# US 12,602,451 B2 · Unsupervised anomaly detection machine learning frameworks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,451 B2 - Document ID: US12602451B2 - Status: Granted - Kind: B2 - Application number: 17/579,335 - Filed: 2022-01-19 - Published: 2023-07-20 - Granted: 2026-04-14 - Earliest claimed: 2022-01-19 - Assignees: Optum Services (Ireland) Limited - Applicants: Optum Services (Ireland) Limited - Inventors: David T. Cleere; Ian Crawford - Web page: https://patentgrep.com/patent/US12602451B2 ## CPC - G06F 18/23: Clustering techniques - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06F 18/2433: Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06N 5/045: Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/20: Ensemble learning - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Various embodiments of the present invention provide methods, apparatus, systems, computing devices, computing entities, and/or the like for performing anomaly detection operations. Certain embodiments of the present invention utilize systems, methods, and computer program products that perform anomaly detection operations by using a three-tiered unsupervised anomaly detection machine learning framework to perform high-volume anomaly detection and via utilizing a first tier anomaly detection tier that uses a randomized partitioning anomaly detection machine learning model (e.g., an isolation forest anomaly detection machine learning model), a second tier anomaly detection tier that uses a rule-based partitioning anomaly detection model, and a third tier anomaly detection tier that uses a clustering machine learning model and intra-cluster inferences performed based at least in part on cluster distribution ratios and/or per-cluster anomaly designations. ## Claims ### Claim 1 A computer-implemented method comprising: receiving, by one or more processors, a plurality of predictive inputs for a three-tiered unsupervised anomaly detection machine learning framework and an anomaly detection label for a filtered predictive input, wherein (i) the three-tiered unsupervised anomaly detection machine learning framework comprises (a) a randomized partitioning anomaly detection machine learning model, (b) a rule-based partitioning anomaly detection model, and (c) a clustering machine learning model, and (ii) the anomaly detection label for the filtered predictive input is generated by the three-tiered unsupervised anomaly detection machine learning framework by: determining, using the randomized partitioning anomaly detection machine learning model, a randomized partitioning anomaly detection label for a first predictive input of the plurality of predictive inputs, in response to a first determination that the first predictive input is associated with an affirmative randomized partitioning anomaly detection label, determining, using the rule-based partitioning anomaly detection model, a rule-based partitioning anomaly detection label based at least in part on the first predictive input, identifying the first predictive input as the filtered predictive input by excluding a second predictive input, of the plurality of predictive inputs, from the plurality of predictive inputs based on a second determination that the second predictive input is not associated with an affirmative rule-based partitioning anomaly detection label, determining, using the clustering machine learning model, an input cluster based at least in part on the filtered predictive input, determining an anomaly designation for the input cluster based at least in part on a ground-truth anomaly detection label for a highest utility filtered predictive input in the input cluster, and in response to determining that the anomaly designation for the input cluster is an affirmative anomaly designation, determining the anomaly detection label for the filtered predictive input based at least in part on a cluster distribution ratio of: (i) an input utility measure for the filtered predictive input, and (ii) a cluster utility measure for the highest utility filtered predictive input in the input cluster; and initiating, by the one or more processors, performance of an operational load balancing operation for a computing system configured to perform one or more investigatory actions based at least in part on the anomaly detection label. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein determining the anomaly detection label for the filtered predictive input further comprises: in response to determining that the cluster distribution ratio for the filtered predictive input satisfies a proximity cluster distribution ratio threshold, determining that the filtered predictive input is associated with a high anomaly detection label. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein determining the anomaly detection label for the filtered predictive input further comprises: in response to determining that the cluster distribution ratio for the filtered predictive input fails to satisfy a proximity cluster distribution ratio threshold, determining that the filtered predictive input is associated with a low anomaly detection label. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, further comprising: in response to determining that another anomaly designation for another input cluster is a negative anomaly designation, determining a negative anomaly detection label. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, further comprising: in response to determining that the randomized partitioning anomaly detection label for the first predictive input is a negative randomized partitioning anomaly detection label, or that the rule-based partitioning anomaly detection label for the first predictive input is a negative rule-based partitioning anomaly detection label, determining that the first predictive input is associated with the negative anomaly detection label. