Devices and methods for anomaly detection

Abstract

An anomaly detector for detecting anomalies in input data includes an autoencoder trained to encode input data and decode the encoded input data to reconstruct the input data. Furthermore, the anomaly detector includes a classifier trained to determine a reconstruction loss indicating the difference between accepted input data and the reconstructed input data, wherein the reconstruction loss includes a weighted combination of multiple loss functions, different types of loss functions, or both, that evaluate the reconstruction loss of multiple parts of the reconstructed input data. The classifier is also configured to detect anomalies in the reconstructed input data when the reconstruction loss is above a threshold.

Description

Technical Field

[0001] This invention relates generally to anomaly detection, and more specifically, to an apparatus and method for detecting anomalies using an automatic encoder. Background Technology

[0002] Anomaly detection typically involves the task of detecting abnormal situations. This task is widely applicable to various applications such as assurance, safety, quality control, fault monitoring, and process control. Across a wide range of applications, the purpose of anomaly detection is usually to alert authorities to unusual situations that require further investigation and potential response actions to mitigate any harmful problems. Because of the massive flow of information, manual investigation and response can be costly; therefore, it is useful for anomaly detection systems to also provide information that helps explain the cause of the detection to guide the investigation and appropriate response.

[0003] Traditional anomaly detectors use autoencoders that reconstruct the input data and employ a reconstruction loss between the input and reconstructed data to detect anomalies. One of the main problems in training anomaly detectors is the lack of training data with anomalies. Therefore, autoencoders configured to detect anomalies are currently trained on normal, non-anomaly data. The concept of training an autoencoder only on non-anomaly data is called uniclass learning, where uniclass learning models the data distribution of “normal” (non-anomaly) data samples. In this approach, the autoencoder’s reconstruction loss acts as an indicator of whether an input data example (given at test time) is anomalous; a higher reconstruction error indicates anomaly because the general principle is that the autoencoder should learn to effectively reconstruct normal data but have a higher error for anomalous data. Therefore, thresholding the error serves as the function of an anomaly detector.

[0004] However, single-class classifiers for anomaly detection may fail to properly handle the rich context of real-world applications, where the input data for anomaly detection includes multiple possible heterogeneous features. Therefore, there is a need for an anomaly detector that analyzes each feature of the input data individually to detect anomalies and / or provide information explaining the reasons for the detected anomalies. Summary of the Invention

[0005] Some implementations are based on the understanding that it is difficult to obtain labeled anomalous data to train an anomaly detector to detect anomalies. Therefore, unsupervised anomaly detection methods are used, which involve training the anomaly detector using normal data. When anomalous data is input into the anomaly detector, which has been trained using normal or benign data, it can then detect the anomalous data. This training is referred to herein as a single-class classifier.

[0006] However, input data includes multiple features. Training a single-class classifier for anomaly detection cannot analyze each feature of the input data individually. Therefore, even when a current anomaly detector detects an anomaly, it cannot provide information about which feature of the input data was identified as the anomaly. This information could be extremely useful in guiding the investigation of detected anomalies. For example, some implementations are based on the understanding that different features of the input data may contribute differently to anomalies. Analyzing different features individually but jointly can improve the accuracy of anomaly detection.

[0007] Alternatively, some implementations are based on the understanding that sometimes anomalous training data is available, but the amount is insufficient to train a multi-class classifier. Some implementations are based on the understanding that a uniclass classifier is still preferable to a multi-class classifier when some classes are undertrained. Therefore, the insufficient amount of anomalous training data is unfortunately ignored when training a uniclass classifier.

[0008] To address this issue, some implementations replace the use of available anomalous training data to train multi-class classifiers, instead using the anomalous training data to adjust the anomaly detection threshold of single-class classifiers. These implementations, alone or in combination with composite loss functions, can improve the accuracy of anomaly detection without increasing the complexity of their training.

[0009] For example, some implementations perform anomaly detection on structured sequence data where the data samples contain a mixture of different types of features. Some features are categories, some are words from a large vocabulary, and some are numerical values. Processing sequence data requires combining different types of values ​​corresponding to different types of features in order to detect anomalies. These varying data types appear in sequence data such as internet proxy logs, where some fields are categories (commands, protocols, error codes, etc.), some are words (domain names, URL paths, file names, etc.), and others are numerical values ​​(data size, character counts, timing, etc.).

[0010] Some implementations use anomaly detectors trained with single-class label models to perform anomaly detection in Internet proxy log data to detect cyberattacks on cyber-physical systems and other malicious activities in computer networks. The goal of this anomaly detector is to help automate the detection and response to cyberattacks and further provide explanations of why the data is anomalous, guiding investigations and appropriate responses. Raw Internet service log data comprises log entries from Internet service requests from many different users, these different data streams inherently intertwined within the log data records. Therefore, the proposed anomaly detector first deintertwines the sequences of log entries generated by different users and then processes the sequences of each user independently. An alternative that simply processes all sequences while interleaving them could overload the training of the autoencoder, adding unnecessary complexity.

[0011] Some implementations are based on the understanding that Internet proxy log data comprises heterogeneous samples of data with different characteristics. Some characteristics naturally appear in the data (proxy log entries contain numerical, categorical, and text fields). Internet proxy log data is a type of sequential data. Within this sequential data, within each sequence, the data is structured as a mixture of different types of characteristics. Some characteristics are categorical, some are words from a large vocabulary, and some are numerical. In particular, for sequential data corresponding to Internet business logs, the key original characteristics are HTTP commands and the URLs accessed. HTTP commands are examples of categorical characteristics from a finite set of possibilities (e.g., GET, POST, HEAD, etc.). However, URLs consist of many different parts, including the protocol (e.g., the most common "http", "https", or "ftp"), the domain name, and the top-level domain, and may also include subdomains, paths, filenames, file extensions, and parameters. While the protocol and top-level domain are categorical variables, the rest of the URL consists of general words and symbols that can come from a very large vocabulary. Therefore, in order to handle URL features, in some implementations, the URL is decomposed into: treating the protocol and top-level domain as category features, treating the domain name and subdomain as words from a large vocabulary, and calculating numerical statistics on the path and parameters.

[0012] To handle domain and subdomain words, a vocabulary of the most common words is formed from the training data. Words outside the most common set are labeled as the "other" group. However, the necessary vocabulary can still be very large, making it difficult to manage. Therefore, to handle the vocabulary size during training, a word embedding module is used. This module is pre-trained on each of the multiple features present in the URL to transform each word into a smaller-dimensional feature vector, rather than using very large one-hot class encoding. These embedding vectors (i.e., feature vectors) are then used as features for the autoencoder instead of the original domain / subdomain words.

[0013] In some implementations, for other category features with a manageable number of categories, the category set may be reduced to only those most frequently encountered during training, and the remainder may be labeled as “other” categories.

[0014] In some implementations, the anomaly detector decomposes the individual sequences of the input sequence data into multiple fields based on multiple features of the sequence data. Furthermore, the data corresponding to the features included in each field are vectorized, concatenated, and provided to the autoencoder. The autoencoder is trained to compress and reconstruct the concatenated data. The overall reconstruction loss of the autoencoder training is calculated by combining the individual losses of the individual features. For embedded word features, the loss is measured as the mean squared error or mean absolute error of the word embedding feature vectors. For categorical features, the loss is measured using cross-entropy loss. For numerical features, the loss is measured using the mean squared error or mean absolute error of the numerical values. These individual loss terms are all combined as a weighted average to form the overall reconstruction loss.

[0015] In some implementations, to cover different types of structured sequence data, the anomaly detector includes a flexible structure that provides feature selection from: categorical features to be embedded, categorical features to be one-hot encoded, or numerical features. Therefore, this flexible structure provides a loss function selection mechanism that adaptively selects the optimal set of loss functions for the selected features.

