Incorporating feedback in anomaly detection performed by unsupervised learning

A non-transitory machine-readable medium storing one or more sequences of instructions for classifying items as anomalous or non-anomalous, wherein execution of said one or more instructions by one or more processors contained in a digital processing system causes said digital processing system to perform the actions of:

• performing a first machine learning (ML) technique on a large set of data items to identify a primary cluster containing data items classified as non-anomalous, with the rest of the data items classified as anomalous;
• performing a second ML technique on said large set of data items to identify a set of secondary clusters;
• receiving feedback on the classification of at least some of said large set of data items;
• maintaining a feedback data associating said feedback with each secondary cluster of said set of secondary clusters;
• receiving a first indication to find a classification of a first data item of said large set of data items;
• identifying as a first result, whether said first data item is non-anomalous or anomalous based on whether said first data item belongs to said primary cluster or not;
• determining, based on a first secondary cluster to which said first data item belongs and said feedback associated with said first secondary cluster, whether said first result is to be modified;
• if said first result is to be modified and said first result is non-anomalous, changing said first result from non-anomalous to anomalous;
• if said first result is to be modified and said first result is anomalous, changing said first result from anomalous to non-anomalous;
• and
• providing said first result as said classification for said first data item.

A digital processing system comprising:

• a random access memory (RAM) to store instructions for classifying items as anomalous or non-anomalous;
• and
• one or more processors to retrieve and execute the instructions, wherein execution of the instructions causes the digital processing system to perform the actions of:
• performing a first machine learning (ML) technique on a large set of data items to identify a primary cluster containing data items classified as non-anomalous, with the rest of the data items classified as anomalous;
• performing a second ML technique on said large set of data items to identify a set of secondary clusters;
• receiving feedback on the classification of at least some of said large set of data items;
• maintaining a feedback data associating said feedback with each secondary cluster of said set of secondary clusters;
• receiving a first indication to find a classification of a first data item of said large set of data items;
• identifying as a first result, whether said first data item is non-anomalous or anomalous based on whether said first data item belongs to said primary cluster or not;
• determining, based on a first secondary cluster to which said first data item belongs and said feedback associated with said first secondary cluster, whether said first result is to be modified;
• if said first result is to be modified and said first result is non-anomalous, changing said first result from non-anomalous to anomalous;
• if said first result is to be modified and said first result is anomalous, changing said first result from anomalous to non-anomalous;
• and
• providing said first result as said classification for said first data item.