US 11,537,902 B1Granted

Detecting anomalous events from categorical data using autoencoders

AssigneeAmazon Technologies, Inc.

InventorsSergul Aydore, Baris Coskun, Luca Melis

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems, devices, and methods are provided for detecting anomalous events from categorical data using autoencoders. A system may receive a data set associated with actions requested within the computing environment, wherein the data set includes first categorical data indicative of anomalous activity in the computing environment. The system may train an autoencoder to reconstruct approximations of requests associated with the computing environment based on the received data set, wherein training the autoencoder includes using a beta divergence and a maximum mean discrepancy divergence. The trained system may receive a request to invoke an action within the computing environment, may generate a reconstruction of the request to invoke the action using the trained autoencoder, may determine a normalcy score based on a probability that the reconstruction of the request exists in the training data set, and, based on the calculated normalcy score, may determine whether requests indicate anomalous data.

Claims20

Dependent claims

A method for training autoencoders to detect potentially anomalous activity in a computing environment based on categorical data, the method comprising:

receiving a training data set of requests executed within the computing environment, wherein a request in the training data set comprises a plurality of request attributes and a plurality of contextual attributes, and wherein the training data set comprises first categorical data indicative of anomalous activity in the computing environment;
training a variational autoencoder (VAE) to reconstruct approximations of requests associated with the computing environment based on the training data set, wherein training the VAE comprises:
determining initial parameters of an encoder of the VAE;
determining initial parameters of a decoder of the VAE;
determining a kernel with which to determine a maximum mean discrepancy divergence associated with the training data set;
determining a divergence coefficient associated with the training data set, the divergence coefficient greater than or equal to zero;
sampling first data from the training data set, the first data comprising the first categorical data;
sampling second data from a fixed prior distribution over latent space;
sampling third data based on an encoding of the second data, wherein the second data and the third data comprise numerical values;
determining a beta divergence reconstruction loss associated with the training data set based on the divergence coefficient, the sampled first data, and the sampled third data;
determining a maximum mean discrepancy reconstruction loss associated with the maximum mean discrepancy divergence based on the kernel, the sampled second data, and the sampled third data;
and
determining a total loss associated with the training data set based on the beta divergence and the maximum mean discrepancy divergence;
and
provisioning the VAE to detect, based on the training, anomalous requests to invoke an action within the computing environment.

12 more elements

A method for training autoencoders to detect potentially anomalous activity in a computing environment based on categorical data, the method comprising:

receiving a data set associated with actions requested within the computing environment, wherein a request in the data set comprises attributes, and wherein the data set comprises first categorical data indicative of anomalous activity in the computing environment;
training an autoencoder to reconstruct approximations of requests associated with the computing environment based on the data set, wherein training the autoencoder comprises:
sampling first data from the data set, the first data comprising the first categorical data;
sampling second data from a fixed prior distribution over latent space;
sampling third data based on an encoding of the second data, wherein the second data and the third data comprise numerical values;
determining a beta divergence reconstruction loss associated with the data set based on the sampled first data and the sampled third data;
determining a maximum mean discrepancy reconstruction loss associated with the maximum mean discrepancy divergence based on the sampled second data and the sampled third data;
and
determining a total loss associated with the data set based on the beta divergence and the maximum mean discrepancy divergence;
and
provisioning the trained autoencoder to detect, based on the training, anomalous requests to invoke an action within the computing environment.

8 more elements

A system for training autoencoders to detect potentially anomalous activity in a computing environment based on categorical data, the system configured to:

receive a data set associated with actions requested within the computing environment, wherein a request in the data set comprises attributes, and wherein the data set comprises first categorical data indicative of anomalous activity in the computing environment;
train an autoencoder to reconstruct approximations of requests associated with the computing environment based on the data set, wherein training the autoencoder comprises:
sample first data from the data set, the first data comprising the first categorical data;
sample second data from a fixed prior distribution over latent space;
sample third data based on an encoding of the second data, wherein the second data and the third data comprise numerical values;
determine a beta divergence reconstruction loss associated with the data set based on the sampled first data and the sampled third data;
determine a maximum mean discrepancy reconstruction loss associated with the maximum mean discrepancy divergence based on the sampled second data and the sampled third data;
and
determine a total loss associated with the data set based on the beta divergence and the maximum mean discrepancy divergence;
and
provisioning the trained autoencoder to detect, based on the training, anomalous requests to invoke an action within the computing environment.

8 more elements

Dependencies are inferred from the claim text.