[0016] Some implementations are based on the understanding that detecting anomalies from heterogeneous mixtures of data features is a challenging task. General methods for anomaly detectors can also be applied to other forms of data with heterogeneous feature mixtures. For example, in computer vision tasks, different color channels of an image can provide different levels of information. Furthermore, images can be preprocessed using various tools such as object detection and skeleton tracking, which produces different features beyond the original pixel values. In audiovisual data, sound is another heterogeneous feature as part of the mixture. Video data may also have preprocessed motion vectors in addition to the original image. For example, physiological data, if collected from various sensor modalities, can also include heterogeneous features.

[0017] Heterogeneous feature mixing can be handled using autoencoders, which jointly encode and decode all features, and the overall reconstruction loss is expressed as a weighted sum of individual loss terms for each feature, where each loss term is feature-specific and suited to that feature (e.g., for internet proxy data: mean squared error of numerical features, cross-entropy of categories, etc.). Weights are applied to the loss terms because they can be at different scales, but these weights can also be used to emphasize more important features while emphasizing less important ones. However, assuming the data consists only of training on normal samples, it is difficult to know which features are most important for distinguishing unknown types of anomalies. Therefore, the challenge arises in identifying and optimally utilizing the most important features.

[0018] After training, by determining the overall reconstruction loss and comparing it with an adjustable threshold, the autoencoder can be applied to detect anomalies in new data examples. Furthermore, to obtain the degree of interpretability in anomaly detection, individual loss terms can be examined to discover which feature(s) contribute most significantly to the loss. This highlights the features that are most difficult to compress and reconstruct, suggesting they may be the root cause of anomalies in a particular data example. Therefore, this type of information can potentially identify the most interesting anomalous features for subsequent investigators.

[0019] Therefore, the autoencoder is first trained offline using unsupervised training, and then further tuned online using a limited amount of labeled data generated by users who provide feedback at test time (supervised learning). Instead of maintaining static loss term weights and fixed thresholds for anomaly declarations in the calculation of the overall reconstruction loss, these weights and thresholds can be adjusted in a supervised manner based on user feedback.

[0020] Furthermore, while providing anomaly detection results to the user, the user can also provide feedback, which indicates false alarms and missed detections to the anomaly detector. This feedback provides labels to a smaller set of labeled data examples. Using this smaller set of labeled data provided by the user, the anomaly detector can readjust the weights of the loss terms to improve detection performance.

[0021] Therefore, the reconstruction loss is considered as a score computed as a function of individual loss terms and weights corresponding to each of the multiple features of the input data. The weights are adjusted based on the smaller set of labeled examples, utilizing the ground truth labels indicated by the user for that smaller set, to improve detection performance. This can be implemented online, with only incremental, small adjustments made for each labeled example, since feedback from the user is limited during operation. In an example implementation, this adjustment can be specifically implemented using a gradient descent step on the weights for the binary classification cross-entropy loss between the ground truth labels (provided through user feedback) and the classification score computed from the reconstruction loss and a threshold.

[0022] Furthermore, in the feedback, the user can also roughly indicate where they want to operate on the false alarm to missed detection tradeoff curve (i.e., the user can indicate whether they want a better detection rate at the cost of more false alarms, or fewer alarms at the cost of more missed detections). Therefore, the threshold used to compare the overall reconstruction loss for detecting anomalies increases / decreases in response to the user's feedback. However, to calibrate and adjust the threshold to achieve the specific tradeoff point indicated by the user, a smaller set of labeled examples generated from the user feedback can be used to adjust the threshold so that the anomaly detector performs the desired false alarm to missed detection tradeoff.

[0023] Therefore, one embodiment discloses an anomaly detector comprising: an input interface configured to accept input data; at least one processor; and a memory storing instructions for a module forming the anomaly detector, wherein the at least one processor is configured to execute the instructions for the module forming the anomaly detector. The module includes: an autoencoder including an encoder trained to encode the input data and a decoder trained to decode the encoded input data to reconstruct the input data. The module also includes a classifier trained to determine a reconstruction loss indicating the difference between the accepted input data and the reconstructed input data, wherein the reconstruction loss includes a weighted combination of multiple loss functions evaluating the reconstruction loss of multiple parts of the reconstructed input data, different types of loss functions, or both. The classifier module is further configured to detect anomalies in the reconstructed input data when the reconstruction loss is above a threshold. The anomaly detector also includes an output interface configured to render the results of the anomaly detection.

[0024] Therefore, one embodiment discloses a method for detecting anomalies. The method includes the steps of: receiving input data; encoding the input data; and decoding the encoded input data to reconstruct the input data. The method further includes the steps of: determining a reconstruction loss indicating the difference between the received input data and the reconstructed input data, wherein the reconstruction loss includes a weighted combination of multiple loss functions evaluating the reconstruction loss of multiple parts of the reconstructed input data, different types of loss functions, or both; detecting anomalies in the reconstructed input data when the reconstruction loss is higher than a threshold; and rendering the result of the anomaly detection. Attached Figure Description

[0025] [ Figure 1 ] Figure 1 An anomaly detector for detecting anomalies from input data is shown according to an example implementation.

[0026] [ Figure 2 ] Figure 2 A functional diagram illustrating the adjustment process in an anomaly detector according to an example implementation is shown.

[0027] [ Figure 3 ] Figure 3 This is a schematic diagram illustrating the architecture of an anomaly detector according to an example implementation.

[0028] [ Figure 4 ] Figure 4 The steps of a method for detecting anomalies according to an example implementation are shown.

[0029] [ Figure 5A ] Figure 5A This is a schematic diagram illustrating the workflow of an anomaly detector for detecting anomalies in Internet proxy data according to an example implementation.

[0030] [ Figure 5B ] Figure 5B This illustrates how, according to an example implementation, data from Internet proxy logs is decomposed into categorical and numerical features.

[0031] [ Figure 5C ] Figure 5C This illustrates a cascading module configured to cascade data corresponding to multiple features of a URL, according to an example implementation.

[0032] [ Figure 6 ] Figure 6 This is a block diagram illustrating anomaly detection in video data according to an example implementation.

[0033] [ Figure 7 ] Figure 7 A block diagram is shown of a computer-based anomaly detector for detecting anomalies from input data, according to an example implementation. Detailed Implementation

[0034] In the following description, numerous specific details are set forth for illustrative purposes in order to provide a thorough understanding of this disclosure. However, it will be apparent to those skilled in the art that this disclosure may be practiced without these specific details. In other instances, apparatuses and methods are shown only as block diagrams to avoid obscuring this disclosure.

[0035] As used in this specification and claims, the terms "for example" and "such as," as well as the verbs "comprising," "having," "including," and other verb forms thereof, when used in conjunction with a list of one or more components or other items, shall each be interpreted as open-ended, meaning that the list should not be considered as excluding other additional components or items. The term "based on" means at least partially based on. Furthermore, it will be understood that the wording and terminology used herein are for descriptive purposes and should not be considered limiting. Any headings used within this description are for convenience only and have no legal or limiting effect.

[0036] This disclosure proposes an anomaly detector for detecting anomalies in mixed sequence data (e.g., image data, video data, internet proxy data, etc.) that includes heterogeneous features. However, one of the challenges in anomaly detection is the lack of labeled anomalous data that can be used to train the anomaly detector. To overcome this challenge, the proposed anomaly detector uses a neural network-based autoencoder. At a high level, the autoencoder maps the input data to itself (i.e., the input data) through a latent space representation of the input data. To this end, the autoencoder encodes the input data into a latent space. Furthermore, the autoencoder decodes the encoded input data from the same latent space. A reconstruction loss is estimated between the input data and the reconstructed data of the autoencoder (or encoder). The anomaly detector can be trained based on the reconstruction loss to detect anomalies in the input data. Therefore, the proposed anomaly detector can be trained without labeled data (i.e., the anomaly detector is trained using the reconstruction loss). The following is about... Figure 1 Provide a detailed description of the proposed anomaly detector.

