Addressing structured false positives during asset anomaly detection
Techniques are described with regard to addressing structured false positives in the context of detecting asset anomalies in a computing environment. An associated computer-implemented method includes applying an anomaly detection machine learning model to each of a plurality of assets in order to determine a plurality of anomaly assets among the plurality of assets. The plurality of anomaly assets are determined based upon a model anomaly risk score calculated for each of the plurality of assets consequent to asset event data analysis. The method further includes calculating a structured false positive score for each of the plurality of anomaly assets during a current structured false positive time window. The method further includes retraining the anomaly detection machine learning model responsive to determining that a threshold value of anomaly assets among the plurality of anomaly assets have a structured false positive score exceeding a structured false positive threshold value.
1 . A computer-implemented method comprising:
applying an anomaly detection machine learning model to each of a plurality of assets in a computing environment in order to determine a plurality of anomaly assets among the plurality of assets based upon a model anomaly risk score calculated for each of the plurality of assets consequent to asset event data analysis;
calculating a structured false positive score for each of the plurality of anomaly assets during a current structured false positive time window;
calculating a total anomaly risk score for each of the plurality of anomaly assets by deducting the structured false positive score calculated for each of the plurality of anomaly assets from the model anomaly risk score calculated for each of the plurality of anomaly assets; and
retraining the anomaly detection machine learning model responsive to determining that a threshold value of anomaly assets among the plurality of anomaly assets have a structured false positive score exceeding a structured false positive threshold value.
2 . The computer-implemented method of claim 1 , further comprising:
responsive to user input, providing a model retraining summary via at least one user application interface, wherein the model retraining summary includes structured false positive data and a listing of anomaly assets among the plurality of anomaly assets having a structured false positive score calculated during the current structured false positive time window that exceeds the structured false positive threshold value.
3 . The computer-implemented method of claim 1 , wherein configuring the anomaly detection machine learning model comprises:
parsing respective behavioral attributes from event data associated with one or more of the plurality of assets; and
training the anomaly detection machine learning model by applying at least one classification algorithm to derive associations between the respective behavioral attributes and each of a plurality of asset types.
4 . The computer-implemented method of claim 3 , wherein configuring the anomaly detection machine learning model further comprises:
training the anomaly detection machine learning model in conjunction with a long short-term memory recurrent neural network (LSTM-RNN) architecture configured to store time series pattern data with respect to one or more of the plurality of assets.
5 . The computer-implemented method of claim 1 , wherein applying the anomaly detection machine learning model to each of the plurality of assets comprises:
predicting for the asset an asset type among a plurality of asset types based upon analyzing event data associated with the asset in view of model-derived associations between respective behavioral attributes and each of the plurality of asset types;
calculating, via the anomaly detection machine learning model, the model anomaly risk score for the asset based upon a normalized probability ratio value associated with a correct model prediction of the asset type for the asset; and
identifying the asset as an anomaly asset responsive to determining that the model anomaly risk score calculated for the asset exceeds a model anomaly risk threshold value.
6 . The computer-implemented method of claim 5 , wherein the normalized probability ratio value is a normalized ratio of a probability value associated with a correct model prediction of the asset type for the asset to a maximum probability value among a set of probability values associated with correct asset type model prediction.
7 . The computer-implemented method of claim 1 , wherein calculating the structured false positive score for each of the plurality of anomaly assets during the current structured false positive time window comprises:
averaging a structured false positive score for the anomaly asset during a time window immediately preceding the current structured false positive time window with a calculated difference between an asset type abnormal ratio value and a curve deviation value.
8 . The computer-implemented method of claim 7 , wherein the asset type abnormal ratio value is a ratio of a number of anomaly assets among the plurality of anomaly assets associated with an asset type of the anomaly asset to a total number of assets of the asset type among the plurality of assets.
