Anomaly detection by classifying past behavior

A system for detecting anomalies in a system by an anomaly detector, comprising:

• a memory;
• a processor coupled to the memory, wherein the processor is further configured to:
• receive a trained machine learning model that detects anomalies;
• receive a set of new inputs from the system;
• set a label for each of the set of new inputs to a value indicating normal operation of the system;
• train a new anomaly detection model using incremental learning to update the trained machine learning model using the labeled set of new inputs;
• receive a set of past model inputs with an associated label;
• produce a verification set by inputting the set of past model inputs into the new anomaly detection model;
• and
• compare the verification set with the labelled past model inputs to determine if an anomaly is present.

A non-transitory machine-readable storage medium encoded with instructions for execution by an anomaly detector, the non-transitory machine-readable storage medium, comprising:

• instructions for receiving a trained machine learning model that detects anomalies;
• instructions for receiving a set of new inputs by the anomaly detector from the system;
• instructions for setting a label for each of the set of new inputs to a value indicating normal operation of the system;
• instructions for training a new anomaly detection model using incremental learning to update the trained machine learning model using the labeled set of new inputs;
• instructions for receiving a set of past model inputs with an associated label;
• instructions for producing a verification set by inputting the set of past model inputs into the new anomaly detection model;
• and
• instructions for comparing the verification set with the labelled past model inputs to determine if an anomaly is present.