System and method for anomaly detection in dynamically evolving data using hybrid decomposition

1. In a computer system, a method comprising:

a) receiving a plurality of measurements m of multidimensional data points (MDDPs), each data point having n≥2 features, wherein the data forms a matrix A with size m×n and a rank 0<k≤n and wherein n<<m;

b) applying randomized lower and upper triangular matrix (LU) decomposition to matrix A using l random projections and rank k of matrix A to obtain a dictionary D in the form of a matrix of size l×n, wherein k<l<m;

c) embedding dictionary D in a lower dimension space that has a dimension r lower than n, thereby obtaining an embedded dictionary D that has a plurality of embedded data points;

d) determining an average distance D nn between each embedded data point and a respective nearest neighbor;

e) applying a Gaussian mixture fit with an expectation-maximization (EM) function to a plurality of average distances D nn to obtain Gaussians associated by respective probabilities with elements in D nn ;

f) deriving a threshold T from a posterior probability for each element in D nn ; and

g) classifying the MDDP or a newly arrived MDDP (NAMDDP) as an anomaly if a D nn associated with the MDDP or the NAMDDP is larger than T, while requiring smaller computational effort and having faster processing due to the reduction in size from m to l and the reduction in dimension from n to r, thereby enhancing anomaly detection performance.

2. The method of claim 1 , further comprising:

repeating step (b) p≥1 times to obtain p additional dictionaries D(p);

concatenating each additional dictionary D(p) with all previously obtained dictionaries into a concatenated dictionary Dc; and

embedding concatenated dictionary Dc into the lower dimension space to obtain an embedded concatenated dictionary Dc,

whereby the repeating step (b) p≥1 times removes randomization effects related to the randomized LU decomposition, thereby providing a more robust embedded space and improving anomaly detection performance.

3. The method of claim 2 , further comprising: preparing an alert related to the anomaly and sending the alert to a data client system.

4. The method of claim 1 , further comprising: preparing an alert related to the anomaly and sending the alert to a data client system.

5. The method of claim 1 , further comprising: preparing an alert related to the anomaly and sending the alert to a data client system.

6. A computer program product, comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:

a) receiving a plurality of measurements m of multidimensional data points (MDDPs), each data point having n≥2 features, wherein the data forms a matrix A with size m×n and a rank 0<k≤n and wherein n<<m;

b) applying randomized lower and upper triangular matrix (LU) decomposition to matrix A using l random projections and rank k of matrix A to obtain a dictionary D in the form of a matrix of size l×n, wherein k<l<m;

c) embedding dictionary D in a lower dimension space that has a dimension r lower than n, thereby obtaining an embedded dictionary D that has a plurality of embedded data points;

d) determining an average distance D nn between each embedded data point and a respective nearest neighbor;

e) applying a Gaussian mixture fit with an expectation-maximization (EM) function to a plurality of average distances D nn to obtain Gaussians associated by respective probabilities with elements in D nn ;

f) deriving a threshold T from a posterior probability for each element in D nn ; and

g) classifying the MDDP or a newly arrived MDDP (NAMDDP) as an anomaly if a D nn associated with the MDDP or the NAMDDP is larger than T, while requiring smaller computational effort and having faster processing due to the reduction in size from m to l and the reduction in dimension from n to r, thereby enhancing anomaly detection performance.

7. The computer program product of claim 6 , wherein the method further comprises:

repeating step (b) p≥1 times to obtain p additional dictionaries D(p);

concatenating each additional dictionary D(p) with all previously obtained dictionaries into a concatenated dictionary Dc; and

embedding concatenated dictionary Dc into the lower dimension space to obtain an embedded concatenated dictionary Dc,

whereby the repeating step (b) p≥1 times removes randomization effects related to the randomized LU decomposition, thereby providing a more robust embedded space and improving anomaly detection performance.

8. The computer program product of claim 7 , wherein the method further comprises: preparing an alert related to the anomaly and sending the alert to a data client system.

9. The computer program product of claim 6 , wherein the method further comprises: preparing an alert related to the anomaly and sending the alert to a data client system.

10. The computer program product of claim 6 , wherein the method further comprises: preparing an alert related to the anomaly and sending the alert to a data client system.

11. A computer system, comprising a hardware processor configurable to perform a method comprising:

a) receiving a plurality of measurements m of multidimensional data points (MDDPs), each data point having n≥2 features, wherein the data forms a matrix A with size m×n and a rank 0<k≤n and wherein n<<m;

b) applying randomized lower and upper triangular matrix (LU) decomposition to matrix A using l random projections and rank k of matrix A to obtain a dictionary D in the form of a matrix of size l×n, wherein k<l<m;

c) using dictionary D to form a reduced dimension embedded space with a dimension r smaller than n, the embedded space including a plurality of embedded data points;

d) determining an average distance D nn between each embedded data point and a respective nearest neighbor;

e) applying a Gaussian mixture fit with an expectation-maximization (EM) function to a plurality of average distances D nn to obtain Gaussians associated by respective probabilities with elements in D nn ;

f) deriving a threshold T from a posterior probability for each element in D nn ; and

g) classifying the MDDP or a newly arrived MDDP (NAMDDP) as an anomaly if a D nn associated with the MDDP or the NAMDDP is larger than T, while requiring smaller computational effort and having faster processing due to the reduction in size from m to l and the reduction in dimension from n to r, thereby enhancing anomaly detection performance.

12. The computer system of claim 11 , wherein the method further comprises:

repeating step (b) p≥1 times to obtain p additional dictionaries D(p);

concatenating each additional dictionary D(p) with all previously obtained dictionaries into a concatenated dictionary Dc; and

embedding concatenated dictionary Dc into the lower dimension space to obtain an embedded concatenated dictionary Dc,

whereby the repeating step (b) p≥1 times removes randomization effects related to the randomized LU decomposition, thereby providing a more robust embedded space and improving anomaly detection performance.

13. The computer system of claim 12 , wherein the method further comprises: preparing an alert related to the anomaly and sending the alert to a data client system.

14. The computer system of claim 11 , wherein the method further comprises: preparing an alert related to the anomaly and sending the alert to a data client system.

15. The computer system of claim 11 , wherein the method further comprises: preparing an alert related to the anomaly and sending the alert to a data client system.