System and method for anomaly detection in dynamically evolving data using hybrid decomposition
A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features; constructing a dictionary D based on the received data; embedding dictionary D into a lower dimension embedded space; and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.
1. In a computer system, a method comprising:
a) receiving data comprising a plurality of measurements m of multidimensional data points (MDDPs), each data point having n features wherein n≥3, wherein m>>n and wherein the data forms a matrix A with size m×n and rank k;
b) applying randomized lower and upper triangular matrix (LU) decomposition to matrix A to obtain a dictionary D in the form of a matrix l×n, wherein k<l, wherein k<<m and wherein accordingly dictionary D has fewer measurements than matrix A;
c) applying a kernel method to dictionary D to obtain an embedded dictionary D with a dimension lower than n by normalizing dictionary D to obtain a normalized Markov matrix with a respective dimension and reducing the respective dimension of the normalized Markov matrix to obtain embedded dictionary D; and
d) based on embedded dictionary D, classifying a MDDP or a newly arrived MDDP (NAMDDP) as an anomaly using a Gaussian mixture fit,
whereby the reduction in the number of measurements from m to l and further reducing the dimension n to a dimension lower than n reduces computer processing requirements, thereby enhancing anomaly detection performance.
2. The method of claim 1 , further comprising:
e) repeating (b) p≥1 times to obtain p additional dictionaries D(p);
f) concatenating each additional dictionary D(p) with all previously obtained dictionaries into a concatenated dictionary Dc; and
g) applying the kernel method to concatenated dictionary D to obtain an embedded concatenated dictionary D with a dimension lower than n,
whereby the repeating (b) p≥1 times provides a more robust embedded concatenated dictionary Dc and improves anomaly detection performance.
3. The method of claim 1 , wherein the classifying a MDDP or a newly arrived MDDP (NAMDDP) as an anomaly includes classifying without relying on a signature and/or a rule and/or on domain expertise.
4. A computer program product, comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:
a) receiving data comprising a plurality of measurements m of multidimensional data points (MDDPs), each data point having n features wherein n≥3, wherein m>>n and wherein the data forms a matrix A with size m×n and rank k;
b) applying randomized lower and upper triangular matrix (LU) decomposition to matrix A to obtain a dictionary D in the form of a matrix l×n, wherein k<l, wherein k<<m and wherein accordingly dictionary D has fewer measurements than matrix A;
c) applying a kernel method to dictionary D to obtain an embedded dictionary D with a dimension lower than n by normalizing dictionary D to obtain a normalized Markov matrix with a respective dimension and reducing the respective dimension of the normalized Markov matrix to obtain embedded dictionary D; and
d) based on embedded dictionary D, classifying a MDDP or a newly arrived MDDP(NAMDDP) as an anomaly using a Gaussian mixture fit,
whereby the reduction in the number of measurements from m to l and further reducing the dimension n to a dimension lower than n reduces computer processing requirements, thereby enhancing anomaly detection performance.
5. The computer program product of claim 4 , wherein the method further comprises:
e) repeating (b) p≥1 times to obtain p additional dictionaries D(p);
f) concatenating each additional dictionary D(p) with all previously obtained dictionaries into a concatenated dictionary Dc; and
g) applying the kernel method to concatenated dictionary D to obtain an embedded concatenated dictionary D with a dimension lower than n,
whereby the repeating (b) p≥1 times provides a more robust embedded concatenated dictionary Dc and improves anomaly detection performance.
6. The computer program product of claim 4 , wherein the classifying a MDDP or a newly arrived MDDP(NAMDDP) as an anomaly includes classifying without relying on a signature and/or a rule and/or on domain expertise.
7. A computer system, comprising a hardware processor configurable to perform a method comprising steps of:
a) receiving data comprising a plurality of measurements m of multidimensional data points (MDDPs), each data point having n features wherein n≥3, wherein m>>n and wherein the data forms a matrix A with size m×n and rank k;
b) applying randomized lower and upper triangular matrix (LU) decomposition to matrix A to obtain a dictionary D in the form of a matrix l×n, wherein k<l, wherein k<<m and wherein accordingly dictionary D has fewer measurements than matrix A;
c) applying a kernel method to dictionary D to obtain an embedded dictionary D with a dimension lower than n by normalizing dictionary D to obtain a normalized Markov matrix with a respective dimension and reducing the respective dimension of the normalized Markov matrix to obtain embedded dictionary D; and
d) based on embedded dictionary D, classifying a MDDP or a newly arrived MDDP(NAMDDP) as an anomaly using a Gaussian mixture fit,
whereby the reduction in the number of measurements from m to l and further reducing the dimension n to a dimension lower than n reduces computer processing requirements, thereby enhancing anomaly detection performance.
8. The computer system of claim 7 , wherein the method further comprises:
e) repeating (b) p≥1 times to obtain p additional dictionaries D(p);
f) concatenating each additional dictionary D(p) with all previously obtained dictionaries into a concatenated dictionary Dc; and
g) applying the kernel method to concatenated dictionary D to obtain an embedded concatenated dictionary D with a dimension lower than n,
whereby the repeating (b) p≥1 times removes randomization effects related to the randomized LU decomposition by causing eigenvalues of each dictionary D to decline, thereby providing a more robust embedded concatenated dictionary Dc and improving anomaly detection performance.
9. The computer system of claim 8 , wherein the classifying a MDDP or a newly arrived MDDP(NAMDDP) as an anomaly includes classifying without relying on a signature and/or a rule and/or on domain expertise.
10. The computer system of claim 7 , wherein the classifying a MDDP or a newly arrived MDDP(NAMDDP) as an anomaly includes classifying without relying on a signature and/or a rule and/or on domain expertise.