# US 2025/0086083 A1 · Systems and methods for detection of anomalous events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0086083 A1 - Document ID: US20250086083A1 - Status: Published application - Kind: A1 - Application number: 18/466,096 - Filed: 2023-09-13 - Published: 2025-03-13 - Earliest claimed: 2023-09-13 - Applicants: The Toronto-Dominion Bank - Inventors: Tarundeep Dhot; Mohsen Raza; Katarzyna Dorota Wyroslak; Bote Jiang; Abdullah Al Hamour Al Jarad; Thibakar Sanderalingam - Web page: https://patentgrep.com/patent/US20250086083A1 ## CPC - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/328: {Computer systems status display (G06F11/327 takes precedence)} - G06F 2201/81: Threshold - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for processing high volumes of event data to produce a plurality of metrics and determining threshold baselines at which to alert to anomalous event activity. Raw event data is processed into staging tables comprises of the plurality of metrics. Baselines are determined based on one or more past instances of the time segment in a given cycle. Monitoring interfaces are also provided to aid rapid identification of anomalous activity. ## Claims ### Claim 1 A system for identifying anomalies in event activity data, the system comprising: a plurality of data sources comprising at least a first data source and a second data source; a first microservice processor configured to process the first data source to form a first plurality of metrics for a time segment; a second microservice processor configured to process the second data source to form a second plurality of metrics for the time segment; a monitoring processor configured to: obtain the first plurality of metrics for the time segment from the first microservice processor; obtain the second plurality of metrics for the time segment from the second microservice processor; update a staging table with the first and second plurality of metrics; compute a first threshold baseline for the first plurality of metrics based on one or more past instances of the time segment; compute a second threshold baseline for the second plurality of metrics based on the one or more past instances of the time segment; display a first indication of the first plurality of metrics in a dashboard, wherein the first indication is indicative that the first plurality of metrics exceeds the first threshold baseline; and display a second indication of the second plurality of metrics in the dashboard. ### Claim 2 (depends on 1) The system of claim 1, wherein the second indication is indicative that second first plurality of metrics exceeds the second threshold baseline, and wherein the second indication is displayed proximally with the first indication. ### Claim 3 (depends on 2) The system of claim 2, wherein the first and second indication comprise a connection indicator between the first and second indication. ### Claim 4 (depends on 1) The system of claim 1, further comprising: at least one additional microservice processor, each microservice processor configured to process a respective data source to form a respective plurality of metrics for the time segment, wherein the monitoring processor is further configured to, for each respective one of the at least one additional microservice processor: obtain the respective plurality of metrics for the time segment; update the staging table with the respective plurality of metrics; compute a respective threshold baseline for the respective plurality of metrics based on the one or more past instances of the time segment; and display a respective indication of the respective plurality of metrics in the dashboard. ### Claim 5 (depends on 1) The system of claim 1, further comprising an agent processor, the agent processor configured to: monitor the dashboard for the first indication; when the first indication is indicative that the first plurality of metrics exceeds the first threshold baseline, generate a natural language summary of the first indication; and transmit the natural language summary of the first indication to a message service. ### Claim 6 (depends on 5) The system of claim 5, wherein the agent processor is further configured to monitor the message service for a command instruction and, in response to receipt of the command instruction, interact with the dashboard. ### Claim 7 (depends on 6) The system of claim 6, wherein the interacting with the dashboard interface comprises retrieving additional detail from the dashboard interface regarding the first indication. ### Claim 8 (depends on 1) The system of claim 1, wherein the first microservice processor processes the first data source in a pipelined process for the time segment by querying the first data source for data associated with the time segment. ### Claim 9 A method for identifying anomalies in event activity data from a plurality of data sources having at least a first data source and a second data source, the method comprising a monitoring processor: obtaining a first plurality of metrics for a time segment; obtaining a second plurality of metrics for the time segment; updating a staging table with the first and second plurality of metrics; computing a first threshold baseline for the first plurality of metrics based on one or more past instances of the time segment; computing a second threshold baseline for the second plurality of metrics based on the one or more past instances of the time segment; displaying a first indication of the first plurality of metrics in a dashboard, wherein the first indication is indicative that the first plurality of metrics exceeds the first threshold baseline; and displaying a second indication of the second plurality of metrics in the dashboard. ### Claim 10 (depends on 9) The method of claim 9, wherein the first plurality of metrics is obtained from a first microservice processor configured to process the first data source to form the first plurality of metrics for the time segment. ### Claim 11 (depends on 10) The method of claim 10, wherein the second plurality of metrics is obtained from a second microservice processor configured to process the second data source to form the second plurality of metrics for the time segment. ### Claim 12 (depends on 9) The method of claim 9, wherein the second indication is indicative that second first plurality of metrics exceeds the second threshold baseline, and wherein the second indication is displayed proximally with the first indication. ### Claim 13 (depends on 9) The method of claim 9, wherein the first and second indication comprise a connection indicator between the first and second indication. ### Claim 14 (depends on 9) The method of claim 9, further comprising: at least one additional microservice processor processing a respective data source to form a respective plurality of metrics for the time segment. ### Claim 15 (depends on 14) The method of claim 14, further comprising the monitoring processor, for each respective one of the at least one additional microservice processor: obtaining the respective plurality of metrics for the time segment; updating the staging table with the respective plurality of metrics; computing a respective threshold baseline for the respective plurality of metrics based on the one or more past instances of the time segment; and displaying a respective indication of the respective plurality of metrics in the dashboard. ### Claim 16 (depends on 9) The method of claim 9, further comprising an agent processor: monitoring the dashboard for the first indication; when the first indication is indicative that the first plurality of metrics exceeds the first threshold baseline, generating a natural language summary of the first indication; and transmitting the natural language summary of the first indication to a message service. ### Claim 17 (depends on 16) The method of claim 16, further comprising the agent processor monitoring the message service for a command instruction and, in response to receipt of the command instruction, interacting with the dashboard interface. ### Claim 18 (depends on 17) The method of claim 17, wherein the interacting with the dashboard interface comprises retrieving additional detail from the dashboard interface regarding the first indication. ### Claim 19 (depends on 10) The method of claim 10, wherein the first microservice processor processes the first data source in a pipelined process for the time segment by querying the first data source for data associated with the time segment. ### Claim 20 A non-transitory computer readable medium storing computer executable instructions which, when executed by at least one computer processor, cause the at least one computer processor to carry out a method for identifying anomalies in transaction activity data a plurality of data sources having at least a first data source and a second data source, the method comprising: obtaining a first plurality of metrics for a time segment; obtaining a second plurality of metrics for the time segment; updating a staging table with the first and second plurality of metrics; computing a first threshold baseline for the first plurality of metrics based on one or more past instances of the time segment; computing a second threshold baseline for the second plurality of metrics based on the one or more past instances of the time segment; displaying a first indication of the first plurality of metrics in a dashboard, wherein the first indication is indicative that the first plurality of metrics exceeds the first threshold baseline; and displaying a second indication of the second plurality of metrics in the dashboard.