Anomaly detection

Abstract

A computer implemented method for detecting anomalous behaviour within a system is provided. The method generates an autoencoder for detecting anomalous behaviour within the system. The method also generates a classifier for predicting a classification of behaviour within the system. An input to the classifier comprises an output from one or more internal layers of the autoencoder. The method jointly trains the autoencoder and the classifier using a set of training data comprising a plurality of sample inputs that represent normal behaviour within the system and a plurality of sample inputs that represent anomalous behaviour within the system. The training is based on an output from a joint loss function that is configured to combine any reconstruction loss from the autoencoder with any prediction error from the classifier. The joint loss function is further configured to negate any reconstruction loss of the autoencoder in response to the sample input representing anomalous behaviour within the system. The trained autoencoder is used to classify a behaviour of the system as being normal or anomalous.

Dependencies are inferred from the claim text.