System, method, and computer program product for multi-domain ensemble learning based on multivariate time sequence data

A system, comprising:

• at least one processor;
• and
• at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, direct the at least one processor to:
• receive multivariate sequence data comprising a plurality of vectors, each vector of the plurality of vectors comprising elements based on a time sequence for a respective variable of a plurality of variables;
• generate a plurality of scores comprising a respective score for each anomaly detection model based on inputting at least a portion of the multivariate sequence data into each anomaly detection model of a plurality of anomaly detection models;
• combine the multivariate sequence data with the plurality of scores to generate combined intermediate data;
• generate an output score based on inputting the combined intermediate data into a time-series sequences ensemble model (TSEM), the TSEM based on a model-domain ensemble model, a time-domain ensemble model, and a feature-domain ensemble model;
• determine that the output score generated based on the combined intermediate data satisfies a threshold;
• and
• in response to determining that the output score generated based on the combined intermediate data satisfies the threshold:
• update parameters of at least one of the TSEM or the feature-domain ensemble model, wherein, when updating the parameters of at least one of the TSEM or the feature-domain ensemble model, the one or more instructions further direct the at least one processor to, for every time step less than a maximum time step:
• determine a first variable based on the combined intermediate data and a current time step version of the TSEM;
• determine a second variable based on a ratio of labels to the first variable;
• backpropagate the feature-domain ensemble model based on a transpose of the combined intermediate data and the second variable;
• and
• determine a next time step version of the TSEM based on backpropagation of the feature-domain ensemble model and the current time step version of the TSEM.

A computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to:

• receive multivariate sequence data comprising a plurality of vectors, each vector of the plurality of vectors comprising elements based on a time sequence for a respective variable of a plurality of variables;
• generate a plurality of scores comprising a respective score for each anomaly detection model based on inputting at least a portion of the multivariate sequence data into each anomaly detection model of a plurality of anomaly detection models;
• combine the multivariate sequence data with the plurality of scores to generate combined intermediate data;
• generate an output score based on inputting the combined intermediate data into a time-series sequences ensemble model (TSEM), the TSEM based on a model-domain ensemble model, a time-domain ensemble model, and a feature-domain ensemble model;
• determine that the output score generated based on the combined intermediate data satisfies a threshold;
• and
• in response to determining that the output score generated based on the combined intermediate data satisfies the threshold:
• update parameters of at least one of the TSEM or the feature-domain ensemble model, wherein, when updating the parameters of at least one of the TSEM or the feature-domain ensemble model, the one or more instructions further cause the at least one processor to, for every time step less than a maximum time step:
• determine a first variable based on the combined intermediate data and a current time step version of the TSEM;
• determine a second variable based on a ratio of labels to the first variable;
• backpropagate the feature-domain ensemble model based on a transpose of the combined intermediate data and the second variable;
• and
• determine a next time step version of the TSEM based on backpropagation of the feature-domain ensemble model and the current time step version of the TSEM.