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the rule-based partitioning anomaly detection model is configured to: extract a rule-based classification feature value associated with a rule-based classification feature type, determine a target range for the rule-based classification feature type, and determine the rule-based partitioning anomaly detection label for the first predictive input based at least in part on the rule-based classification feature value and the target range for the rule-based classification feature type that is associated with the rule-based classification feature value. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein: the first predictive input is associated with an input feature value associated with an input feature type; the input feature type is associated with the target range; the randomized partitioning anomaly detection machine learning model is associated with an isolation tree that is generated based at least in part on the input feature type, and the rule-based partitioning anomaly detection model is associated with the rule-based classification feature type. ### Claim 8 A system comprising: one or more processors; and one or more memories storing processor-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: receive a plurality of predictive inputs for a three-tiered unsupervised anomaly detection machine learning framework and an anomaly detection label for a filtered predictive input, wherein (i) the three-tiered unsupervised anomaly detection machine learning framework comprises (a) a randomized partitioning anomaly detection machine learning model, (b) a rule-based partitioning anomaly detection model, and (c) a clustering machine learning model, and (ii) the anomaly detection label for the filtered predictive input is generated by the three-tiered unsupervised anomaly detection machine learning framework by: determining, using the randomized partitioning anomaly detection machine learning model, a randomized partitioning anomaly detection label for a first predictive input of the plurality of predictive inputs, in response to a first determination that the first predictive input is associated with an affirmative randomized partitioning anomaly detection label, determining, using the rule-based partitioning anomaly detection model, a rule-based partitioning anomaly detection label based at least in part on the first predictive input, identifying the first predictive input as the filtered predictive input by excluding a second predictive input, of the plurality of predictive inputs, from the plurality of predictive inputs based on a second determination that the second predictive input is not associated with an affirmative rule-based partitioning anomaly detection label, determining, using the clustering machine learning model, an input cluster based at least in part on the filtered predictive input, determining an anomaly designation for the input cluster based at least in part on a ground-truth anomaly detection label for a highest utility filtered predictive input in the input cluster, and in response to determining that the anomaly designation for the input cluster is an affirmative anomaly designation, determining the anomaly detection label for the filtered predictive input based at least in part on a cluster distribution ratio of: (i) an input utility measure for the filtered predictive input, and (ii) a cluster utility measure for the highest utility filtered predictive input in the input cluster; and initiating performance of an operational load balancing operation for a computing system configured to perform one or more investigatory actions based at least in part on the anomaly detection label. ### Claim 9 (depends on 8) The system of claim 8, wherein determining the anomaly detection label for the filtered predictive input further comprises: in response to determining that the cluster distribution ratio for the filtered predictive input satisfies a proximity cluster distribution ratio threshold, determining that the filtered predictive input is associated with a high anomaly detection label. ### Claim 10 (depends on 8) The system of claim 8, wherein determining the anomaly detection label for the filtered predictive input further comprises: in response to determining that the cluster distribution ratio for the filtered predictive input fails to satisfy a proximity cluster distribution ratio threshold, determining that the filtered predictive input is associated with a low anomaly detection label. ### Claim 11 (depends on 10) The system of claim 10, wherein the operations further comprise: in response to determining that another anomaly designation for another input cluster is a negative anomaly designation, determining a negative anomaly detection label. ### Claim 12 (depends on 11) The system of claim 11, wherein the operations further comprise: in response to determining that the randomized partitioning anomaly detection label for the first predictive input is a negative randomized partitioning anomaly detection label, or that the rule-based partitioning anomaly detection label for the first predictive input is a negative rule-based partitioning anomaly detection label, determining that the first predictive input is associated with the negative anomaly detection label. ### Claim 13 (depends on 8) The system of claim 8, wherein the rule-based partitioning anomaly detection model is configured to: extract a rule-based classification feature value associated with a rule-based classification feature type, determine a target range for the