Monitoring effects of forcible actions over a normalized feature set
One or more systems, devices, computer program products and/or computer implemented methods of use provided herein relate to a process of monitoring the effect of forcible actions over a normalized feature set. A system can comprise a memory that stores computer executable components, and a processor that executed the computer executable components stored in the memory, wherein the computer executable components can comprise an input component that can receive one or more forcible actions as input from a user that correspond to an identified anomaly instance of a cluster, an evaluation component that can evaluate an effect of the one or more forcible actions executed over time on the system, and a notification component that can notify the user that a true-positive detection threshold has been reached for a cluster such that true-positives are not detected in the cluster.
1 . A system comprising:
a memory that stores computer executable components; and
a processor that executes at least one of the computer executable components that:
monitors an anomaly detection clustering engine, wherein the monitoring comprises:
receiving, via a user interface device, one or more forcible actions as input from a user that correspond to an identified anomaly instance of a cluster, wherein the one or more forcible actions comprise a user selection to push or pull the identified anomaly instance between clusters or between hierarchical levels of the clusters in the anomaly detection clustering engine;
storing historical metadata describing the one or more forcible actions;
evaluating, over a plurality of anomaly detection iterations, an effect of the one or more forcible actions executed over time on a performance metric of the anomaly detection clustering engine, wherein the evaluating comprises determining, from historical metadata, that a saturation point has occurred in which additional forcible actions would cause the anomaly detection clustering engine to fail to detect true-positives within the cluster; and
notifying the user that the saturation point and a true-positive detection threshold have been reached for the cluster such that true-positives are not detected in the cluster by the anomaly detection clustering engine.
2 . The system of claim 1 , wherein the one or more forcible actions include pulling the identified anomaly instance within a specified group of the clusters.
3 . The system of claim 2 , wherein the identified anomaly instance is pulled from one or more hierarchical levels of clusters in the specified group.
4 . The system of claim 1 , wherein the identified anomaly instance is pushed from a current distance from a specified group of the clusters to a farther distance from the specified group.
5 . The system of claim 4 , wherein the one or more forcible actions include pushing the identified anomaly instance from the specified group of the clusters pertaining to one or more hierarchical levels of the clusters in the specified group.
6 . The system of claim 1 , wherein the at least one of the computer executable components identifies a group and a stack level of the identified anomaly instance and generates group metadata corresponding to the identified anomaly instance.
7 . The system of claim 1 , wherein the at least one of the computer executable components identifies a cluster to anomaly match of the identified anomaly instance to determine whether a confidence threshold of the anomaly detection clustering engine has been breached.
8 . A computer implemented method of monitoring an effect of forcible actions over a normalized feature set, comprising:
monitoring, using a processor, an anomaly detection clustering engine, wherein the monitoring comprises:
receiving, via a user interface device, one or more forcible actions as input from a user that correspond to an identified anomaly instance of a cluster, wherein the one or more forcible actions comprise a user selection to push or pull the identified anomaly instance between clusters or between hierarchical levels of the clusters in the anomaly detection clustering engine;
storing historical metadata describing the one or more forcible actions;
evaluating, over a plurality of anomaly detection iterations, an effect of the one or more forcible actions executed over time on a performance metric of the anomaly detection clustering engine, wherein the evaluating comprises determining, from historical metadata, that a saturation point has occurred in which additional forcible actions would cause the anomaly detection clustering engine to fail to detect true-positives within the cluster; and
notifying the user that the saturation point and a true-positive detection threshold have been reached for the cluster such that true-positives are not detected in the cluster by the anomaly detection clustering engine.
9 . The computer implemented method of claim 8 , wherein the one or more forcible actions include pulling the identified anomaly instance within a specified group of the clusters.
10 . The computer implemented method of claim 9 , wherein the identified anomaly instance is pulled from one or more hierarchical levels of clusters in the specified group.
11 . The computer implemented method of claim 8 , wherein the identified anomaly instance is pushed from a current distance from a specified group of the clusters to a farther distance from the specified group.
12 . The computer implemented method of claim 11 , wherein the one or more forcible actions include pushing the identified anomaly instance from the specified group of the clusters pertaining to one or more hierarchical levels of the clusters in the specified group.
13 . The computer implemented method of claim 8 , further comprising:
identifying, using the processor, a group and a stack level of the identified anomaly instance; and
generating, using the processor, group metadata corresponding to the identified anomaly instance.
14 . The computer implemented method of claim 8 , further comprising:
identifying, via the processor, a cluster to anomaly match of the identified anomaly instance to determine whether a confidence threshold of the anomaly detection clustering engine has been breached.
15 . A computer program product for monitoring an effect of forcible actions over a normalized feature set, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
monitor an anomaly detection clustering engine, wherein the monitoring comprises:
receiving, via a user interface device, one or more forcible actions as input from a user that correspond to an identified anomaly instance of a cluster, wherein the one or more forcible actions comprise a user selection to push or pull the identified anomaly instance between clusters or between hierarchical levels of the clusters in the anomaly detection clustering engine;
storing historical metadata describing the one or more forcible actions;
evaluating, over a plurality of anomaly detection iterations, an effect of the one or more forcible actions executed over time on a performance metric of the anomaly detection clustering engine, wherein the evaluating comprises determining, from historical metadata, that a saturation point has occurred in which additional forcible actions would cause the anomaly detection clustering engine to fail to detect true-positives within the cluster; and
notifying the user that the saturation point and a true-positive detection threshold have been reached for the cluster such that true-positives are not detected in the cluster by the anomaly detection clustering engine.
16 . The computer program product of claim 15 , wherein the one or more forcible actions include pulling the identified anomaly instance within a specified group of the clusters.
17 . The computer program product of claim 16 , wherein the identified anomaly instance is pulled from one or more hierarchical levels of clusters in the specified group.
18 . The computer program product of claim 15 , wherein the identified anomaly instance is pushed from a current distance from a specified group of the clusters to a farther distance from the specified group.
19 . The computer program product of claim 15 , wherein the program instructions further cause the processor to:
identify a group and a stack level of the identified anomaly instance; and
generate group metadata corresponding to the identified anomaly instance.
20 . The computer program product of claim 15 , wherein the program instructions further cause the processor to:
identify a cluster to anomaly match of the identified anomaly instance to determine whether a confidence threshold of the anomaly detection clustering engine has been breached.