Systems and methods for scalable anomaly detection frameworks

A computer-implemented method, comprising:

• receiving a plurality of source-specific anchor values;
• generating a plurality of model features;
• implementing a plurality of trained source-specific classification models each associated with at least one of the plurality of source-specific anchor values and each configured to receive a subset of the plurality of model features, wherein each of the plurality of trained source-specific classification models is configured to classify the associated at least one of the plurality of source-specific anchor values as one of anomalous or non-anomalous;
• implementing a trained weighted classification model to generate an optimal anchor value, wherein the optimal anchor value includes a weighted aggregation of each of the plurality of source-specific anchor values identified as non-anomalous;
• and
• generating an optimal reference value based on the optimal anchor value.

A non-transitory computer readable medium having instructions stored thereon, wherein the instructions, when executed by at least one processor, cause at least one device to perform operations comprising:

• receiving a feature value;
• receiving a plurality of source-specific anchor values;
• generating a plurality of model features;
• implementing a plurality of trained source-specific classification models each associated with at least one of the plurality of source-specific anchor values and each configured to receive a subset of the plurality of model features, wherein each of the plurality of trained source-specific classification models is configured to classify the associated at least one of the plurality of source-specific anchor values as one of anomalous or non-anomalous;
• implementing a trained weighted classification model to generate an optimal anchor value, wherein the optimal anchor value includes a weighted aggregation of each of the plurality of source-specific anchor values identified as non-anomalous;
• generating an optimal reference value based on the optimal anchor value;
• comparing the optimal reference value to a received feature value;
• labeling the received feature value as anomalous or non-anomalous based on the comparison;
• and
• in response to labeling the feature value as anomalous, generating a notification.