9 . The computer-implemented method of claim 1 , wherein retraining the anomaly detection machine learning model comprises:
analyzing event data respectively related to each anomaly asset among the plurality of anomaly assets having a structured false positive score calculated during the current structured false positive time window that exceeds the structured false positive threshold value; and
refining model-derived associations between respective behavioral attributes and each of a plurality of asset types by expanding a behavioral attribute range associated with one or more of the plurality of asset types.
10 . A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to:
apply an anomaly detection machine learning model to each of a plurality of assets in a computing environment in order to determine a plurality of anomaly assets among the plurality of assets based upon a model anomaly risk score calculated for each of the plurality of assets consequent to asset event data analysis;
calculate a structured false positive score for each of the plurality of anomaly assets during a current structured false positive time window;
calculate a total anomaly risk score for each of the plurality of anomaly assets by deducting the structured false positive score calculated for each of the plurality of anomaly assets from the model anomaly risk score calculated for each of the plurality of anomaly assets; and
retrain the anomaly detection machine learning model responsive to determining that a threshold value of anomaly assets among the plurality of anomaly assets have a structured false positive score exceeding a structured false positive threshold value.
11 . The computer program product of claim 10 , wherein the program instructions further cause the computing device to:
responsive to user input, provide a model retraining summary via at least one user application interface, wherein the model retraining summary includes structured false positive data and a listing of anomaly assets among the plurality of anomaly assets having a structured false positive score calculated during the current structured false positive time window that exceeds the structured false positive threshold value.
12 . The computer program product of claim 10 , wherein configuring the anomaly detection machine learning model comprises:
parsing respective behavioral attributes from event data associated with one or more of the plurality of assets; and
training the anomaly detection machine learning model by applying at least one classification algorithm to derive associations between the respective behavioral attributes and each of a plurality of asset types.
13 . The computer program product of claim 10 , wherein retraining the anomaly detection machine learning model comprises:
analyzing event data respectively related to each anomaly asset among the plurality of anomaly assets having a structured false positive score calculated during the current structured false positive time window that exceeds the structured false positive threshold value; and
refining model-derived associations between respective behavioral attributes and each of a plurality of asset types by expanding a behavioral attribute range associated with one or more of the plurality of asset types.
14 . A system comprising:
at least one processor; and
a memory storing an application program, which, when executed on the at least one processor, performs an operation comprising:
applying an anomaly detection machine learning model to each of a plurality of assets in a computing environment in order to determine a plurality of anomaly assets among the plurality of assets based upon a model anomaly risk score calculated for each of the plurality of assets consequent to asset event data analysis;
calculating a structured false positive score for each of the plurality of anomaly assets during a current structured false positive time window;
calculating a total anomaly risk score for each of the plurality of anomaly assets by deducting the structured false positive score calculated for each of the plurality of anomaly assets from the model anomaly risk score calculated for each of the plurality of anomaly assets; and
retraining the anomaly detection machine learning model responsive to determining that a threshold value of anomaly assets among the plurality of anomaly assets have a structured false positive score exceeding a structured false positive threshold value.
15 . The system of claim 14 , wherein the operation further comprises:
responsive to user input, providing a model retraining summary via at least one user application interface, wherein the model retraining summary includes structured false positive data and a listing of anomaly assets among the plurality of anomaly assets having a structured false positive score calculated during the current structured false positive time window that exceeds the structured false positive threshold value.
16 . The system of claim 14 , wherein configuring the anomaly detection machine
parsing respective behavioral attributes from event data associated with one or more of the plurality of assets; and
training the anomaly detection machine learning model by applying at least one classification algorithm to derive associations between the respective behavioral attributes and each of a plurality of asset types.
17 . The system of claim 14 , wherein retraining the anomaly detection machine learning model comprises:
analyzing event data respectively related to each anomaly asset among the plurality of anomaly assets having a structured false positive score calculated during the current structured false positive time window that exceeds the structured false positive threshold value; and
refining model-derived associations between respective behavioral attributes and each of a plurality of asset types by expanding a behavioral attribute range associated with one or more of the plurality of asset types.