Anomaly detection using processor-based machine learning models trained using cross-validation training datasets

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory;
• the at least one processing device being configured to implement the following steps:
• accessing data of a plurality of data structures, wherein each data structure corresponds to a different item grouping of one or more items and comprises a plurality of feature values related to the corresponding item grouping, wherein the plurality of feature values comprises a first feature group comprising one or more first feature values related to an entity associated with the corresponding item grouping and a second feature group comprising one or more second feature values related to the corresponding item grouping, and wherein the entity associated with the corresponding item grouping is one of a plurality of entities associated with the plurality of data structures;
• in response to obtaining additional data corresponding to a given item grouping of one or more items and being associated with a given entity:
• identifying a selected machine learning (ML) model, wherein the selected ML model is selected from a plurality of ML models trained using a cross-validation training process that processes data structures associated with entities having positive instances of one or more designated anomalous events, wherein training data for a given entity comprises data from data structures associated with positive instances of the one or more designated anomalous events for one or more different entities than the given entity;
• applying feature associated with the additional data corresponding to the given item grouping to the selected ML model to obtain data characterizing an anomaly result;
• and
• initiating one or more processing steps based at least in part on the anomaly result.

A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:

• accessing data of a plurality of data structures, wherein each data structure corresponds to a different item grouping of one or more items and comprises a plurality of feature values related to the corresponding item grouping, wherein the plurality of feature values comprises a first feature group comprising one or more first feature values related to an entity associated with the corresponding item grouping and a second feature group comprising one or more second feature values related to the corresponding item grouping, and wherein the entity associated with the corresponding item grouping is one of a plurality of entities associated with the plurality of data structures;
• in response to obtaining additional data corresponding to a given item grouping of one or more items and being associated with a given entity;
• identifying a selected machine learning (ML) model, wherein the selected ML model is selected from a plurality of ML models trained using a cross-validation training process that processes data structures associated with entities having positive instances of one or more designated anomalous events, wherein training data for a given entity comprises data from data structures associated with positive instances of the one or more designated anomalous events for one or more different entities than the given entity;
• applying feature values associated with the additional data corresponding to the given item grouping to the selected ML model to obtain data characterizing an anomaly result;
• and
• initiating one or more processing steps based at least in part on the anomaly result.