rule-based classification feature type, and determine the rule-based partitioning anomaly detection label for the first predictive input based at least in part on the rule-based classification feature value and the target range for the rule-based classification feature type that is associated with the rule-based classification feature value. ### Claim 14 (depends on 13) The system of claim 13, wherein: the first predictive input is associated with an input feature value associated with an input feature type; the input feature type is associated with the target range; the randomized partitioning anomaly detection machine learning model is associated with an isolation tree that is generated based at least in part on the input feature type, and the rule-based partitioning anomaly detection model is associated with the rule-based classification feature type. ### Claim 15 One or more non-transitory computer-readable media storing processor-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising: receive a plurality of predictive inputs for a three-tiered unsupervised anomaly detection machine learning framework and an anomaly detection label for a filtered predictive input, wherein (i) the three-tiered unsupervised anomaly detection machine learning framework comprises (a) a randomized partitioning anomaly detection machine learning model, (b) a rule-based partitioning anomaly detection model, and (c) a clustering machine learning model, and (ii) the anomaly detection label for the filtered predictive input is generated by the three-tiered unsupervised anomaly detection machine learning framework by: determining, using the randomized partitioning anomaly detection machine learning model, a randomized partitioning anomaly detection label for a first predictive input of the plurality of predictive inputs, in response to a first determination that the first predictive input is associated with an affirmative randomized partitioning anomaly detection label, determining, using the rule-based partitioning anomaly detection model, a rule-based partitioning anomaly detection label based at least in part on the first predictive input, identifying the first predictive input as the filtered predictive input by excluding a second predictive input, of the plurality of predictive inputs, from the plurality of predictive inputs based on a second determination that the second predictive input is not associated with an affirmative rule-based partitioning anomaly detection label, determining, using the clustering machine learning model, an input cluster based at least in part on the filtered predictive input, determining an anomaly designation for the input cluster based at least in part on a ground-truth anomaly detection label for a highest utility filtered predictive input in the input cluster, and in response to determining that the anomaly designation for the input cluster is an affirmative anomaly designation, determining the anomaly detection label for the filtered predictive input based at least in part on a cluster distribution ratio of: (i) an input utility measure for the filtered predictive input, and (ii) a cluster utility measure for the highest utility filtered predictive input in the input cluster; and initiating performance of an operational load balancing operation for a computing system configured to perform one or more investigatory actions based at least in part on the anomaly detection label. ### Claim 16 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein determining the anomaly detection label for the filtered predictive input further comprises: in response to determining that the cluster distribution ratio for the filtered predictive input satisfies a proximity cluster distribution ratio threshold, determining that the filtered predictive input is associated with a high anomaly detection label. ### Claim 17 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein determining the anomaly detection label for the filtered predictive input further comprises: in response to determining that the cluster distribution ratio for the filtered predictive input fails to satisfy a proximity cluster distribution ratio threshold, determining that the filtered predictive input is associated with a low anomaly detection label. ### Claim 18 (depends on 17) The one or more non-transitory computer-readable media of claim 17, further comprising: in response to determining that another anomaly designation for another input cluster is a negative anomaly designation, determining a negative anomaly detection label. ### Claim 19 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the rule-based partitioning anomaly detection model is configured to: extract a rule-based classification feature value associated with a rule-based classification feature type, determine a target range for the rule-based classification feature type, and determine the rule-based partitioning anomaly detection label for the first predictive input based at least in part on the rule-based classification feature value and the target range for the rule-based classification feature type that is associated with the rule-based classification feature value. ### Claim 20 (depends on 19) The one or more non-transitory computer-readable media of claim 19, wherein: the first predictive input is associated with an input feature value associated with an input feature type; the input feature type is associated with a target range; the randomized partitioning anomaly detection machine learning model is associated with an isolation tree that is generated based at least in part on the input feature type, and the rule-based partitioning anomaly detection model is associated with the rule-based classification feature type.