US 11,308,407 B1Granted

Anomaly detection with feedback

AssigneeAmazon Technologies, Inc.

InventorsSudipto Guha, Tal Wagner, Shiva Prasad Kasiviswanathan, Nina Mishra

Life of this patent

Estimating the term…

Loading patent…

Abstract

Examples of techniques for anomaly detection with feedback are described. An instance includes a technique is receiving a plurality of unlabeled data points from an input stream; performing anomaly detection on a point of the unlabeled data points using an anomaly detection engine; pre-processing the unlabeled data point that was subjected to anomaly detection; classifying the pre-processed unlabeled data point; determining the anomaly detection was not proper based on a comparison of a result of the anomaly detection and a result of the classifying of the pre-processed unlabeled data point; and in response to determining the anomaly detection was not proper, providing feedback to the anomaly detection engine to change at least one emphasis used in anomaly detection.

Claims21

Dependent claims

An apparatus comprising:

one or more non-transitory computer-readable storage media;
and
program instructions stored on the one or more non-transitory computer readable storage media that, when read and executed by a processing system, direct the processing system to:
receive a plurality of unlabeled data points from an input stream;
perform anomaly detection on a data point of the unlabeled data points using an anomaly detection engine;
pre-process the data point of the unlabeled data points to generate a pre-processed unlabeled data point;
and
classify the pre-processed unlabeled data point by:
maintaining, in memory, a graph of nodes including a defined maximum dimension, such that when a first node is removed from the graph of nodes the first node is replaced with a second node including a same amount of information as the first node, such that the memory maintains the defined maximum dimension of the graph of nodes;
removing an oldest node from the graph of nodes;
and
inserting a new node in the graph of nodes for the pre-processed unlabeled data point, the new node including a same amount of information as the oldest node, such that the memory maintains the defined maximum dimension of the graph of nodes.

9 more elements

A system comprising:

a processor;
and
a memory storing instructions that, when executed by the processor, cause the processor to:
receive a plurality of unlabeled data points from an input stream;
perform anomaly detection on a data point of the unlabeled data points using an anomaly detection engine;
pre-process the data point of the unlabeled data points to generate a pre-processed unlabeled data point;
classify the pre-processed unlabeled data point by:
maintaining, in the memory, a graph of nodes including a defined maximum dimension, such that when a first node is removed from the graph of nodes the first node is replaced with a second node including a same amount of information as the first node, such that the memory maintains the defined maximum dimension of the graph of nodes;
removing an oldest node from the graph of nodes;
and
inserting a new node in the graph of nodes for the pre-processed unlabeled data point, the new node including a same amount of information as the oldest node, such that the memory maintains the defined maximum dimension of the graph of nodes;
determine the anomaly detection was not proper based on a comparison of a result of the anomaly detection and a result of the classifying of the pre-processed unlabeled data point;
and
in response to determining the anomaly detection was not proper, provide feedback to the anomaly detection engine to change at least one emphasis used in the anomaly detection.

11 more elements

Dependencies are inferred from the claim text.