Data transaction anomaly detection enhancement

1 . A method, comprising:

receiving noisy data parsed from raw data, the noisy data indicating a plurality of first transaction events determined to be noise in the raw data;

generating a plurality of vector pairs corresponding to the plurality of first transaction events, each vector pair of the plurality of vector pairs comprising a delta value for a respective first transaction event of the plurality of first transaction events and a value of the respective transaction event of the plurality of first transaction events, wherein the delta value is a difference between the value of the respective transaction event and a closest baseline value;

training, using the noisy data, the plurality of vector pairs, and a processor, a first detection model to assign anomaly event indicators to second transaction events;

receiving, by the first detection model, an anomaly record, the anomaly record indicating at least a portion of anomalous transaction events identified in runtime data; and

assigning, by the first detection model, the anomaly event indicators to the anomalous transaction events, the anomaly event indicators indicating levels of severity of the anomalous transaction events identified in the runtime data.

2 . The method of claim 1 ,

wherein the first detection model comprises:

a plurality of cluster cells, each cluster cell, of the plurality of cluster cells representing a respective transaction event group; and

a respective cluster radius for each cluster cell.

3 . The method of claim 2 ,

wherein the training, using the noisy data, the first detection model to assign the anomaly event indicators to the second transaction events comprises:

determining transaction event groups based on the plurality of vector pairs; and

clustering the transaction event groups into the plurality of cluster cells.

4 . The method of claim 1 ,

wherein the assigning, by the first detection model, the anomaly event indicators to the anomalous transaction events comprises:

selecting an anomalous transaction event from the anomaly record;

determining a distance between the selected anomalous transaction event and each of a plurality of cluster cells; and

determining the selected anomalous transaction event to belong to a transaction event group based on the distance between the selected transaction event and the cluster cell for that transaction event group being less than or equal to a radius of the cluster cell.

5 . The method of claim 1 ,

wherein the assigning, by the first detection model, the anomaly event indicators to the anomalous transaction events comprises:

selecting an anomalous transaction event from the anomaly record;

determining a distance between the selected anomalous transaction event and each of a plurality of cluster cells; and

determining a transaction event group to which the selected anomalous transaction event is closest.

6 . The method of claim 1 ,

wherein the receiving, by the first detection model, the anomaly record comprises receiving the anomaly record, using the first detection model, from a second detection model processing the runtime data.

7 . The method of claim 1 , further comprising:

outputting, by the first detection model, augmented anomaly transaction events, the augmented anomaly transaction events comprising the anomaly event indicators;

receiving at least one user input indicating an augmented anomaly transaction event is incorrectly identified; and

responsive to receiving the at least one user input indicating the augmented anomaly transaction event is incorrectly identified, refining, based on the at least one user input, the first detection model to improve accuracy of the first detection model at determining the augmented anomaly transaction events.

8 . A system, comprising:

one or more processors; and

one or more memory devices coupled to the one or more processors, wherein the one or more processors are configured to:

receive noisy data parsed from raw data, the noisy data indicating a plurality of first transaction events determined to be noise in the raw data;

generate a plurality of vector pairs corresponding to the plurality of first transaction events, each vector pair of the plurality of vector pairs comprising a delta value for a respective first transaction event of the plurality of first transaction events and a value of the respective transaction event of the plurality of first transaction events, wherein the delta value is a difference between the value of the respective transaction event and a closest baseline value;

train, using the noisy data and the plurality of vector pairs, a first detection model to assign anomaly event indicators to second transaction events;

receive, using the first detection model, an anomaly record, the anomaly record indicating at least a portion of anomalous transaction events identified in runtime data; and

assign, using the first detection model, the anomaly event indicators to the anomalous transaction events, the anomaly event indicators indicating levels of severity of the anomalous transaction events identified in the runtime data.

9 . The system of claim 8 ,

wherein the first detection model comprises:

a plurality of cluster cells, each cluster cell, of the plurality of cluster cells, representing a respective transaction event group; and

a respective cluster radius for each cluster cell.

