Analytic system to incrementally update a support vector data description for outlier identification

A computing device comprising:

• a processor;
• and
• a non-transitory computer-readable medium operably coupled to the processor, the computer-readable medium having computer-readable instructions stored thereon that, when executed by the processor, cause the computing device to
• compute a Gaussian similarity matrix between a plurality of observation vectors, wherein each observation vector of the plurality of observation vectors includes a variable value for each variable of a plurality of variables;
• compute an inverse Gaussian similarity matrix from the computed Gaussian similarity matrix;
• compute a row sum vector that includes a row sum value computed from each row of the computed inverse Gaussian similarity matrix;
• select a set of boundary support vectors from the plurality of observation vectors;
• (a) select a new observation vector from an event stream or from an input dataset;
• (b) compute an acceptance value for the selected new observation vector using the selected set of boundary support vectors, the computed row sum vector, and the new observation vector;
• (c) when the computed acceptance value is greater than zero, compute an incremental vector from the computed inverse Gaussian similarity matrix and the selected new observation vector;
• (d) when the computed acceptance value is greater than zero and when a maximum value of the computed incremental vector is less than a first predefined tolerance value, output an indicator that the selected new observation vector is an abnormal observation vector relative to the selected set of boundary support vectors;
• and
• (e) repeat (a) to (d) until the event stream is stopped or a last observation vector is selected from the input dataset in (a).

A method of iteratively updating a support vector data description for outlier identification, the method comprising:

• computing, by a computing device, a Gaussian similarity matrix between a plurality of observation vectors, wherein each observation vector of the plurality of observation vectors includes a variable value for each variable of a plurality of variables;
• computing, by the computing device, an inverse Gaussian similarity matrix from the computed Gaussian similarity matrix;
• computing, by the computing device, a row sum vector that includes a row sum value computed from each row of the computed inverse Gaussian similarity matrix;
• selecting, by the computing device, a set of boundary support vectors from the plurality of observation vectors;
• (a) selecting, by the computing device, a new observation vector from an event stream or from an input dataset;
• (b) computing, by the computing device, an acceptance value for the selected new observation vector using the selected set of boundary support vectors, the computed row sum vector, and the new observation vector;
• (c) when the computed acceptance value is greater than zero, computing, by the computing device, an incremental vector from the computed inverse Gaussian similarity matrix and the selected new observation vector;
• (d) when the computed acceptance value is greater than zero and when a maximum value of the computed incremental vector is less than a first predefined tolerance value, outputting, by the computing device, an indicator that the selected new observation vector is an abnormal observation vector relative to the selected set of boundary support vectors;
• and
• (e) repeating, by the computing device, (a) to (d) until the event stream is stopped or a last observation vector is selected from the input dataset in (a).