Interpretable supervised anomaly detection for determining reasons for unsupervised anomaly decision
Techniques are provided for determining reasons for unsupervised anomaly decisions. One method comprises obtaining values of predefined features associated with a remote user device; applying the predefined feature values to an unsupervised anomaly detection model that generates an unsupervised anomaly decision; applying the predefined feature values to a supervised anomaly detection model that generates a supervised anomaly decision; determining a third anomaly decision using the unsupervised anomaly decision; and determining reasons for the third anomaly decision by analyzing the supervised anomaly decision. The supervised anomaly detection model can be trained using the unsupervised anomaly decision and/or anomalous training data based on known anomalies. The third anomaly decision can be based on the supervised anomaly decision and the unsupervised anomaly decision using ensemble techniques.
1. A method, comprising:
receiving at a network monitoring device implemented by a cloud infrastructure values of one or more predefined features associated with a remote user device that is separate from the cloud infrastructure;
applying the values of the one or more predefined features to an unsupervised anomaly detection model that generates an unsupervised anomaly decision by identifying at least one previously-unknown pattern in the values of the one or more features associated with the remote user device;
applying the values of the one or more predefined features to a supervised anomaly detection model that generates a supervised anomaly decision based on at least one input-output pair in a labeled training dataset, wherein the supervised anomaly detection model is trained at least in part using anomalous training data based on known anomalies and supplemental training data that includes generated fraudulent attacks that are underrepresented in the anomalous training data;
determining a third anomaly decision based on the supervised anomaly decision with the unsupervised anomaly decision using ensemble techniques;
determining one or more reasons for the third anomaly decision by analyzing the supervised anomaly decision to identify one or more instances in which a value associated with a feature violated a rule of the supervised anomaly detection model,
executing a predefined remediation step in response to the third anomaly decision, wherein the predefined remediation step includes restricting the remote user device from accessing a network in response to the third anomaly decision by autonomously adjusting a network permission that controls which resources the remote user device and a user account associated with the remote user device may access; and
performing a feature importance analysis to identify one or more features that are most predictive in detecting an anomaly for a future anomaly detection instance, wherein the feature importance analysis includes a feature interaction analysis to identify two or more features that have a dependency relationship;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , wherein a decision logic of the unsupervised anomaly detection model is not exposed to a user.
3. The method of claim 1 , wherein the supervised anomaly detection model is trained at least in part using the unsupervised anomaly decision.
4. The method of claim 1 , wherein the supervised anomaly detection model comprises a nearest neighbor model and wherein the values of the one or more predefined features associated with the remote user device are assigned to a substantially closest data point in the nearest neighbor model, and wherein the determining the one or more reasons for the third anomaly decision comprises identifying an anomaly type of the substantially closest data point in the nearest neighbor model.
5. The method of claim 1 , wherein the supervised anomaly detection model comprises a logistic regression classifier model and the determining the one or more reasons for the third anomaly decision comprises identifying one or more of the predefined features associated with the remote user device that contributed to the supervised anomaly decision.
6. The method of claim 1 , wherein the supervised anomaly detection model comprises a Naive Bayes classifier model that estimates a first likelihood of an anomalous class and a second likelihood of a non-anomalous class given each of the predefined features and the determining the one or more reasons for the third anomaly decision comprises identifying one or more of the predefined features associated with the remote user device that contributed to one or more of the first likelihood and the second likelihood.
7. The method of claim 1 , further comprising assigning an importance to one or more of the predefined features based on features appearing in the supervised anomaly detection model.
8. The method of claim 1 , wherein the third anomaly decision is used to detect one or more predefined anomalies comprising one or more of a risk anomaly, a security level anomaly, a fraud likelihood anomaly, an identity assurance anomaly, and a behavior anomaly.
9. The method of claim 1 , further comprising obtaining feedback from a human analyst indicating one or more reasons for the third anomaly decision.
10. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured to implement the following steps:
receiving at a network monitoring device implemented by a cloud infrastructure values of one or more predefined features associated with a remote user device that is separate from the cloud infrastructure;
applying the values of the one or more predefined features to an unsupervised anomaly detection model that generates an unsupervised anomaly decision by identifying at least one previously-unknown pattern in the values of the one or more features associated with the remote user device;
applying the values of the one or more predefined features to a supervised anomaly detection model that generates a supervised anomaly decision based on at least one input-output pair in a labeled training dataset, wherein the supervised anomaly detection model is trained at least in part using anomalous training data based on known anomalies and supplemental training data that includes generated fraudulent attacks that are underrepresented in the anomalous training data;
determining a third anomaly decision based on the supervised anomaly decision with the unsupervised anomaly decision using ensemble techniques;
determining one or more reasons for the third anomaly decision by analyzing the supervised anomaly decision to identify one or more instances in which a value associated with a feature violated a rule of the supervised anomaly detection model;
performing a feature importance analysis to identify one or more features that are most predictive in detecting an anomaly for a future anomaly detection instance, wherein the feature importance analysis includes a feature interaction analysis to identify two or more features that have a dependency relationship;
executing a predefined remediation step in response to the third anomaly decision, wherein the predefined remediation step includes restricting the remote user device from accessing a network in response to the third anomaly decision by autonomously adjusting a network permission that controls which resources the remote user device may access and by quarantining one or more files associated with the user device from the network.
11. The apparatus of claim 10 , wherein the supervised anomaly detection model is trained at least in part using one or more of the unsupervised anomaly decision and anomalous training data based on known anomalies.
12. The apparatus of claim 10 , further comprising obtaining feedback from a human analyst indicating one or more reasons for the third anomaly decision.
13. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
receiving at a network monitoring device implemented by a cloud infrastructure values of one or more predefined features associated with a remote user device that is separate from the cloud infrastructure;
applying the values of the one or more predefined features to an unsupervised anomaly detection model that generates an unsupervised anomaly decision by identifying at least one previously-unknown pattern in the values of the one or more features associated with the remote user device;
applying the values of the one or more predefined features to a supervised anomaly detection model that generates a supervised anomaly decision based on at least one input-output pair in a labeled training dataset, wherein the supervised anomaly detection model is trained at least in part using anomalous training data based on known anomalies and supplemental training data that includes generated fraudulent attacks that are underrepresented in the anomalous training data;
determining a third anomaly decision based on the supervised anomaly decision with the unsupervised anomaly decision using ensemble techniques;
determining one or more reasons for the third anomaly decision by analyzing the supervised anomaly decision to identify one or more instances in which a value associated with a feature violated a rule of the supervised anomaly detection model;
performing a feature importance analysis to identify one or more features that are most predictive in detecting an anomaly for a future anomaly detection instance, wherein the feature importance analysis includes a feature interaction analysis to identify two or more features that have a dependency relationship;
executing a predefined remediation step in response to the third anomaly decision, wherein the predefined remediation step includes restricting the remote user device from accessing a network in response to the third anomaly decision by autonomously adjusting a network permission that controls which resources the remote user device may access and by deactivating a user account associated with the remote user device.
14. The non-transitory processor-readable storage medium of claim 13 , wherein the supervised anomaly detection model is trained at least in part using one or more of the unsupervised anomaly decision.