[0037] Figure 1 An anomaly detector 101 for anomaly detection from input data 103 is illustrated according to an example embodiment. The anomaly detector 101 may include an input interface (not shown) to obtain the input data 103. The input data 103 may correspond to mixed sequence data including heterogeneous features. The sequence data may include text data (e.g., internet proxy log data), image data, video data, audio data, protein sequences, etc. In some embodiments, the input data 103 may include multiple features such as categorical features, numerical features, etc.

[0038] Anomaly detector 101 may include autoencoder 105, which is a pair of neural networks: an encoder neural network and a decoder neural network. Input data 103 is provided to autoencoder 105. Autoencoder 105 transforms samples of input data 103 into a dimensionality-reduced (compressed) representation, and the decoder uses these representations to reconstruct the original data samples of input data 103. The reconstructed input data 107 includes some reconstruction loss 115, where reconstruction loss 115 corresponds to the difference between the original input data 103 and the reconstructed input data 107. Anomaly detector 101 determines anomalies in input data 103 based on the calculation of reconstruction loss 115.

[0039] To this end, an autoencoder 105 is trained on normal data samples (or benign data samples) associated with the type of input data 103, wherein the autoencoder 105 is trained to encode the input data 103 and the decoder is trained to decode the encoded input data to reconstruct the input data 103 (i.e., the reconstructed input data 107).

[0040] Anomaly detector 101 may include classifier module 109 (also referred to as "classifier 109"). Reconstructed input data 107 is provided to classifier 109, which is configured to determine a reconstruction loss 115 associated with the reconstructed input data 107. To determine the reconstruction loss 115, classifier module 109 initially determines multiple portions 111 of the reconstructed input data 107. In particular, the multiple portions 111 are determined based on multiple features of the reconstructed input data 107. Each portion of the multiple portions 111 includes reconstructed data corresponding to a respective feature among the multiple features. The multiple features may be inherited by the reconstructed input data 107 from the original accepted input data (input data 103). For example, in text data, the multiple features include categorical features, numerical features, etc.

[0041] The classifier module 109 is also configured to determine multiple loss functions 113 for each of the multiple portions 111 of the reconstructed input data 107. Each of the multiple loss functions 113 accurately measures the individual loss (or individual reconstruction loss) associated with each portion of the multiple portions 111 of the reconstructed input data 107. In some implementations, each of the multiple loss functions is selected based on the type of features included in each portion of the multiple portions 111. For example, the classifier module 109 may determine a cross-entropy loss function to determine the loss corresponding to the portion of the reconstructed input data associated with categorical features. Similarly, a mean squared error (MSE) loss function may be used to determine the loss corresponding to the portion of the reconstructed input data 107 associated with numerical features.

[0042] Furthermore, classifier 109 is configured to determine the reconstruction loss 115 as a weighted combination of multiple loss functions 113. To this end, classifier module 109 can determine multiple weights for weighting each of the multiple loss terms / functions 113. These multiple weights can be used to emphasize important features of the reconstructed input data 107 and de-emphasize less important features to identify anomalies from the reconstructed input data 107.

[0043] To detect anomalies, classifier module 109 is also configured to compare reconstruction loss 115 (or overall reconstruction loss) with threshold reconstruction loss 117 (also referred to as "threshold 117"). In some implementations, threshold 117 may be determined based on the reconstruction loss between multiple normal data samples (or benign data samples) of the original input data 103 and multiple reconstructed data samples corresponding to the normal samples of the input data 103.

[0044] When the determined reconstruction loss 115 is higher than the threshold 117, the classifier 109 determines that a particular input sample contains an anomaly that may threaten the user. The classifier 109 can also notify the user of the detected anomaly. On the other hand, when the determined reconstruction loss 115 is less than the threshold 117, the classifier 109 determines that the particular input sample is a benign data sample. Thus, the proposed anomaly detector 101 uses the reconstruction loss 115, which is a weighted combination of multiple loss functions 113, to determine the anomaly detection result 119 in the input data 103.

[0045] In some implementations, the value of threshold 117 is adjustable. For this purpose, feedback is obtained from the user in real time or offline. Additionally, user feedback is used to adjust the weights associated with the various loss functions among the multiple loss functions 113. Regarding... Figure 2 Further details on adjusting the threshold 117 and the weights of the loss function based on user feedback.

[0046] Figure 2 A functional diagram illustrating the adjustment process in the anomaly detector 101 according to an example implementation is shown. Figure 2 Combination Figure 1 To describe.

[0047] In some implementations, the anomaly detector 101 may include an adjuster module 209. The adjuster module 209 is used in conjunction with the classifier module 109. Initially, the classifier module 109 determines individual loss components 201 corresponding to each of the plurality of parts 111, wherein the individual loss components 201 may include MSE loss, cross-entropy loss, etc. Furthermore, weights 203 of the individual loss functions may be determined, and thus, the reconstruction loss 115 may be determined as a weighted sum of loss terms. The classifier 109 further uses loss-based anomaly detection 205, wherein the reconstruction loss 115 calculated by the classifier 109 is compared with a threshold 117 to detect anomalies, and thus, anomaly detection results 119 are rendered.

[0048] Based on the anomaly detection result 119, the user can provide feedback to the anomaly detector 101 in cases of inconsistency (also referred to as "user feedback"). For example, input data 103, which is classified as non-anomaly data by the classifier module 109, may be anomalous. When the user identifies this discrepancy, the user can provide feedback, in which the user provides a label for the misclassified input data 103 (in this case, non-anomaly).

[0049] Based on feedback, the adjuster module 209 can update at least one of the thresholds 117 and weights 203 of at least one of the multiple loss functions 113 (i.e., individual) in the weighted combination of loss functions to adjust the reconstruction loss 115 so that the anomaly detection result 119 is consistent with the label provided by the user. The weights 203 can be adjusted automatically during the training of the anomaly detector 101 or during execution (i.e., based on user feedback received online).

[0050] In another implementation, based on the anomaly detection result 119, the user can determine whether the input data is misclassified as anomalous (or non-anomaly). The user can update the anomaly detector 101 with feedback regarding the misclassification, where the feedback may include one or more labels indicating the misclassification of the input data 103. For example, if non-anomaly data is identified as anomalous by the anomaly detector 101, the user can provide the label "No" to indicate the misclassification of the input data 103. Therefore, based on this feedback, the adjuster module 209 can update at least one of the thresholds 117 and weights 203 of at least one (or individual) of the multiple loss functions 113 in the weighted combination of loss functions to correct the misclassification.

[0051] In some implementations, the anomaly detector 101 can determine the amount of misclassified data based on user feedback. Furthermore, if the amount of misclassified data exceeds a certain threshold, the threshold reconstruction loss 117 can be updated.

[0052] In another embodiment, a user can adjust threshold 117 based on observations of anomaly detection result 119. The user can confirm whether anomaly detection result 119 is an anomaly or a false alarm. Anomaly detector 101 allows the user to provide feedback via a user interface (not shown). By adjusting threshold 117, the user can determine the performance trade-off between improving the false alarm rate and improving the anomaly detection rate. User feedback provides a limited amount of labeled data, which includes labels for the anomalous data identified by the user. Classifier module 109 uses the labeled data to evaluate the performance of anomaly detector 101. Using the limited amount of labeled data, the false alarm rate and anomaly detection rate of anomaly detector 101 can be estimated. To this end, anomaly detector 101 can determine the amount of input data 103 that is misclassified by anomaly detector 101 based on the labeled data obtained from user feedback, where misclassified data leads to false alarms. Furthermore, anomaly detector 101 can compare the amount of misclassified data with a specific threshold (e.g., threshold 117), whereby the false alarm rate and anomaly detection rate can be determined based on this comparison. Based on the estimated false alarm rate and anomaly detection rate, the threshold 117 can be automatically adjusted to obtain the performance trade-offs desired by the user (i.e., whether the user wants an improved anomaly detection rate or an improved false alarm detection rate).

