Unsupervised anomaly detection machine learning frameworks

A system comprising:

• one or more processors;
• and
• one or more memories storing processor-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receive a plurality of predictive inputs for a three-tiered unsupervised anomaly detection machine learning framework and an anomaly detection label for a filtered predictive input, wherein (i) the three-tiered unsupervised anomaly detection machine learning framework comprises (a) a randomized partitioning anomaly detection machine learning model, (b) a rule-based partitioning anomaly detection model, and (c) a clustering machine learning model, and (ii) the anomaly detection label for the filtered predictive input is generated by the three-tiered unsupervised anomaly detection machine learning framework by:
• determining, using the randomized partitioning anomaly detection machine learning model, a randomized partitioning anomaly detection label for a first predictive input of the plurality of predictive inputs,
• in response to a first determination that the first predictive input is associated with an affirmative randomized partitioning anomaly detection label, determining, using the rule-based partitioning anomaly detection model, a rule-based partitioning anomaly detection label based at least in part on the first predictive input,
• identifying the first predictive input as the filtered predictive input by excluding a second predictive input, of the plurality of predictive inputs, from the plurality of predictive inputs based on a second determination that the second predictive input is not associated with an affirmative rule-based partitioning anomaly detection label,
• determining, using the clustering machine learning model, an input cluster based at least in part on the filtered predictive input,
• determining an anomaly designation for the input cluster based at least in part on a ground-truth anomaly detection label for a highest utility filtered predictive input in the input cluster, and
• in response to determining that the anomaly designation for the input cluster is an affirmative anomaly designation, determining the anomaly detection label for the filtered predictive input based at least in part on a cluster distribution ratio of:
• (i) an input utility measure for the filtered predictive input, and (ii) a cluster utility measure for the highest utility filtered predictive input in the input cluster;
• and
• initiating performance of an operational load balancing operation for a computing system configured to perform one or more investigatory actions based at least in part on the anomaly detection label.

One or more non-transitory computer-readable media storing processor-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receive a plurality of predictive inputs for a three-tiered unsupervised anomaly detection machine learning framework and an anomaly detection label for a filtered predictive input, wherein (i) the three-tiered unsupervised anomaly detection machine learning framework comprises (a) a randomized partitioning anomaly detection machine learning model, (b) a rule-based partitioning anomaly detection model, and (c) a clustering machine learning model, and (ii) the anomaly detection label for the filtered predictive input is generated by the three-tiered unsupervised anomaly detection machine learning framework by:
• determining, using the randomized partitioning anomaly detection machine learning model, a randomized partitioning anomaly detection label for a first predictive input of the plurality of predictive inputs,
• in response to a first determination that the first predictive input is associated with an affirmative randomized partitioning anomaly detection label, determining, using the rule-based partitioning anomaly detection model, a rule-based partitioning anomaly detection label based at least in part on the first predictive input,
• identifying the first predictive input as the filtered predictive input by excluding a second predictive input, of the plurality of predictive inputs, from the plurality of predictive inputs based on a second determination that the second predictive input is not associated with an affirmative rule-based partitioning anomaly detection label,
• determining, using the clustering machine learning model, an input cluster based at least in part on the filtered predictive input,
• determining an anomaly designation for the input cluster based at least in part on a ground-truth anomaly detection label for a highest utility filtered predictive input in the input cluster, and
• in response to determining that the anomaly designation for the input cluster is an affirmative anomaly designation, determining the anomaly detection label for the filtered predictive input based at least in part on a cluster distribution ratio of:
• (i) an input utility measure for the filtered predictive input, and (ii) a cluster utility measure for the highest utility filtered predictive input in the input cluster;
• and
• initiating performance of an operational load balancing operation for a computing system configured to perform one or more investigatory actions based at least in part on the anomaly detection label.