Unsupervised anomaly detection using lookahead pairs

A system for detecting anomalies in sequences of actions using lookahead pairs (LAPs), the system comprising:

• one or more processors;
• and
• at least one memory coupled to the one or more processors and storing instructions that, when executed by the one or more processors, cause the system to perform operations including:
• receiving, over a communications network, a sequence of actions performed by a user during an active session;
• generating a set of LAPs of interest based on the received sequence of actions, wherein generating the set of LAPs of interest includes:
• storing recent actions of the sequence of actions in a data structure;
• designating a most recent action of the stored recent actions as a fixed target action;
• and
• iterating backward through previous actions in the data structure and pairing the fixed target action with one or more of the previous actions, wherein for each respective previous action encountered during the backward iteration, a LAP of interest is generated that indicates (i) the fixed target action most recently performed by the user, (ii) the respective previous action performed by the user before the fixed target action, and (iii) a determined count of intermediate gap actions performed by the user after the performance of the respective previous action and up to the performance of the fixed target action;
• and
• selectively flagging the set of LAPs of interest as anomalies based on whether they appear in a LAP database including a plurality of historical LAPs each indicating a previously observed pair of actions and a count of intermediate actions observed between the previously observed pair of actions, the selective flagging including, for each respective LAP of interest:
• refraining from flagging the respective LAP of interest as an anomaly if the LAP database indicates that the respective LAP of interest is associated with a frequency count of observances greater than or equal to a minimum threshold;
• and
• flagging the respective LAP of interest as an anomaly if the LAP database indicates that the respective LAP of interest is associated with a frequency count of observances less than the minimum threshold or if the respective LAP of interest does not appear in the LAP database.