Optimizing accuracy of security alerts based on data classification

A method for a computing system to train one or more machine-learning models to perform anomaly detection, the method comprising:

• accessing a training dataset;
• determining an overall sensitivity score for the training dataset, the overall sensitivity score indicative of an amount of sensitive data included in the training dataset;
• and
• training one or more machine-learning models to perform anomaly detection based on the training dataset and the overall sensitivity score, the one or more machine-learning models using the sensitivity score to determine a threshold, wherein the determined threshold is configured such that a low threshold value is determined when the amount of sensitive data included in the training dataset is relatively high and a high threshold value is determined when the amount of sensitive data included in the training dataset is relatively low, wherein:
• when the one or more machine-learning models are executed by one or more processors, the one or more machine-learning models are configured to determine if a probability score of one or more features extracted from a received dataset are above the determined threshold when a second overall sensitivity score of the received dataset is substantially similar to the overall sensitivity score of the training dataset;
• and
• in response to determining that the probability score is above the determined threshold, causing an alert to be generated, the alert indicating that an anomaly has been detected.

A method for a computing system to perform anomaly detection, the method comprising:

• executing one or more machine-learning models trained based on a training dataset, wherein training the one or more machine-learning models comprises:
• determining an overall sensitivity score for the training dataset, the overall sensitivity score indicative of an amount of sensitive data included in the dataset;
• and
• using the overall sensitivity score to determine a threshold, wherein the determined threshold is configured such that a low threshold value is determined when the amount of sensitive data included in the training dataset is relatively high and a high threshold value is determined when the amount of sensitive data included in the training dataset is relatively low;
• receiving a dataset at the computing system;
• determining if a probability score of one or more features extracted from the received dataset are above the determined threshold when a second overall sensitivity score of the received dataset is substantially similar to the overall sensitivity score of the training dataset;
• and
• in response to determining that the probability score is above the determined threshold, generating an alert, the alert indicating that an anomaly has been detected.