[0053] In some implementations, user feedback can be obtained online (in real time). In another implementation, user feedback can be obtained offline.

[0054] In some implementations, the performance evaluation 207 using finite labeled data can use either the overall loss or the reconstruction loss 115 as a soft decision score for anomaly detection. The soft decision score is used to calculate the cross-entropy loss with respect to the labeled data. Since the reconstruction loss 115 is a function of the weights of multiple loss functions, the weights of these loss functions can be adjusted via methods such as gradient descent to optimize the cross-entropy loss. Gradient descent is an optimization algorithm used to find local minima of differentiable functions. Gradient descent is only used to find the values ​​of the function parameters (coefficients) that minimize the cost function as much as possible.

[0055] Gradient descent allows for tuning and fine-tuning of the anomaly detector 101 using only a very limited amount of labeled data, which may include online tuning via user feedback. Gradient descent is particularly suitable when labeled data may be limited, making it impractical to fully tune the parameters of the entire autoencoder (training alone on a large amount of unlabeled data).

[0056] Figure 3 The architecture of an anomaly detector 101 according to an example implementation is shown. The anomaly detector 101 includes an autoencoder module 105 trained to compress input data (e.g., input data 103) and decompose the input data to reconstruct it. Furthermore, a reconstruction loss is determined between the reconstructed input data and the original input data to detect anomalies in the input data. Some implementations are based on the understanding that the input data comprises multiple features. The autoencoder module 105 may marginalize multiple features during the compression and decompression of the input data. Some implementations are also based on the understanding that the reconstruction loss obtained by marginalizing all features of the input data may not accurately detect anomalies in the input data because, due to marginalization, different input features present in the input data may be treated equally. Therefore, it may be impossible to inform the user which feature of the input data is detected as associated with an anomaly.

[0057] Therefore, some implementations analyze individual features of the input data separately to accurately identify anomalies and further determine which of the multiple features is associated with the anomaly.

[0058] To this end, a uniclass classification model is used to train the autoencoder module 105. The uniclass classification model comprises an unsupervised learning algorithm that attempts to model “normal” examples in order to classify new examples as normal (non-abnormal) or abnormal (abnormal). The uniclass classification model can be used for binary classification tasks with severely skewed class distributions. The model is fitted to input examples from the training dataset representing the majority of classes, and then evaluated on a held-out test dataset.

[0059] Therefore, training datasets that include most classes of the normal dataset can be used to train autoencoders using uniclass classification models, as uniclass classification models are effective for imbalanced classification datasets with few or no outlier class examples. Furthermore, uniclass classification models are effective on datasets lacking coherent structure to separate classes that can be learned through supervised algorithms. Thus, uniclass classification (or simply OCC) involves fitting a model to “normal” (or non-outlier) data and predicting whether new data is normal (i.e., non-outlier) or an outlier / outlier (or abnormal).

[0060] Following training, the autoencoder module 105 can be applied to detect anomalies in new data examples by determining an overall reconstruction loss 115 and comparing it with an adjustable threshold (or threshold 117). Furthermore, to obtain the degree of illustrativeness of the association between anomaly detection and detected anomalies, individual loss terms among the multiple loss terms 113 can be examined to discover which(s) of the multiple features of the input data contribute most significantly to the reconstruction loss 115. This highlights the features that are most difficult to compress and reconstruct, indicating that they may be the root cause of anomalies in specific data. Therefore, this type of information can potentially identify the most anomalous features of interest to subsequent investigators.

[0061] To this end, the data loader module 301 of the anomaly detector 101 accepts input data and divides the input data into multiple parts based on multiple features present in the input data. Each part includes input data corresponding to each of the multiple features. The data loader module 301 is also configured to process the input data corresponding to each feature and generate a fixed-dimensional numerical feature representation vector. Therefore, the data loader module 301 vectorizes the data corresponding to each feature included in each part, and vectorizes each part to generate parts 303a, 303b...303n (also referred to as "part A", "part B"..."part N" respectively).

[0062] Furthermore, the vectorized data are provided to the cascading module 305 of the anomaly detector 101. The cascading module 305 is configured to cascade multiple vectorized portions to form cascaded data. The cascaded data is further provided to the autoencoder module 105, which uses an encoder to encode the cascaded data into a latent space representation. The autoencoder module 105 further uses a decoder to reconstruct the input data from the latent space representation of the cascaded data.

[0063] Furthermore, the reconstructed data generated by the autoencoder module 105 is provided to the segmentation module 307 of the anomaly detector 101. The segmentation module 307 is configured to segment the reconstructed data into multiple parts 309a, 309b...309n (also referred to as "part A'", "part B'"..."part N'") based on multiple features present in the reconstructed data. Therefore, each part includes data corresponding to a specific feature among the multiple features. Segmenting the reconstructed data into multiple parts based on multiple features allows the anomaly detector 101 to individually analyze each feature inherited from the input data.

[0064] Furthermore, multiple portions 309a, 309b...309n of the reconstructed data are provided to the classifier module 109. The classifier module 109 includes a loss function determination module 311, configured to determine multiple loss functions 313a, 313b...313n (also referred to as "loss 1", "loss 2",..., "loss n"). Each loss function accurately calculates the reconstruction loss for each corresponding portion among the multiple portions 309a, 309b..., 309n. Additionally, individual reconstruction losses corresponding to each portion of the reconstructed input data are calculated based on the reconstructed input data.

[0065] To determine the overall reconstruction loss 115, the classifier module 109 also includes a weight determination module 315. The weight determination module 315 is configured to determine the weights of each of the multiple loss functions 113. In some implementations, the user may select one or more features from the multiple features as more important than the remaining features. In this case, the weight determination module 315 assigns higher weights to some of the loss functions 313a, 313b, ..., 313n that correspond to the selected important features, and lower weights to the remaining loss functions 313a, 313b, ..., 313n. Furthermore, the reconstruction loss 115 is determined by calculating a weighted combination of the loss functions 313a, 313b, ..., 313n. The reconstruction loss 115 corresponds to the difference between the data input to the autoencoder module 105 and the data reconstructed by the autoencoder module 105. The reconstruction loss 115 is compared with a threshold 117 to detect anomalies in the input data provided to the anomaly detector 101. When the reconstruction loss 115 exceeds the threshold 117, the input data is detected as containing anomalies.

[0066] When an anomaly is detected, the anomaly detector 101 of the trained autoencoder module 105 can provide information about which feature of the input data was identified as an anomaly, allowing the user to further investigate the anomaly in the input data.

[0067] Specifically, based on the anomaly detection results, the anomaly detector 101 is configured to obtain user feedback online (i.e., in real time) or offline. The user feedback provides at least one label indicating a misclassification of the input data. Based on the user feedback, the anomaly detector 101 uses an adjuster module 209, which is configured to adjust or modify at least one of the thresholds 117 and weights 203 assigned to the respective loss functions in a weighted combination 115 of the loss functions (315a-315n), such that the anomaly detection results are consistent with the feedback provided by the user.

[0068] Figure 4 The steps of a method 400 for detecting anomalies according to an example embodiment are shown. Method 400 begins at step 401, where an anomaly detector (e.g., anomaly detector 101) may receive input data (e.g., input data 103) to detect an anomaly. The input data may correspond to mixed sequence data including heterogeneous features. Sequence data may include text data (e.g., internet proxy log data), image data, video data, audio data, protein sequences, etc. In some embodiments, the input data may include multiple features, such as categorical features, numerical features, etc.

