Comment by joeyrideout

The only analogue that comes to mind is in financial fraud detection: moving money slowly or in a predictable pattern (monthly rent payments etc.) triggers no alarms, but large or unexpected transfers raise alarms.