Systems and methods of optimizing machine learning models for automated anomaly detection

A computerized method of using machine learning models for anomaly detection in a set of accounts, the method comprising:

• clustering training data comprising account information into a set of clusters, via a clustering model, based on input features for the accounts by:
• receiving the training data comprising data points defining each feature of the input features for each account in the set of accounts held by an entity, the training data comprising historical data characterizing each said account in terms of the input features for the accounts, each cluster clustering similar accounts having similarities between one or more associated features in the data points;
• determining, for each of the clusters, a particular feature distribution pattern for accounts contained therein including a median and a degree of deviation, the particular feature defined as related to the anomaly detection;
• identifying particular data points within each cluster having outlier data based on the particular feature distribution for that cluster and labelling each data point within each cluster as to whether outlier or normal and forming an updated training data set comprising the labelling;
• training a tree classification model based on the updated training data set being labelled for detecting anomaly;
• extracting rules from the tree classification model to generate a rules executable for anomaly spotting, the tree classification model being trained to define combinations of feature characteristics resulting in outlier data;
• and, applying the rules executable to new customer data having said feature characteristics to determine a classification of whether outlier or normal.

A computer program product comprising a non-transient storage device storing instructions that when executed by at least one processor of a computing device, configure the computing device for using machine learning models for anomaly detection in a set of accounts, the instructions executable by the at least one processor to perform the steps of:

• clustering training data comprising account information into a set of clusters, via a clustering model, based on input features for the accounts by:
• receiving the training data comprising data points defining each feature of the input features for each account in the set of accounts held by an entity, the training data comprising historical data characterizing each said account in terms of the input features for the accounts, each cluster clustering similar accounts having similarities between one or more associated features in the data points;
• determining, for each of the clusters, a particular feature distribution pattern for accounts contained therein including a median and a degree of deviation, the particular feature defined as related to the anomaly detection;
• identifying particular data points within each cluster having outlier data based on the particular feature distribution for that cluster and labelling each data point within each cluster as to whether outlier or normal and forming an updated training data set comprising the labelling;
• training a tree classification model based on the updated training data set being labelled for detecting anomaly;
• extracting rules from the tree classification model to generate a rules executable for anomaly spotting, the tree classification model being trained to define combinations of feature characteristics resulting in outlier data;
• and, applying the rules executable to new customer data having said feature characteristics to determine a classification of whether outlier or normal.