[0069] Furthermore, in step 403, the input data may be provided to the autoencoder module of the anomaly detector (e.g., autoencoder 105), whereby the input data can be encoded by the encoder neural network included in the autoencoder module. The input data may be compressed by the encoder and further encoded into a latent space representation.

[0070] In step 405, the decoder neural network of the autoencoder module can be used to reconstruct the encoded input data. The decoder can reconstruct the input data using the latent space representation of the input data. The reconstructed input data includes some reconstruction loss, where the reconstruction loss corresponds to the difference between the original input data and the reconstructed input data.

[0071] In step 407, a classifier module (e.g., classifier module 109) can be used to determine the reconstruction loss between the input data provided to the encoder and the reconstructed input data provided to the decoder. To determine the reconstruction loss, multiple portions of the reconstructed input data can initially be determined based on multiple features included in the reconstructed input data. Each of the multiple portions includes reconstructed data corresponding to a specific feature among the multiple features. These multiple features can be inherited from the originally accepted input data by the reconstructed input data.

[0072] Furthermore, multiple loss functions are determined to accurately determine the individual reconstruction loss for each part of the reconstructed input data. Each of the multiple loss functions measures the individual loss (or individual reconstruction loss) associated with each part of the reconstructed input data. Finally, the reconstruction loss is determined as a weighted combination of the multiple loss functions, where multiple weights are used to weight each of the multiple loss functions.

[0073] In step 409, anomalies can be detected based on reconstruction loss. For this purpose, the reconstruction loss can be compared to a threshold. The threshold can be determined based on the reconstruction loss between multiple vectorized normal data samples (or benign data samples) associated with the input data to be analyzed and multiple reconstructed data samples corresponding to the vectorized normal samples of the input data. When the determined reconstruction loss is higher than the threshold for a particular input sample, the input sample is determined to contain an anomaly that may threaten the user. Method 400 may also include notifying the user of the detected anomaly. On the other hand, when the determined reconstruction loss is less than the threshold for a particular input sample, the input sample is determined to be a benign input data sample.

[0074] Figure 5A This is a schematic diagram illustrating the workflow of an anomaly detector 500a for detecting anomalies in Internet proxy data 501 according to an example implementation. Anomalies in Internet proxy data 501 can be detected to detect network attacks. Internet proxy data 501 is sequence data comprising multiple features, such as categorical features, embedded features, and numerical features. Categorical features are those features that have values ​​from a discrete set of possibilities, where the size of the set is manageable. For example, in Internet proxy log data, examples of categorical features include HTTP response / error codes (belonging to a relatively small set), some top-level domain categories, protocol categories, file extensions, etc. Embedded features are essentially categorical features where the set of possible values ​​is too large to manage. The set of possible words that appear in a domain name is an example of a categorical feature that needs to be embedded, representing only a subset of the most common words. Numerical features are those features that are inherently numerical, such as the size of a response or character occurrence statistics extracted from text.

[0075] To detect anomalies in Internet proxy data 501, it is important to analyze the input data corresponding to each of the multiple features. To achieve this, Internet proxy data 501 can be divided into multiple parts based on the multiple features present in Internet proxy data 501.

[0076] To this end, the anomaly detector 500a uses a data loader module 503, which accepts Internet proxy data 501 as input and further divides the Internet proxy data 501 into multiple parts based on embedding features, category features, and numerical features. To enable the anomaly detector to analyze each part to identify anomalies in the input data 501, the data loader module 503 vectorizes each part of the input data.

[0077] Therefore, the portion of input data 501 corresponding to the embedded features is provided to word embedding module 505. Word embedding module 505 is configured to perform word embedding to generate fixed-dimensional numerical vector representations. Word embedding is a learned text representation where words with the same meaning have similar representations. In word embedding techniques, individual words are represented as real-valued vectors in a predefined vector space. Each word is represented by a real-valued vector, often with tens or hundreds of dimensions. The vectorized embedding feature data is provided to cascade module 509.

[0078] Similarly, the portion of the input data corresponding to the categorical features is converted into a numerical vector via the one-hot encoding module 507. The one-hot encoding module 507 is configured to perform one-hot encoding on the data corresponding to the categorical features to transform the categorical features into a numerical vector representation. The one-hot encoding module 507 performs binarization of the categorical feature data and includes the binarized features in the numerical vector. Therefore, the numerical vector created using one-hot encoding includes 0s and 1s. The vectorized categorical data is provided to the cascade module 509.

[0079] Furthermore, the numerical features are inherently numerical and do not require any specific processing. In some implementations, the numerical features may be normalized before being fed into the cascade module 509.

[0080] Cascade module 509 combines the numerical vectors corresponding to all features to form cascaded data. The cascaded data is provided to autoencoder module 511, which encodes and decodes the cascaded data to reconstruct the input data. The reconstructed input data includes a reconstruction loss, which is the difference between the original input data and the reconstructed input data. The reconstructed input data includes multiple features, namely, embedding features, categorical features, and numerical features. To analyze the data corresponding to each feature, the reconstructed input data is provided to segmentation module 515, which segments the reconstructed input data into multiple parts based on the multiple features. Furthermore, the multiple parts are provided to classifier module 529, where the analysis of the multiple parts of the cascaded data determines whether the input data 501 includes anomalies. The cascaded data includes vectorized data corresponding to each feature of the input data 501. A corresponding loss function is used to determine the reconstruction loss for each of the multiple reconstructed parts.

[0081] To achieve this, the word de-embedding module 513 is first used to de-embedding the data corresponding to the embedding features. The word de-embedding module 513 is used in conjunction with the word embedding module 505. The word de-embedding module 513 is used to transform the dense representation vector space of individual words corresponding to the embedding features back into a direct representation of the categorical variable, for example, using a score vector indicating the unnormalized log-likelihood of each possible category value. The word de-embedding module 513 may include a neural network comprising one or more fully connected layers.

[0082] Furthermore, cross-entropy losses corresponding to the embedded features and category features are determined, where the first cross-entropy loss 517 corresponds to the cross-entropy loss of the embedded features, and the second cross-entropy loss 519 corresponds to the category features. Cross-entropy loss (loss) CE ) is the loss function used to train a classifier to recover discrete (class) labels.

[0083]

[0084] Where p = (p1, p2, ..., p n Let y = (y1, y2, ..., yn) be a tensor of likelihood vectors estimated over a set of sizes n. n ) represents the corresponding truth label, p i [y i ] indicates the choice of likelihood vector p i The yth i Element. Ideally, p i [y i The value should be 1, while p i The other elements should be 0 to minimize the cross-entropy loss.

[0085] The first cross-entropy loss 517 is determined based on the output of the word de-embedding module 513 and the original embedding features. Similarly, the second cross-entropy loss 519 is calculated based on the original category features.

[0086] Furthermore, for the components corresponding to the numerical features, a mean squared error (MSE) loss is calculated with respect to the numerical features, wherein the MSE loss corresponding to the numerical features is represented as a first MSE loss 521. Additionally, an MSE loss is calculated with respect to the inputs and outputs of the auto encoder module 511, wherein the MSE loss 521 calculated with respect to the inputs and outputs of the auto encoder module 511 is represented as a second MSE loss 523.

[0087] MSE (Mean Squared Error) loss MSE The following formula is given.

[0088]

[0089] Where x = (x1, x2, ..., x) d ) and y = (y1, y2, ..., y d ) are the two vectors being compared. For example, x can be the true value of a vector of numerical features, and y can be an estimate of that vector. In the first MSE loss 521, vector "x" can correspond to the data corresponding to the original numerical features, and vector "y" can correspond to the data corresponding to the reconstructed numerical features. Similarly, in the second MSE loss 523, vector "x" can correspond to the cascaded data provided as input to the autoencoder module 511, and vector "y" can correspond to the reconstructed input data (cascaded data) generated by the autoencoder module 511.

