Distributed machine learning for anomaly detection

An apparatus, comprising:

• hardware processors;
• computer memory holding computer program instructions executed by the hardware processors for anomaly detection in association with an enterprise environment, the computer program instructions configured to:
• provide first machine learning to train at least a first and a second analytic, the first analytic corresponding to a first use case, and the second analytic corresponding to a second use case distinct from the first use case;
• output anomaly information derived from the first machine learning, the anomaly information including data points detected as a result of applying the first and second analytics;
• and
• provide second machine learning based on the anomaly information to capture a correlation among observed parameters in at least the first and second use cases;
• wherein the first machine learning takes place in an enterprise network, and the second machine learning takes place in a cloud computing environment distinct from the enterprise network.

A computer program product in a non-transitory computer readable medium for use in first and second data processing systems for anomaly detection in association with an enterprise environment, the computer program product holding computer program instructions that, when executed by a respective one of the first and second data processing systems, are configured to:

• provide first machine learning to train at least a first and a second analytic, the first analytic corresponding to a first use case, and the second analytic corresponding to a second use case distinct from the first use case;
• output anomaly information derived from the first machine learning, the anomaly information including data points detected as a result of applying the first and second analytics;
• and
• provide second machine learning based on the anomaly information to capture a correlation among observed parameters in at least the first and second use cases;
• wherein the first machine learning takes place in the first data processing system within an enterprise network, and the second machine learning takes place in the second data processing system located in a cloud computing environment distinct from the enterprise network.