Automatic detection of anomalies in electronic communications

A computer system for detecting anomalies in electronic communications, the computer system comprising:

• a memory medium comprising program instructions;
• a bus coupled to the memory medium;
• and
• a processor for executing the program instructions, the program instructions causing the system to:
• identify, using at least one electronic device of a user, a group of customers that are most likely to respond to a particular communication;
• transmit, from a server over a network to electronic devices associated with each of the group of customers, a plurality of electronic communications in a communications batch that is a batch of emails sent from a common batch time and having common content of the particular communication;
• serve, from a marketing server to the at least one electronic device of the user, a graphical user interface (GUI), the GUI including a listing of individual batch jobs having a plurality of batch jobs, a date for each batch job, a selection of a target for each batch job, a selection of a metric for each batch job, a selection of an alert for each batch job, and a selection of an alert type that includes alert types of email, SMS, and Push,
• receive, by the marketing server, a user preference indicating a push-type alert for the communications batch;
• obtain, by the at least one computing device, a set of response metrics from each of the plurality of electronic communications in the communications batch in a real-time data stream;
• compute a response metric value pattern for a response metric of the set of response metrics based on an aggregation of the response metric over the plurality of electronic communications;
• analyze a content of the electronic communications to retrieve characteristics of the communication that are in common with a cluster of previous communications batches in a plurality of clusters, each of the plurality of clusters having value patterns from a plurality of previous communication batches clustered together based on a similarity of data curves corresponding to the previous communication batches;
• generate a predicted metric value pattern corresponding to the response metric based on the cluster, including:
• analyzing accumulated response metrics from a plurality of previously sent communication batches;
• and
• calculating the predicted metric value pattern for each of the accumulated response metrics based on the analyzing;
• analyze the cluster of previous communications batches to find predictive features of the cluster by comparing features and variables within communications that are similar across the cluster and contrasting features and variables with other communications that are not in the cluster;
• estimate a plurality of different models based on the predictive features, the plurality of different models including linear models, dynamic linear models, stochastic process models, hierarchical temporal memory models, gradient boosted trees, and recurrent neural networks with long-short term memory;
• assign a weight to each model of the plurality of different models based on an evaluation of each model according to standard fit and hold-out prediction statistics;
• construct a combined ensemble model based on the weighted plurality of different models;
• compare a trend over time indicated by the response metric value pattern to a predicted metric value pattern corresponding to the response metric based on the combined ensemble model to determine whether the response metric value pattern is anomalous;
• and
• perform a remediation activity in response to a determination that the response metric value pattern is anomalous, the remediation activity including updating the plurality of different models with the anomalous data and transmitting a push-type alert to at least one electronic device of the user advising the user of the anomalous response value pattern.

A computer program product for detecting anomalies in electronic communications, the computer program product comprising a non-transitory computer readable storage device having program instructions stored thereon, to:

• identify, using at least one electronic device of a user, a group of customers that are most likely to respond to a particular communication;
• transmit, from a server over a network to electronic devices associated with each of the group of customers, a plurality of electronic communications in a communications batch that is a batch of emails sent from a common batch time and having common content of the particular communication;
• serve, from a marketing server to the at least one electronic device of the user, a graphical user interface (GUI), the GUI including a listing of individual batch jobs having a plurality of batch jobs, a date for each batch job, a selection of a target for each batch job, a selection of a metric for each batch job, a selection of an alert for each batch job, and a selection of an alert type that includes alert types of email, SMS, and Push,
• receive, by the marketing server, a user preference indicating a push-type alert for the communications batch;
• obtain, by the at least one computing device, a set of response metrics from each of the plurality of electronic communications in the communications batch in a real-time data stream;
• compute a response metric value pattern for a response metric of the set of response metrics based on an aggregation of the response metric over the plurality of electronic communications;
• analyze a content of the electronic communications to retrieve characteristics of the communication that are in common with a cluster of previous communications batches in a plurality of clusters, each of the plurality of clusters having value patterns from a plurality of previous communication batches clustered together based on a similarity of data curves corresponding to the previous communication batches;
• generate a predicted metric value pattern corresponding to the response metric based on the cluster, including:
• analyzing accumulated response metrics from a plurality of previously sent communication batches;
• and
• calculating the predicted metric value pattern for each of the accumulated response metrics based on the analyzing;
• analyze the cluster of previous communications batches to find predictive features of the cluster by comparing features and variables within communications that are similar across the cluster and contrasting features and variables with other communications that are not in the cluster;
• estimate a plurality of different models based on the predictive features, the plurality of different models including linear models, dynamic linear models, stochastic process models, hierarchical temporal memory models, gradient boosted trees, and recurrent neural networks with long-short term memory;
• assign a weight to each model of the plurality of different models based on an evaluation of each model according to standard fit and hold-out prediction statistics;
• construct a combined ensemble model based on the weighted plurality of different models;
• compare a trend over time indicated by the response metric value pattern to a predicted metric value pattern corresponding to the response metric based on the combined ensemble model to determine whether the response metric value pattern is anomalous;
• and
• perform a remediation activity in response to a determination that the response metric value pattern is anomalous, the remediation activity including updating the plurality of different models with the anomalous data and transmitting a push-type alert to at least one electronic device of the user advising the user of the anomalous response value pattern.