Cold-start anomaly detection