Systems and methods for detection of anomalous entities

A system for identifying anomalous entities in a dataset, comprising:

• a data interface for communicating with a storage unit storing thereon at least one dataset;
• a program store storing code;
• and
• a processor coupled to the data interface and the program store for implementing the stored code, the code comprising:
• code to access said storage unit and to select a subset comprising a plurality of training entities from a plurality of entities of at least one dataset;
• code to determine a plurality of dummy tuplets of entities in the subset by applying a permutation function on a plurality of real tuplets, wherein the real tuplets represent original and normal data of the at least one dataset, wherein the dummy tuplets represent anomalous data based on artificially created data not found in the original and normal at least one dataset, each one of the plurality of real tuplets and dummy tuplets comprises at least two of the plurality of training entities;
• code to analyze the plurality of dummy tuplets and the plurality of real tuplets to identify at least one predefined characteristic relation that statistically differentiates between the real tuplets and the dummy tuplets according to a distinguishing requirement;
• and
• code to identify at least one of a normal entity and an anomalous entity in the at least one dataset or in a newly received dataset according to said at least one predefined characteristic relation.

A computer program product comprising a non-transitory computer readable storage medium storing program code thereon for implementation by a processor of a system for identifying anomalous entities in a dataset, comprising:

• instructions to access a storage unit and to select a subset comprising a plurality of training entities from a plurality of entities of at least one dataset stored in said storage unit;
• instructions to determine a plurality of dummy tuplets of entities in the subset by applying a permutation function on a plurality of real tuplets, wherein the real tuplets represent original and normal data of the at least one dataset, wherein the dummy tuplets represent anomalous data based on artificially created data not found in the original and normal at least one dataset, each one of the plurality of real tuplets and dummy tuplets comprises at least two of the plurality of training entities;
• instructions to analyze the plurality of dummy tuplets and the plurality of real tuplets to identify at least one predefined characteristic relation that statistically differentiates between the real tuplets and the dummy tuplets according to a distinguishing requirement;
• and
• instructions to identify at least one of a normal entity and an anomalous entity in the at least one dataset or in a newly received dataset according to said at least one predefined characteristic relation.