US 12,647,439 B2 · System and method for machine learning based anomaly detection

Abstract

A computerized system and method may process and detect anomalies in input data using of machine learning models and techniques. A computerized system comprising one or more processors, a memory, and a communication interface to communicate via a communication network with remote computing devices, may be used for assembling a signal based on event data items; calculating an anomaly score for the signal, which may describe a change or difference between the signal and past signals; generating an alert based on the calculated score; presenting the alert on an output computer display; and allowing or reversing data transfers performed over a communication network between physically separate computer systems based on the anomaly score. Some embodiments of the invention may include performing peer anomaly detection context anomaly detection as two separate and distinct anomaly detection procedures, using separate and distinct machine learning models and algorithms.

Claims17

Dependent claims

A method of detecting anomalies, the method comprising, using a computer processor:

assembling, by the processor, a signal based on one or more event data items;
determining, by the processor, a first anomaly score by automatically organizing, via a first machine learning model, one or more of the past signals in a decision tree, wherein the anomaly score is calculated based on the organization, and wherein the first machine learning model is an unsupervised machine learning model;
determining, by the processor, a second anomaly score by clustering, via a second machine learning model, a plurality of entities into one or more groups based on one or more event data items, and
determining, by the processor, a final anomaly score by consolidating the first anomaly score and the second anomaly score;
generating, by the processor, an alert based on the final anomaly score;
and
presenting, by the processor, the alert on an output computer display.

4 more elements

A method of machine learning based anomaly detection, the method comprising, using a computer processor:

creating, by the processor, a signal based on one or more event data items;
fetching a plurality of past signals based on a predefined time period;
automatically sorting, by a first machine learning model, one or more of the past signals in a first decision tree;
computing, by the processor, a first anomaly rank for the signal based on the first decision tree;
automatically sorting, by a second machine learning model, one or more of the past signals in a second decision tree;
computing, by the processor, a second anomaly rank for the signal based on the second decision tree;
calculating, by the processor, a final anomaly rank, the calculating of a final anomaly rank comprising weighting the first anomaly rank and the second anomaly rank;
generating, by the processor, a notification based on the calculated final anomaly rank;
and
displaying, by the processor, the notification on a user interface (UI);
wherein the sorting of signals in a first decision tree and the sorting of signals in a second decision tree are performed in parallel.

8 more elements

Dependencies are inferred from the claim text.

System and method for machine learning based anomaly detection

Life of this patent

System and method for machine learning based anomaly detection

Life of this patent

Abstract

Claims17