pool fills up before a Monday rotation and thins out by Friday afternoon. A processing facility might run three shifts on weekdays and a skeleton crew on weekends, with a visible dip in vehicles on the apron between shift changes. That's the normal rhythm of the place, and a baseline needs to account for it before calling anything a deviation.

The trouble starts when an analyst, a tasking cell, or an automated change-detection pass treats every day the same and compares today's count against a 30-day rolling average that mixes Tuesdays with Sundays. The variance from the day-of-week cycle gets read as deviation, and the deviation from an actual change gets buried in it. You either drown in false flags or you loosen the threshold so much that you stop catching the thing you were looking for.

Building day-of-week buckets that hold up

Building day-of-week buckets takes several weeks of repeat passes, but the method itself is straightforward: build seven baselines for the site, one for each day of the week, each pulled from that same day over several weeks of observation. A weekday baseline and a weekend baseline is the coarse version, and it works fine for sites running a simple five-and-two cycle. Sites with rotating shifts need a finer cut, sometimes down to time-of-day bins within each day, because a shift-change window can look like a surge or a drawdown depending on when the pass catches it.

A few things matter more than people expect once you start building these buckets:

• Collection time consistency. If your daily pass comes in at a different hour each day, you're comparing shift-change traffic on one day to mid-shift steady-state on another, and the bucket will never settle.
• Holiday and event contamination. A federal holiday that falls on a Wednesday will wreck the Wednesday bucket if you don't pull it out and treat it separately. Same with a known surge, a scheduled exercise, a maintenance shutdown. Flag those passes, exclude them from baseline training, then check them against the finished baseline like any other day.
• Minimum sample before you trust it. A day-of-week bucket needs more than three observations before it counts as a pattern. Treat anything thinner as a coin flip. Four to six weeks of repeat looks is a reasonable floor before you start trusting a Tuesday-specific threshold.
• Drift over time. A site's rhythm changes. A facility that goes from two shifts to three, or a yard that picks up a new weekend contract, needs its baseline retrained to the new rhythm within a few weeks.

Once the buckets are in place, the comparison holds up a lot better. A Sunday pass gets checked against Sunday's own several-week history, the number that reflects a typical Sunday rather than a blended average of the whole week. A shift-change window gets checked against its own several-week history too, which captures the dip that a flattened 24-hour average would erase.

This is the kind of grinding, repeat-observation work that's easy to describe and tedious to do by hand across more than a handful of sites. A baseline built from accumulated daily imagery, bucketed by the rhythm of the site itself, is the difference between flagging a real anomaly and flagging a Thursday. Activity-Based Intel's approach to daily pattern-of-life baselines handles exactly this kind of day-of-week bucketing as new passes come in.

Worth setting up once a site has enough history to show its real weekly shape, and worth revisiting whenever a shift schedule or a new contract changes that shape. If day-of-week noise is driving most of your false flags, it's worth a look.