[0090] In some implementations, each of the multiple parts may be provided to the loss function determination module (e.g., loss function determination module 145). Figure 5A (not shown in the image) is used to calculate individual loss functions such as the first cross-entropy loss function 517, the second cross-entropy loss function 519, the first MSE loss function 521, and the second MSE loss function 523.

[0091] Furthermore, the overall reconstruction loss is determined as a weighted sum of all loss functions 525 (i.e., a weighted sum of the first cross-entropy loss function 517, the second cross-entropy loss function 519, the first MSE loss function 521, and the second MSE loss function 523). For this purpose, a weight determination module (e.g., weight determination module 315) can be used (shown in...). Figure 3 The weights corresponding to each loss function are determined using a method (e.g., 527). Furthermore, loss-based anomaly detection 527 is used to detect anomalies in the surrogate data 501, where the reconstruction loss is compared to a threshold reconstruction loss. Surrogate data 501 is determined to contain anomalies when the reconstruction loss corresponding to the surrogate data 501 is greater than the threshold.

[0092] In the example implementation, the anomaly detector 500a can be used with a user interface. The user can select one or more features from multiple features of the proxy data 501 via the user interface to detect anomalies in the proxy data 501. Furthermore, the user can select multiple loss functions to be used to determine the loss corresponding to each feature, and also select the weights to be used for each loss function when determining the overall reconstruction loss.

[0093] In an example implementation, a single-class classification model can be used to train the anomaly detector 500a to perform anomaly detection on the Internet proxy log data 501, thereby detecting network attacks on the network physical system and other malicious activities in the computer network. The anomaly detector 500a automates the detection of network attacks based on the detection of anomalies in the Internet proxy data 501. Furthermore, the anomaly detector 500a can automate the response to network attacks, such as notifying users, where the notification may include a ringing alarm or notification sound, displaying a notification or location. The anomaly detector 500a can also provide an explanation of why the data is abnormal to guide investigation and appropriate response.

[0094] Figure 5B The data from Internet proxy logs, according to an example implementation, is decomposed into categorical features and numerical features. Figure 5C A cascading module 509, configured to cascade data corresponding to multiple features of URL 531 according to an example implementation, is shown. Figure 5B Combination Figure 5A To describe it. Furthermore, Figure 5C Combination Figure 5B and Figure 5A To describe.

[0095] Internet proxy logs (also known as Internet proxy data 501) include information associated with user requests to the network. For example, Internet proxy data 501 includes the host ID, client ID, and user ID of the user who requested access to a specific website or web content. Internet proxy data 501 also includes the data time, time zone, and the command the user used to access the specific website or web content, as well as information about the status of the command and the number of bytes used.

[0096] Internet proxy data 501 is raw data comprising sequences of log entries from internet service requests from many different users, where these log entry sequences are inherently interleaved with Internet proxy data 501. Therefore, to detect anomalies in Internet proxy data 501, anomaly detector 500a first deinterleaves the log entry sequences generated by different users and then processes each user's sequence independently. Furthermore, an alternative of simply processing all sequences while interleaving them could overload the training of autoencoder 511, adding unnecessary complexity.

[0097] Anomaly detector 500a obtains a URL 531 corresponding to one of the deinterleaved sequences, wherein anomaly detector 500a decomposes URL 531 into multiple parts based on multiple features included in URL 531. URL 531 includes different information associated with a user's request to access a website or web content. The information included in URL 531 is decomposed into categorical features 533 and numerical features 535. The information decomposed into categorical features 533 includes the method name used by the user to access the website, in this case, the method name corresponds to "GET", where GET is the default HTTP method for retrieving resources from a specific URL. The information included in categorical features 533 also includes: subdomain terms, in this case, "download"; domain terms, in this case, "windowsupdate."; class top-level domain (TLD): "co."; country code TLD: ".jp"; and file extension: ".exe". Due to the very large vocabulary size, subdomain terms and domain terms can be further classified into embedded features.

[0098] Furthermore, the information for URL 531 categorized as numerical feature 535 includes the number of levels (#), lowercase #, uppercase #, numerical value #, special character #, and parameter #. Data loader module 503 classifies URL 531 based on its features. Additionally, data loader module 503 vectorizes the data included in each of features 533 and 535. Data vectorization converts textual data (e.g., data included in domain terms, subdomain terms, etc.) into numerical vectors, which are used for anomaly detection.

[0099] exist Figure 5C In this process, the vectorized data corresponding to categorical feature 533 and numerical feature 535 are provided to the concatenation module 509. The concatenation module 509 concatenates the vectorized data corresponding to all features 533 and 535 to generate concatenated data 537.

[0100] To vectorize the data (text) in domain and subdomain words, word embedding module 505 is trained using training data comprising words from a vocabulary of the most common words. Words outside the most common set are labeled as the "other" group during training of word embedding module 505. However, the necessary vocabulary can still be very large, making it difficult to handle the size of the vocabulary. Therefore, to handle the size of the vocabulary during training, the word embedding module is pre-trained against individual features from multiple features present in URL 531 to convert individual words in domain and subdomain words into smaller-dimensional feature vectors, rather than using very large one-hot class encodings. Thus, these embedding vectors (i.e., feature vectors) are used as features for processing instead of the original domain / subdomain words for use by autoencoder module 511.

[0101] Cascaded data 537 is provided to autoencoder module 511, which uses an encoder to encode the cascaded data 537 into a latent space representation. Autoencoder module 511 also uses a decoder to reconstruct the cascaded data 537 from its latent space representation (i.e., vectorize URL 531). Furthermore, the reconstructed cascaded data 537 is provided to segmentation module 515, which segments the reconstructed cascaded data 537 into multiple parts based on multiple features present in the reconstructed cascaded data 537. Therefore, each part of the multiple parts includes data corresponding to each feature among the multiple features. The multiple parts are further provided to classifier module 529, which determines whether URL 531 includes any anomalies, such as those related to... Figure 5A As described. In some implementations, the proposed anomaly detector can be used to detect anomalies in video data. The following is about... Figure 6 This provides a detailed description of how the proposed anomaly detector is used to detect anomalies in video data.

[0102] Figure 6 This is a block diagram 600 illustrating anomaly detection in video data 601 according to an example implementation. The video data 601, in the form of sequence data, can be real-time video and / or recorded video. Figure 6 In the video data 601, patient 601a is lying in bed, and an electrocardiogram (ECG) machine 601b is monitoring patient 601a's heartbeat. Video data 601 is provided to an anomaly detector 603. Anomaly detector 603 may correspond to anomaly detector 101. Upon receiving video data 601, anomaly detector 603 processes video data 601. Each image frame of video data 601 includes different features, such as different color channels like red, green, and blue. In addition to the original image, multiple features of video data 601 may also include preprocessed motion vectors. Furthermore, anomaly detector 603 processes each image frame using various tools such as object detection and skeleton tracking, which generates multiple features in video data 601 in addition to the original pixel values.

[0103] For example, by using an object detection tool, the anomaly detector 603 can detect the ECG machine 601b in an image frame and zoom in or out on the ECG machine 601b in the image frame. Furthermore, the image of the ECG graph on the ECG machine 601b can be analyzed to detect abnormalities in the heartbeat of the patient 601a. ​​For this purpose, the anomaly detector 603 can be trained using training data including ECGs of normal heartbeats. The anomaly detector 603 can determine a reconstruction loss corresponding to the image of the ECG graph on the ECG machine 601b included in one or more image frames of the video data 601. The anomaly detector 603 uses the overall reconstruction loss to determine the abnormality in the heartbeat of the patient 601a. ​​Therefore, the anomaly detector 603 can notify the doctor of the detected abnormality.

