# US 11,442,804 B2 · Anomaly detection in data object text using natural language processing (NLP) > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,442,804 B2 - Document ID: US11442804B2 - Status: Granted - Kind: B2 - Application number: 16/728,102 - Filed: 2019-12-27 - Published: 2021-07-01 - Granted: 2022-09-13 - Earliest claimed: 2019-12-27 - Assignees: Paypal, Inc. - Applicants: Paypal, Inc. - Inventors: Dmitry Martyanov - Web page: https://patentgrep.com/patent/US11442804B2 ## CPC - G06F 40/279: Recognition of textual entities - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 18/24: Classification techniques - G06F 18/24133: {Distances to prototypes} - G06F 40/20: Natural language analysis (semantic analysis of natural language G06F40/30) - G06N 3/045: Combinations of networks - G06N 3/0499: Feedforward networks - G06N 3/088: Non-supervised learning, e.g. competitive learning - G06N 3/09: Supervised learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Systems and methods are disclosed for detecting anomalies in text content of data objects even when a format of the data and/or data object is unknown. These may include receiving a first data object that corresponds to a first application service and that includes first text content. An anomaly classifier may be trained based on an artificial neural network by using a natural language processing algorithm on respective text content of at least a portion of each of a plurality of data objects corresponding to the first computing service. Each of the plurality of data objects may be labeled as belonging a category. The trained anomaly classifier may identify one or more text character sequences in the first text content of the first data object as anomalous and output identifying information indicating the one or more anomalous text character sequences in the first text content of the first data object. ## Claims ### Claim 1 A system, comprising: a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising: accessing at least a portion of a first plurality of data objects corresponding to a computing service, wherein each of the first plurality of data objects includes text content; training an anomaly classifier based on an artificial neural network by using a natural language processing algorithm on the text content of each of at least the portion of the first plurality of data objects, wherein each of the first plurality of data objects is labeled as having a first condition or as having a second condition, and wherein a complete structural format of the text content of the data objects is not available to the system during the training; and based on the training, producing a trained anomaly classifier that can identify one or more text character sequences in particular text content of a particular data object having the second condition as anomalous. ### Claim 2 (depends on 1) The system of claim 1, wherein the operations further comprise: receiving a first data object that corresponds to the computing service and that includes first text content; identifying, using the trained anomaly classifier, one or more text character sequences in the first text content of the first data object as anomalous; and outputting identifying information indicating the one or more anomalous text character sequences in the first text content of the first data object. ### Claim 3 (depends on 2) The system of claim 2, wherein the first data object is labeled as having the first condition, and wherein the first condition is a no error condition. ### Claim 4 (depends on 1) The system of claim 1, wherein the second condition is an error condition. ### Claim 5 (depends on 1) The system of claim 1, wherein the operations further comprise: receiving a second plurality of data objects that each corresponds to the computing service and that each includes text content; identifying, using the trained anomaly classifier, one or more first common anomalous text character sequences in first text content of a first set of the second plurality of data objects; identifying, using the trained anomaly classifier, one or more second common anomalous text character sequences in second text content of a second set of the second plurality of data objects; and outputting, in response to determining that the one or more first common anomalous text character sequences satisfies a predetermined condition, identifying information indicating the one or more first common anomalous text character sequences in the first set of the second plurality of data objects. ### Claim 6 (depends on 5) The system of claim 5, wherein the operations further comprise: omitting, in response to determining that the one or more second common anomalous text character sequences does not satisfy a predetermined condition, identifying information indicating the one or more second common anomalous text character sequences in the second set of the second plurality of data objects. ### Claim 7 (depends on 1) The system of claim 1, wherein the training the trained anomaly classifier includes: using an unsupervised neural network to extract features from the text content; and training, using the extracted features and the labels of each of the first plurality of data objects, a supervised neural network to determine one or more text character sequences in the text content in the first plurality of data objects as anomalous. ### Claim 8 A method, comprising receiving a first data object that corresponds to a first computing service and that includes first text content; accessing a trained anomaly classifier, wherein the trained anomaly classifier was trained based on an artificial neural network by using a natural language processing algorithm on respective text content of at least a portion of each of a plurality of data objects corresponding to the first computing service, and wherein each of the plurality of data objects is labeled as belonging to one of a plurality of categories; identifying, using the trained anomaly classifier, one or more text character sequences in the first text content of the first data object as anomalous; and outputting identifying information indicating the one or more anomalous text character sequences in the first text content of the first data object. ### Claim 9 (depends on 8) The method of claim 8, wherein the first data object is a log file that is generated based on communications between the first computing service and a second computing service. ### Claim 10 (depends on 8) The method of claim 8, further comprising: determining that the first data object is included in a first category of the plurality of categories, wherein the accessing the trained anomaly classifier is in response to the determining that the first data object is included in the first category of the plurality of categories. ### Claim 11 (depends on 10) The method of claim 10, wherein the first category of the plurality of categories is an error condition. ### Claim 12 (depends on 8) The method of claim 8, further comprising: sending the first data object to a second computing service; and receiving an error message from the second computing service that the first data object resulted in an error, wherein the identifying is performed in response to receiving the error message. ### Claim 13 (depends on 8) The method of claim 8, wherein outputting identifying information indicating the one or more anomalous text character sequences includes causing the one or more anomalous text character sequences to be visually augmented on a user interface to appear different than other text content of the first text content. ### Claim 14 (depends on 8) The method of claim 8, further comprising: updating the trained anomaly classifier by at least one of penalizing the artificial neural network for incorrectly identifying one or more anomalous text character sequences or rewarding the artificial neural network for correctly identifying one or more anomalous text character sequences. ### Claim 15 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: receiving a first data object that corresponds to a first computing service and that includes first text content; accessing a trained anomaly classifier, wherein the trained anomaly classifier was trained based on an artificial neural network by using a natural language processing algorithm on respective text content of at least a portion of each of a plurality of data objects corresponding to the first computing service, and wherein each of the plurality of data objects is labeled an error condition or a no error condition; identifying, using the trained anomaly classifier, one or more text character sequences in the first text content of the first data object as anomalous; and outputting identifying information indicating the one or more anomalous text character sequences in the first text content of the first data object. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the first data object is a log file that is generated from communications between the first computing service and a second computing service. ### Claim 17 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the operations further comprise: determining that the first data object is associated with an error condition, wherein the accessing the trained anomaly classifier is in response to the determining that the first data object is associated with the error condition. ### Claim 18 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the operations further comprise: sending the first data object to a second computing service; and receiving an error message from the second computing service that the first data object resulted in an error, wherein the identifying is performed in response to receiving the error message. ### Claim 19 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the operations further comprise: receiving a second data object that corresponds to the first computing service and that includes second text content; identifying, using the trained anomaly classifier, one or more text character sequences in the second text content of the second data object as non-anomalous; and outputting identifying information indicating the one or more non-anomalous text character sequences in the second text content of the second data object that correspond with the one or more anomalous text character sequences in the first text content of the first data object. ### Claim 20 (depends on 19) The non-transitory machine-readable medium of claim 19, wherein the identifying information indicating the one or more non-anomalous text character sequences is visually augmented differently than the identifying information indicating the one or more anomalous text character sequences.