ARBITRATION ENGINE FOR CONSOLIDATING ANOMALY DETECTION MEthODS

A method comprising:

• at a computing platform comprising at least one processor, a communication interface, and memory:
• training, using historical system status information, a plurality of anomaly detection engines, wherein each of the plurality of anomaly detection engines corresponds to a different machine learning model, and wherein training the plurality of anomaly detection engines configures each of the plurality of anomaly detection engines to output, for given system status inputs, a binary value indicating whether or not the system status input indicates an anomaly, and a confidence level associated with the binary value;
• monitoring a system to collect system status information;
• inputting the system status information into each of the plurality of anomaly detection engines, wherein each of the plurality of anomaly detection engines outputs, based on the system status information, a corresponding binary value indicating whether the system status information is anomalous according to a given anomaly detection engine, and a corresponding confidence level associated with the corresponding binary value;
• inputting the binary values and the corresponding confidence levels into an arbitration engine, wherein the arbitration engine generates a weighted average of the corresponding confidence levels and binary values;
• comparing the weighted average to a predetermined threshold value;
• based on identifying that the weighted average meets or exceeds the predetermined threshold value, labelling the system as experiencing anomalous behavior;
• and
• executing one or more corrective actions to address the anomalous behavior.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• train, using historical system status information, a plurality of anomaly detection engines, wherein each of the plurality of anomaly detection engines corresponds to a different machine learning model, and wherein training the plurality of anomaly detection engines configures each of the plurality of anomaly detection engines to output, for given system status inputs, a binary value indicating whether or not the system status input indicates an anomaly, and a confidence level associated with the binary value;
• monitor a system to collect system status information;
• input the system status information into each of the plurality of anomaly detection engines, wherein each of the plurality of anomaly detection engines outputs, based on the system status information, a corresponding binary value indicating whether the system status information is anomalous according to a given anomaly detection engine, and a corresponding confidence level associated with the corresponding binary value;
• input the binary values and the corresponding confidence levels into an arbitration engine, wherein the arbitration engine generates a weighted average of the corresponding confidence levels and binary values;
• compare the weighted average to a predetermined threshold value;
• based on identifying that the weighted average meets or exceeds the predetermined threshold value, label the system as experiencing anomalous behavior;
• and
• execute one or more corrective actions to address the anomalous behavior.