Data transaction anomaly detection enhancement
AssigneeInternational Business Machines Corporation
InventorsBo Chen Zhu, Mai Zeng, Min Cheng, Sheng Yan Sun, Meng Wan
Life of this patent
Estimating the term…
Abstract
Noisy data parsed from raw data can be received. The noisy data indicates first transaction events determined to be noise in the raw data. Using the noisy data, a first detection model can be trained to assign anomaly event indicators to second transaction events. The first detection model can receive an anomaly record. The anomaly record can indicate at least a portion of anomalous transaction events identified in runtime data. The first detection mode can assign the anomaly event indicators to the anomalous transaction events. The anomaly event indicators can indicate levels of severity of the anomalous transaction events identified in the runtime data.
Claims20
A method, comprising:
- receiving noisy data parsed from raw data, the noisy data indicating a plurality of first transaction events determined to be noise in the raw data;
- generating a plurality of vector pairs corresponding to the plurality of first transaction events, each vector pair of the plurality of vector pairs comprising a delta value for a respective first transaction event of the plurality of first transaction events and a value of the respective transaction event of the plurality of first transaction events, wherein the delta value is a difference between the value of the respective transaction event and a closest baseline value;
- training, using the noisy data, the plurality of vector pairs, and a processor, a first detection model to assign anomaly event indicators to second transaction events;
- receiving, by the first detection model, an anomaly record, the anomaly record indicating at least a portion of anomalous transaction events identified in runtime data;
- and
- assigning, by the first detection model, the anomaly event indicators to the anomalous transaction events, the anomaly event indicators indicating levels of severity of the anomalous transaction events identified in the runtime data.
A system, comprising:
- one or more processors;
- and
- one or more memory devices coupled to the one or more processors, wherein the one or more processors are configured to:
- receive noisy data parsed from raw data, the noisy data indicating a plurality of first transaction events determined to be noise in the raw data;
- generate a plurality of vector pairs corresponding to the plurality of first transaction events, each vector pair of the plurality of vector pairs comprising a delta value for a respective first transaction event of the plurality of first transaction events and a value of the respective transaction event of the plurality of first transaction events, wherein the delta value is a difference between the value of the respective transaction event and a closest baseline value;
- train, using the noisy data and the plurality of vector pairs, a first detection model to assign anomaly event indicators to second transaction events;
- receive, using the first detection model, an anomaly record, the anomaly record indicating at least a portion of anomalous transaction events identified in runtime data;
- and
- assign, using the first detection model, the anomaly event indicators to the anomalous transaction events, the anomaly event indicators indicating levels of severity of the anomalous transaction events identified in the runtime data.
A non-transitory computer-readable medium storing a set of instructions for wireless communication, the set of instructions comprising:
- one or more instructions that, when executed by one or more processors of a device, cause the device to:
- receive noisy data parsed from raw data, the noisy data indicating a plurality of first transaction events determined to be noise in the raw data;
- generate a plurality of vector pairs corresponding to the plurality of first transaction events, each vector pair of the plurality of vector pairs comprising a delta value for a respective first transaction event of the plurality of first transaction events and a value of the respective transaction event of the plurality of first transaction events, wherein the delta value is a difference between the value of the respective transaction event and a closest baseline value;
- train, using the noisy data and the plurality of vector pairs, a first detection model to assign anomaly event indicators to second transaction events;
- receive, using the first detection model, an anomaly record, the anomaly record indicating at least a portion of anomalous transaction events identified in runtime data;
- and
- assign, using the first detection model, the anomaly event indicators to the anomalous transaction events, the anomaly event indicators indicating levels of severity of the anomalous transaction events identified in the runtime data.
Dependencies are inferred from the claim text.