Multiple Domain Anomaly Detection System and Method Using Fusion Rule and Visualization

A fusion rule-based anomaly detection system, the system comprising:

• a learning agent for each domain configured to transmit a piece of new information to a data mining engine module operatively connected to the learning agent;
• a normal data profile for each domain executable on a CPU and a memory unit of a computer, wherein the normal data profile is created by a generic learning procedure and data collection using the learning agent;
• an anomaly detection engine module for each domain operatively connected to the data mining engine module for each domain, wherein the anomaly detection engine is configured to compare the piece of new information against the normal data profile to derive an anomaly score for each domain;
• a multiple-domain anomaly detection system operatively connected to a plurality of domain-specific anomaly detection systems, wherein each domain-specific anomaly detection system contains its own learning agent, its own normal data profile, and its own anomaly detection engine;
• a fusion rule executable on a CPU and a memory unit of the multiple-domain anomaly detection system, wherein the fusion rule derives a multiple-domain anomaly score based on an analysis of anomaly scores for each domain or other outputs from the plurality of domain-specific anomaly detection systems;
• and
• a data network operatively connecting the multiple-domain anomaly detection system and the plurality of domain-specific anomaly detection systems for data communication.