Unsupervised universal anomaly detection for situation handling

A system comprising:

• at least one hardware processor;
• and
• a non-transitory computer-readable medium storing executable instructions that, when executed, cause the at least one processor to perform operations comprising:
• generating at least one contingency table based on a plurality of historical data points, each one of the plurality of historical data points having a corresponding manifestation value for each one of a plurality of variable categories, the at least one contingency table comprising, for each one of the manifestation values for each one of the plurality of variable categories, a corresponding number of times the manifestation value for the variable category coincides with each manifestation value of each other variable category of the plurality of variable categories in the plurality of historical data points;
• for each one of the manifestation values for each one of the plurality of variable categories, calculating a corresponding restriction index for each manifestation value for each other variable category in the plurality of variable categories based on a manifestation space value and a prediction space value using the at least one contingency table, the manifestation space value comprising a number of different manifestation values for the other variable category in the plurality of historical data points and corresponding to a first space containing every historical manifestation of a dependent variable in the plurality of historical data points, and the prediction space value comprising a number of different manifestation values for the other variable category coinciding with the manifestation value for the variable category in the plurality of historical data points and corresponding to a second space containing every historical manifestation of the dependent variable in the plurality of historical data points that a given predictor manifestation predicts;
• detecting an anomaly in a new data point that is not included in the plurality of historical data points and that has a corresponding manifestation value for each one of the plurality of variable categories based on the restriction index for the corresponding manifestation value for at least one of the plurality of variable categories in the new data point;
• and
• causing a notification of the anomaly in the new data point to be displayed on a computing device based on the detecting of the anomaly.

A non-transitory machine-readable storage medium, tangibly embodying a set of instructions that, when executed by at least one hardware processor, causes the at least one processor to perform operations comprising:

• generating at least one contingency table based on a plurality of historical data points, each one of the plurality of historical data points having a corresponding manifestation value for each one of a plurality of variable categories, the at least one contingency table comprising, for each one of the manifestation values for each one of the plurality of variable categories, a corresponding number of times the manifestation value for the variable category coincides with each manifestation value of each other variable category of the plurality of variable categories in the plurality of historical data points;
• for each one of the manifestation values for each one of the plurality of variable categories, calculating a corresponding restriction index for each manifestation value for each other variable category in the plurality of variable categories based on a manifestation space value and a prediction space value using the at least one contingency table, the manifestation space value comprising a number of different manifestation values for the other variable category in the plurality of historical data points and corresponding to a first space containing every historical manifestation of a dependent variable in the plurality of historical data points, and the prediction space value comprising a number of different manifestation values for the other variable category coinciding with the manifestation value for the variable category in the plurality of historical data points and corresponding to a second space containing every historical manifestation of the dependent variable in the plurality of historical data points that a given predictor manifestation predicts;
• detecting an anomaly in a new data point that is not included in the plurality of historical data points and that has a corresponding manifestation value for each one of the plurality of variable categories based on the restriction index for the corresponding manifestation value for at least one of the plurality of variable categories in the new data point;
• and
• causing a notification of the anomaly in the new data point to be displayed on a computing device based on the detecting of the anomaly.