Anomaly detection

#The invention pertains to the technical field of automatically detecting anomalies through feature engineering.

#There remains a need in the art for an improved system for automatically detecting anomalies in large data sets.

#Related prior art is provided by US 2016/0379309 and WO 2017/032775.

#FIGS. 1a to 1d illustrate a method of one embodiment of the present invention, where FIG. 1a illustrates a selection step of the method, FIG. 1b illustrates a partitioning step of the method, FIG. 1c illustrates an anomaly detection step of the method, and FIG. 1d illustrates a training step of the method.

#FIGS. 2a and 2b illustrate an example of an isolation tree application, where FIG. 2a illustrates a two-dimensional graph with six samples, each associated with different values for continuous numeric attributes X1 and X2, in which normal data points are indicated with circles and an anomaly is indicated with a triangle, and FIG. 2b illustrates an iTree procedure which is repeated with a randomly selected attribute and a randomly drawn split value until a stopping condition is reached.

#FIGS. 3a to 3d show a comparison of anomaly detection according to prior art methods and according to the present invention for a specific example, where FIG. 3a illustrates a two-dimensional graph of sample data corresponding to height and weight measurements of males and females, FIG. 3b illustrates contour lines corresponding to anomaly scores generated according to a prior art method for the sample data, FIG. 3c illustrates contour lines corresponding to anomaly scores generated according to a method of the present invention for the males of the sample data, and FIG. 3d illustrates contour lines corresponding to anomaly scores generated according to a method of the present invention for the females of the sample data.

#The present invention concerns a system and use of said system for detecting anomalies.

#In the context of this document, the terms “physical entity record” and “record” are used interchangeably, and refer to data representing a physical entity. The record comprises physical data values for at least one numeric attribute. Furthermore, the record comprises partition-specifying values concerning values for one or more nominal attributes. One example is a record comprising measurements of e.g. location of a physical person, the time spent in a certain state and related data, as can be found e.g. in insurance claim records. Hereby, the time spent may for instance be comprised in the physical data values, whereas categories relating to the claimant, i.e. the person to which the claim applies, may be part of the partition-specifying values. Furthermore, the plurality of physical entity records may be connected by some form of mutual relation. In one embodiment it may be identical measurements relating to a plurality of persons.

#In another embodiment, the record concerns an image, e.g. a bitmap comprising an array of pixels. Then, the plurality of records may concern an image data set composed of a time sequence of images and as such constitute a video sequence on which outlier detection is performed. The plurality may alternatively or additionally derive from a plurality of channels from different spectra or different contrast methods. In yet another embodiment, the record may concern another format, such as a sound file or a video file. In another embodiment, the record may be defined as part of an insurance claim, and may for instance concern an image that provides evidence in the context of an insurance claim. In such case, the image may concern or be comprised in the physical data values, whereas the partition-specifying values may concern metadata of the image or information regarding the claimant associated with the claim to which the image belongs.