[0104] In an example implementation, an anomaly detector 603 can be used to detect abnormalities in the heartbeat of patient 601a based on image frames corresponding to ECG machine 601b from video data 601. For this purpose, training data from ECGs including normal heartbeats can be used to train the anomaly detector 603. Alternatively or additionally, the anomaly detector 603 can be trained to determine distinct features from the image frames corresponding to ECGs; for example, the anomaly detector 603 may be trained to determine that green (corresponding to the ECG image displayed on ECG machine 601b) contributes more information than other colors.

[0105] In another embodiment, the anomaly detector 603 can be used to detect abnormalities in the posture (or pose) of the patient 601a. ​​For example, the patient 601a may be in an abnormal posture when the patient is about to fall off the bed. Furthermore, the abnormal posture of the patient 601a may be due to a seizure. Therefore, the anomaly detector 603 can be trained on the normal posture of a patient lying in bed or performing normal activities in bed (e.g., eating). The anomaly detector 603 based on video data 601 can determine multiple features associated with the movement of the patient 601a from various image frames of video data 601. For this purpose, the anomaly detector 603 can use a skeletal tracking tool to detect abnormalities in the position (or posture or pose) of the patient 601a. ​​Additionally, the anomaly detector 603 can then determine an overall reconstruction loss corresponding to the image associated with the movement of the patient 601a, and use the reconstruction loss to determine the abnormality in the posture of the patient 601a. ​​Therefore, the anomaly detector 603 can notify the doctor of the anomaly.

[0106] Exemplary Implementation

[0107] Figure 7A block diagram of a computer-based anomaly detector 700 for detecting anomalies from input data 103, according to an example embodiment, is shown. The computer-based anomaly detector 700 includes multiple interfaces for connecting the anomaly detector 700 to other systems and devices. The anomaly detector 700 includes an input interface 701 configured to accept input data 103, wherein the input data 103 includes sequential data such as internet proxy data, video data, audio data, image data, etc.

[0108] In some implementations, the anomaly detector 700 includes a network interface controller (NIC) 705 configured to receive input data 103 via a network 707, which may be one or a combination of wired and wireless networks.

[0109] A network interface controller (NIC) 705 is adapted to connect an anomaly detector 700 to a network 707 via a bus 723, and the network 707 connects the anomaly detector 700 to an input device 703. The input device 703 may correspond to a proxy log data recorder that records proxy log data, which is provided to the anomaly detector 700 to detect anomalies in the recorded proxy log data. In another embodiment, the input device 703 may correspond to a video recorder that records video, which is provided to the anomaly detector 700 to detect anomalies in the recorded video data.

[0110] Alternatively or concurrently, the anomaly detector 700 may include a human-machine interface (HMI) 711. The HMI 711 within the anomaly detector 700 connects the anomaly detector 700 to a keyboard 713 and a pointing device 715, wherein the pointing device 715 may include a mouse, trackball, touchpad, joystick, pointing stick, stylus, or touchscreen, etc.

[0111] The anomaly detector 700 includes a processor 721 configured to execute stored instructions 717 and a memory 719 storing instructions executable by the processor 721. The processor 721 may be a single-core processor, a multi-core processor, a computing cluster, or any number of other configurations. The memory 719 may include random access memory (RAM), read-only memory (ROM), flash memory, or any other suitable memory system. The processor 721 may be connected to one or more input and output devices via a bus 723.

[0112] Instruction 717 can implement a method for detecting anomalies according to some embodiments. For this purpose, computer memory 719 stores a data loader module 301, a cascade module 305, an autoencoder module 105, a segmentation module 307, a classifier module 109, and an adjuster module 209. To determine anomalies in input data 103, initially, data loader module 301 divides input data 103 into multiple parts based on multiple features present in the input data. Data loader module 301 further vectorizes each of the multiple parts of input data 103, wherein the vectorized part includes a numerical representation of the data in the corresponding part.

[0113] Furthermore, vectorized data is provided to cascade module 305 to cascade multiple vectorized portions and generate cascaded data. The cascaded data is provided to autoencoder module 105, where it is compressed and decompressed to reconstruct the cascaded data. The reconstructed data includes a reconstruction loss, which is the difference between the original input data of autoencoder module 105 and the input data reconstructed by autoencoder module 105.

[0114] Anomaly detector 700 can accurately detect anomalies from input data 103 and further determine which feature of input data 103 is anomalous. To this end, anomaly detector 700 is configured to analyze input data 103 individually, corresponding to each feature. This is achieved using segmentation module 307, which divides the reconstructed data into multiple parts based on multiple features in the reconstructed data. Furthermore, the data corresponding to each feature is provided to classifier module 109. Classifier module 109 is configured to determine a loss function corresponding to each part to accurately determine the individual reconstruction loss. Classifier module 109 is also configured to determine the overall reconstruction loss as a weighted combination of individual reconstruction losses. The overall reconstruction loss is then compared to a threshold. When the overall reconstruction loss exceeds the threshold, classifier module 109 determines that input data 103 contains anomalies. The user can be notified of the anomaly and the features of the input data containing the anomaly, enabling the user to further investigate the detected anomaly.

[0115] Based on the anomaly detection results provided by classifier module 109, the user can provide feedback to classifier module 109. User feedback may include labeling information associated with input data being misclassified as anomaly, and vice versa. Adjuster module 209 uses the labeled data in the user feedback to adjust or regulate the thresholds and weights used for individual reconstruction loss, so that the modified result of anomaly detector 700 is consistent with the label (anomaly or non-anomaly) corresponding to the input data 103 provided through user feedback.

[0116] In some implementations, the output interface 727 may be configured to render anomaly detection results on a display device 709. Examples of display devices 709 include computer monitors, televisions, projectors, or mobile devices. The computer-based anomaly detector 700 may also be connected to an application interface 725, which is adapted to connect the computer-based anomaly detector 700 to an external device 723 for performing various tasks.

[0117] Implementation

[0118] The description provides only exemplary embodiments and is not intended to limit the scope, applicability, or configuration of this disclosure. Rather, the following description of exemplary embodiments will provide those skilled in the art with enabling descriptions for implementing one or more exemplary embodiments. Various changes to the function and arrangement of the elements will be contemplated without departing from the spirit and scope of the disclosed subject matter as set forth in the appended claims.

[0119] Specific details are set forth in the following description to provide a thorough understanding of the embodiments. However, it will be understood by those skilled in the art that embodiments may be practiced without these specific details. For example, systems, processes, and other elements in the disclosed subject matter may be shown as components in block diagram form to avoid obscuring the embodiments with unnecessary detail. In other instances, well-known processes, structures, and techniques may be shown without unnecessary detail to avoid obscuring the embodiments. Furthermore, similar reference numerals in the various figures indicate similar elements.

[0120] Furthermore, the various implementations can be described as processes depicted as flowcharts, data flow diagrams, structural diagrams, or block diagrams. Although flowcharts may describe operations as sequential processes, many operations can be executed in parallel or concurrently. Additionally, the order of operations can be rearranged. A process may terminate upon completion of its operations, but may have additional steps not discussed or included in the diagrams. Moreover, not all operations in any specifically described process may occur in all implementations. A process may correspond to a method, function, procedure, subroutine, subroutine, etc. When a process corresponds to a function, the termination of the function may correspond to the function returning to the calling function or the main function.

[0121] Furthermore, implementations of the disclosed subject matter can be implemented, at least partially, manually or automatically. They can be performed, or at least assisted in, manual or automatic implementation using machines, hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented in software, firmware, middleware, or microcode, program code or code segments that perform the necessary tasks can be stored in a machine-readable medium. The processor can perform the necessary tasks.

[0122] Furthermore, the embodiments of this disclosure and the functional operations described in this specification can be implemented in digital electronic circuits, in tangibly embodied computer software or firmware, in computer hardware including the structures disclosed in this specification and their structural equivalents, or in a combination of one or more of these. Additionally, some embodiments of this disclosure can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions embodied on a tangible, non-transitory program carrier for execution by a data processing device or for controlling the operation of a data processing device. Furthermore, program instructions can be encoded on artificially generated propagation signals, such as machine-generated electrical signals, optical signals, or electromagnetic signals, which are generated to encode information for transmission to a suitable receiving device for execution by the data processing device. The computer storage medium can be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of these.

