Information fusion for multiple anomaly detection systems

2:

• The method as recited in claim 1, wherein said normal profiles are generated from analyzing or mining historical data from a knowledge repository of structured or unstructured data sources or both, discovering knowledge patterns in a unified process, wherein examples of said structured data sources including data types from spreadsheets, databases and XML data, wherein examples of said unstructured data sources including free text input, word, html, pdf and ppt documents, wherein said unified process is used to represent said structured and unstructured data and input to said method separately or jointly, wherein said knowledge patterns are also called normal profiles, being stored within a collection of mining models, wherein said mining model is a mathematical model without predefined formula or pre-defined factors or attributes.

3:

• The method of claim 2, wherein said mining models are shared and accessed by a network of a plurality of anomaly detection systems powered by the said method, wherein each said anomaly detection system is dedicated to a single collection of said structured or unstructured data in a single application domain, wherein said mining model represents knowledge patterns discovered from said data collection in said domain, wherein said network, said data sources and said knowledge patterns can be of cross-domain in order to facilitate cross-validation of said knowledge patterns with the benefits to reduce false alarm rates, wherein said fusion rules of claim, independent of any application domains of said method, are applied to said network so that a collaborative decision of said degree of anomalousness in claim can be made, wherein said collaborative decision is dependent on new factors discovered from all the data in said cross domains and independent of pre-defined rules from any domain experts.

4:

• The method of claim 1, wherein said assessing a piece of information includes comparing it against said normal profiles in claim 1, calculating a degree of association or correlation said information with said normal profiles, and determining an anomaly score, wherein said anomaly score is a measure of distance of said information from existing knowledge represented in said normal files, wherein said anomaly score is data-driven, computed from previously unknown factors discovered from said data in said application domain in claim 1.

5:

• The method of claim 4, wherein assessing a piece of information includes calculating said anomaly scores, generating said collaborative decision from said network of systems and from said fusion rules for a piece of real-time information, wherein said real-time information comes from a plurality of search interfaces, a plurality of real-time data feed mechanisms or a plurality of data subscriptions.

6:

• A method of representing anomaly scores structurally easily for interpreting and visualizing the scores, wherein said method determines data-driven, previously unknown factors that have highest probability to trigger a critical event using said anomaly scores from said method in claim 4, wherein said previously unknown factors are discovered from the data dependent on application domains.

7:

• The method of claim 6, wherein triggering a critical event includes processing a network of said anomaly scores and decides which fusion rules being triggered, wherein said fusion rule is domain-specific, data-driven and derived from said knowledge patterns or normal profiles, wherein triggering a said rule includes first evaluating sequentially a large-scale collection of said normal profiles from a network of shared systems and anomaly scores and then forms a single fusion rule that triggers said critical event.

8:

• A method of recursively sorting critical events among said network of anomaly detection systems in claim 5 including creating a critical event object data structure that contains at least a reference to said information and said calculated anomaly score, categorizing critical events with a severity score attached to each category so that said sorting of said critical events can be done quickly and communicated among said network, wherein said severity score for said critical event category is computed from said fusion rules and said collaborative decisions, wherein final critical events in said data structures are passed a single interface that be invoked anywhere in said network for visualization, allowing for all triggered fusion rules said to be explored, involving, for example, the time a fusion rule is triggered, the critical event name, and said severity or categorization of the critical event.

9:

• The computer program that stores instructions executable by one or more processors to perform said method for assessing a piece of information against a plurality of said normal profiles and deciding a degree of anomalousness, fusing a plurality of said anomaly scores, independent of said pre-define expert rules and dependent of said previously unknown factors, from said network of anomaly detection systems, for analyzing said data sources of cross-domain, and generating said fusion rule independent of any pre-defined rules from experts, for applying said method to processing said real-time information, for triggering a critical event from the said sorting and categorizing of critical events and pass them into a single visualization interface in claim 8.