Multi-layer anomaly detector

Abstract

Multi-layer anomaly detection identifies and issues alerts to focus limited resources on the most concerning activities detected in voluminous data. A multi-layer anomaly detector includes a clusterer, a forecaster, and a statistics generator to respectively generate a first, second, and third anomaly lists for input data indicating voluminous events relative to one or more domains, such as access to computing devices; access to real estate; or financial transactions. An ensemble detector may generate an ensemble anomaly list indicating a subset of the voluminous events based on the first, second, and third anomaly lists. The lists may indicate anomaly (e.g., security risk) scores. The ensemble anomaly list may combine the anomaly (e.g., risk) scores in the first, second, and third anomaly lists. An identifier may generate an alert for the subset of events, e.g., with relative security risk scores for the relevant individuals, entities, and/or events.

Dependencies are inferred from the claim text.