[0123] A computer program (also referred to or described as a program, software, software application, module, software module, script, or code) may be written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and it may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for a computing environment. A computer program may (but does not necessarily) correspond to a file in a file system. A program may be stored as part of a file containing other programs or data (e.g., in one or more scripts in a markup language document), in a single file dedicated to the program in question, or in multiple coordination files, such as files storing one or more modules, subroutines, or portions of code. A computer program may be deployed to execute on a single computer, at a single site, or on multiple computers distributed across multiple sites and interconnected by a communication network. As an example, computers suitable for executing computer programs include those based on general-purpose or special-purpose microprocessors or both, or any other type of central processing unit. Typically, the central processing unit receives instructions and data from read-only memory or random access memory or both. The basic elements of a computer are the central processing unit for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include or be operatively coupled to receive data from or transfer data to one or more mass storage devices (e.g., magneto-optical, magneto-optical, or optical discs) used for storing data, or both. However, a computer does not necessarily need to have these devices. Furthermore, a computer may be embedded in another device, such as a mobile phone, personal digital assistant (PDA), mobile audio or video player, game console, global positioning system (GPS) receiver, or portable storage device such as a universal serial bus (USB) flash drive.

[0124] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, or tactile input. Additionally, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending a webpage to a web browser in response to a request received from a web browser on the user's client device.

[0125] The embodiments of the subject matter described in this specification can be implemented in a computing system that includes back-end components (e.g., as a data server), or middleware components (e.g., an application server), or front-end components (e.g., a client computer with a graphical user interface or web browser through which a user can interact with the implementation of the subject matter described in this specification), or any combination of one or more such back-end, middleware, or front-end components. The components of the system can be interconnected via digital data communication of any form or medium, such as a communication network. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), such as the Internet.

[0126] Computing systems may include clients and servers. Clients and servers are typically geographically separated and usually interact through communication networks. The client-server relationship arises from computer programs running on individual computers that have client-server relationships with each other.

[0127] Although this disclosure has been described with reference to specific preferred embodiments, it will be understood that various other adjustments and modifications may be made within the spirit and scope of this disclosure. Therefore, aspects of the appended claims cover all such variations and modifications that fall within the true spirit and scope of this disclosure.

Claims

1. An anomaly detector, the anomaly detector comprising: An input interface configured to accept input data; At least one processor; and a memory storing instructions for forming a module of the anomaly detector, wherein the at least one processor is configured to execute the instructions of the module of the anomaly detector, the module comprising: A data loader module is configured to divide the input data into multiple parts based on multiple features of the input data, and to vectorize each of the multiple parts of the input data to determine multiple vectorized parts of the input data; A cascaded model configured to cascade the plurality of vectorized portions of the input data to form cascaded data; An autoencoder comprising an encoder trained to encode the cascaded data and a decoder trained to decode the encoded data to reconstruct the input data, wherein the autoencoder has been trained based on non-abnormal sample data. The classifier is configured as follows: Determine a reconstruction loss that indicates the difference between the accepted input data and the reconstructed input data, wherein the reconstruction loss includes a weighted combination of multiple loss functions, different types of loss functions, or both, that evaluate the reconstruction loss of multiple parts of the reconstructed input data; and When the reconstruction loss exceeds a threshold, anomalies are detected in the reconstructed input data; and Output interface, which renders the results of anomaly detection.

2. The anomaly detector according to claim 1, wherein, The input interface is also configured to accept user input based on the result of the anomaly detection, wherein the user input includes a label indicating whether the accepted input data is abnormal.

3. The anomaly detector according to claim 2, wherein, The module also includes: An adjuster configured to update at least one of the thresholds and weights of at least one of the plurality of loss functions in the weighted combination in response to accepted user input, so as to adjust the reconstruction loss such that the result of the anomaly detection is consistent with the label.

4. The anomaly detector according to claim 1, wherein, The input interface is also configured to accept user input based on the result of the anomaly detection, wherein the user input includes a label indicating an incorrect classification of the accepted input data.

5. The anomaly detector according to claim 4, wherein, The module also includes: An adjuster configured to update at least one of the thresholds and weights of at least one of the plurality of loss functions in the weighted combination in response to accepted user input, in order to correct misclassification of the accepted input data.

6. The anomaly detector according to claim 1, wherein, The module further includes a segmentation module, which is configured to: Receive the reconstructed input data from the autoencoder; and The reconstructed input data is segmented into the multiple parts based on the multiple features present in the reconstructed input data.

7. The anomaly detector according to claim 6, wherein, The module further includes a loss function determination module, which is configured as follows: Receive each of the plurality of parts corresponding to the reconstructed input data; Determine a loss function suitable for calculating the loss of each part of the reconstructed input data; and The individual reconstruction loss corresponding to each part of the reconstructed input data is calculated based on the determined loss function.

8. The anomaly detector according to claim 7, wherein, The module further includes a weight determination module, which is configured to: Assign weights to each loss function; and Determine the weighted combination of the plurality of loss functions associated with the plurality of portions of the reconstructed input data.

9. The anomaly detector according to any one of claims 1-8, wherein, The input data corresponds to Internet proxy log data.

10. The anomaly detector according to claim 9, wherein, The module also includes a data loader module, which is configured to divide the internet proxy log data into multiple parts based on multiple features of the internet proxy log data. The multiple features of the internet proxy log data include embedding features, category features, and numerical features, and The data loader module is further configured to vectorize each of the plurality of parts of the Internet proxy log data.

11. The anomaly detector according to claim 10, wherein, The module also includes a word embedding module and a one-hot encoding module. The word embedding module is configured to vectorize the plurality of parts corresponding to the embedded features, and The one-hot encoding module is used to vectorize the multiple parts corresponding to the category features.

12. A method for anomaly detection, wherein, The method uses a processor coupled to stored instructions implementing the method, wherein the instructions, when executed by the processor, perform steps of the method, the method including the following steps: Receive input data; The input data is divided into multiple parts based on multiple features of the input data; Each of the plurality of portions of the input data is vectorized to determine a plurality of vectorized portions of the input data; The multiple vectorized portions of the input data are concatenated to form concatenated data; The cascaded data is encoded using a neural network with an autoencoder architecture, and the encoded data is decoded to reconstruct the input data, wherein the autoencoder is trained using non-abnormal sample data. Determine a reconstruction loss that indicates the difference between the accepted input data and the reconstructed input data, wherein the reconstruction loss includes a weighted combination of multiple loss functions that evaluate the reconstruction loss of multiple parts of the reconstructed input data, different types of loss functions, or both. When the reconstruction loss exceeds a threshold, anomalies are detected in the reconstructed input data; and Render the results of the anomaly detection.

13. A non-transitory computer-readable storage medium having a program implemented thereon, the program being executable by a processor to perform a method comprising: Receive input data; The input data is divided into multiple parts based on multiple features of the input data; Each of the plurality of portions of the input data is vectorized to determine a plurality of vectorized portions of the input data; The multiple vectorized portions of the input data are concatenated to form concatenated data; The cascaded data is encoded using a neural network with an autoencoder architecture, and the encoded data is decoded to reconstruct the input data, wherein the autoencoder is trained using non-abnormal sample data. Determine a reconstruction loss that indicates the difference between the accepted input data and the reconstructed input data, wherein the reconstruction loss includes a weighted combination of multiple loss functions that evaluate the reconstruction loss of multiple parts of the reconstructed input data, different types of loss functions, or both. When the reconstruction loss exceeds a threshold, anomalies are detected in the reconstructed input data; and Results of rendering anomaly detection.

Images