10 . The system of claim 9 ,

wherein the one or more processors, to train the first detection model, are configured to:

determine transaction event groups based on the plurality of vector pairs; and

cluster the transaction event groups into the plurality of cluster cells.

11 . The system of claim 8 ,

wherein the one or more processors, to assign the anomaly event indicators to the anomalous transaction events, are configured to:

select an anomalous transaction event from the anomaly record;

determine a distance between the selected anomalous transaction event and each of a plurality of cluster cells; and

determine the selected anomalous transaction event to belong to a transaction event group based on the distance between the selected transaction event and the cluster cell for that transaction event group being less than or equal to a radius of the cluster cell.

12 . The system of claim 8 ,

wherein the one or more processors, to assign the anomaly event indicators to the anomalous transaction events, are configured to:

select an anomalous transaction event from the anomaly record;

determine a distance between the selected anomalous transaction event and each of a plurality of cluster cells; and

determine a transaction event group to which the selected anomalous transaction event is closest.

13 . The system of claim 8 ,

wherein the one or more processors, to receive, the anomaly record, are configured to:

receive, using the first detection model, the anomaly record from a second detection model processing the runtime data.

14 . The system of claim 8 , the one or more processors are configured to:

output, by the first detection model, augmented anomaly transaction events, the augmented anomaly transaction events comprising the anomaly event indicators;

receive at least one user input indicating an augmented anomaly transaction event is incorrectly identified; and

responsive to receiving the at least one user input indicating the augmented anomaly transaction event is incorrectly identified, refine, based on the at least one user input, the first detection model to improve accuracy of the first detection model at determining the augmented anomaly transaction events.

15 . A non-transitory computer-readable medium storing a set of instructions for wireless communication, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

receive noisy data parsed from raw data, the noisy data indicating a plurality of first transaction events determined to be noise in the raw data;

generate a plurality of vector pairs corresponding to the plurality of first transaction events, each vector pair of the plurality of vector pairs comprising a delta value for a respective first transaction event of the plurality of first transaction events and a value of the respective transaction event of the plurality of first transaction events, wherein the delta value is a difference between the value of the respective transaction event and a closest baseline value;

train, using the noisy data and the plurality of vector pairs, a first detection model to assign anomaly event indicators to second transaction events;

receive, using the first detection model, an anomaly record, the anomaly record indicating at least a portion of anomalous transaction events identified in runtime data; and

assign, using the first detection model, the anomaly event indicators to the anomalous transaction events, the anomaly event indicators indicating levels of severity of the anomalous transaction events identified in the runtime data.

16 . The non-transitory computer-readable medium of claim 15 ,

wherein the first detection model comprises:

a plurality of cluster cells, each cluster cell, of the plurality of cluster cells representing a respective transaction event group; and

a respective cluster radius for each cluster cell.

17 . The non-transitory computer-readable medium of claim 16 ,

wherein the one or more instructions, to cause the device to train the first detection model, cause the device to:

determine transaction event groups based on the plurality of vector pairs; and

cluster the transaction event groups into the plurality of cluster cells.

18 . The non-transitory computer-readable medium of claim 15 ,

wherein the one or more instructions, to cause the device to assign the anomaly event indicators to the anomalous transaction events, cause the device to:

select an anomalous transaction event from the anomaly record;

determine a distance between the selected anomalous transaction event and each of a plurality of cluster cells; and

determine the selected anomalous transaction event to belong to a transaction event group based on the distance between the selected transaction event and the cluster cell for that transaction event group being less than or equal to a radius of the cluster cell.

19 . The non-transitory computer-readable medium of claim 15 ,

wherein the one or more instructions, to cause the device to assign the anomaly event indicators to the anomalous transaction events, cause the device to:

select an anomalous transaction event from the anomaly record;

determine a distance between the selected anomalous transaction event and each of a plurality of cluster cells; and

determine a transaction event group to which the selected anomalous transaction event is closest.

20 . The non-transitory computer-readable medium of claim 15 ,

wherein the one or more instructions, to cause the device to receive the anomaly record, cause the device to:

receive, using the first detection model, the anomaly record from a second detection model processing the runtime data.