Data abnormality detection system

Abstract

To provide an improved system and method for detecting data abnormality.SOLUTION: A data analysis system accesses data generated on a data platform to analyze the data to detect data abnormality. Analyzing includes: using principal component analysis (PCA) to generate an optimum coordinate system without reducing the number of dimensions; converting the data into the optimum coordinate system without reducing the number of dimensions; and applying a sigma rule to the data converted on the optimum coordinate system. The sigma rule can be a 3-sigma rule. The data analysis system also includes: generating a notification or an alert relating to the data abnormality to transmit the same to a user or a downstream component; and removing the data abnormality to derive the undated data to provide the updated data for the downstream system for use.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The subject matter disclosed herein relates generally to data anomaly detection. Specifically, the present disclosure addresses systems and methods for detecting data anomalies by generating a new coordinate system, transforming data into the new coordinate system, and applying the Sigma statistical rule. [Background technology]

[0002] A data platform may have tens of thousands of pipeline jobs running daily. These jobs generate large amounts of data. This leads to the problem of how to efficiently monitor the data and accurately detect anomalous data or data anomalies. If data anomalies are not detected and corrected, they may cause inaccurate results in downstream processes or systems. [Brief explanation of the drawings]

[0003] [Figure 1A] FIG. 1 illustrates the 3 sigma rule for data anomaly detection. [Figure 1B] FIG. 10 illustrates an exemplary plot showing data anomalies that cannot be detected using the Sigma rule. [Figure 2] FIG. 10 illustrates an exemplary plot on an optimal coordinate system generated using principal component analysis. [Figure 3] FIG. 1 illustrates an exemplary network environment suitable for detecting data anomalies using Sigma rules, according to an exemplary embodiment. [Figure 4] FIG. 1 illustrates components of a data analysis system and an exemplary downstream system, according to an exemplary embodiment. [Figure 5] 1 is a flowchart illustrating the operation of a method for detecting data anomalies using the Sigma rule, in accordance with an example embodiment. [Figure 6]FIG. 1 is a block diagram illustrating components of a machine capable of reading instructions from a machine storage medium and performing any one or more of the methods described herein, according to some examples. DETAILED DESCRIPTION OF THE INVENTION

[0004] The following description describes systems, methods, techniques, instruction sequences, and computing machine program products that illustrate examples of the present subject matter. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide an understanding of various examples of the present subject matter. However, it will be apparent to those skilled in the art that various examples of the present subject matter may be practiced without some or other of these specific details. The examples are merely representative of possible variations. Unless otherwise specified, structures (e.g., structural components) are optional and may be combined or subdivided, and operations (e.g., in a procedure, algorithm, or other function) may be resequenced or combined or subdivided.

[0005] Exemplary embodiments address the technical challenge of efficiently and accurately detecting anomalies in data generated on a data platform. The sigma statistical rule (also referred to as the "sigma rule") is a common technique for detecting anomalous data. In particular, the 3-sigma rule can be used to detect data anomalies, whereby normal data lies between μ-3σ and μ+3σ (e.g., the 3-sigma normal range), as shown in FIG. 1A. Here, μ is the mean value of the distribution, and σ is its standard deviation. These two parameters are obtained based on statistics and can be used to identify any outliers (e.g., data point 102) outside the 3-sigma normal range (shown by the dotted line). Although exemplary embodiments are described herein with reference to the 3-sigma rule, other sigma rules can also be used. For example, instead of the 3-sigma rule, the 2-sigma rule, the 4-sigma rule, the 5-sigma rule, etc. can be used.

[0006] However, there are situations in which the Sigma Rule cannot accurately detect data anomalies. In statistics, correlation is any statistical relationship between two random variables, typically referring to the degree to which a pair of variables is linearly related. Referring to FIG. 1B, an exemplary plot is shown illustrating a data anomaly that cannot be detected using the Sigma Rule. While it is clear to a human observing FIG. 1B that data point A is an outlier, a computer cannot detect the outlier using the known Sigma Rule. The plot shows the relationship between variable X and variable Y. For example, when the 3 Sigma Rule is used to detect X, the normal range is 7 to 9. For Y, the normal range is 0.9 to 1.15. Therefore, data point A is not considered an outlier because its X and Y values ​​fall between their respective normal ranges. However, the "actual" normal range is along the solid line 104.

[0007] To address the shortcomings of the 3 Sigma rule or the general Sigma rule, exemplary embodiments use principal component analysis (PCA) to generate a new optimal coordinate system. In one exemplary embodiment, the optimal coordinate system is generated based on maximizing the variance of two or more dimensional data. In an alternative embodiment, the optimal coordinate system is generated based on linear regression for two-dimensional data. Referring now to FIG. 2, an exemplary plot on an optimal coordinate system generated using principal component analysis is shown. Using new X and Y axes and applying the Sigma rule (e.g., shown as a dashed line), point A clearly does not fall within the range of the Sigma rule and is an outlier. While the examples in FIGS. 1A, 1B, and 2 show two-dimensional data points, exemplary embodiments also apply to any multi-dimensional data points (e.g., three-dimensional data points). The process for generating the optimal coordinate system is described in more detail below.

[0008] Thus, the exemplary embodiments address the technical challenge of efficiently and accurately detecting data anomalies in large data sets generated on a data platform. Unlike typical PCA techniques, a new coordinate system is first constructed using PCA without reducing the number of dimensions. The data to be analyzed is then transformed into the new coordinate system. After transformation, the Sigma rule is applied to detect and output data anomalies. In some embodiments, data anomalies may be removed before sending the corrected data to downstream systems for further processing. Thus, the exemplary embodiments provide a technical solution for improving computer functionality and operation by accurately detecting data anomalies and correcting them so as not to adversely affect downstream components, processes, and results.

[0009] 3 illustrates an exemplary network environment 300 suitable for detecting data anomalies using the Sigma (statistical) rule, according to an exemplary embodiment. Network system 302 provides server-side functionality to multiple user devices 306 over a communications network 304 (e.g., the Internet, a wireless network, a cellular network, or a wide area network (WAN)). Network system 302 may comprise any entity with a data platform that generates large amounts of data. For example, network system 302 may be associated with a banking site, an e-commerce site, a travel-related site, a social networking site, etc.

[0010] In various cases, user device 306 is a device associated with a user account of a user of network system 302. In some cases, user device 306 is a device of an individual that uses network system 302 to perform searches, transactions, or other processes, thus triggering the generation of data in network system 302. In other cases, user device 306 is a device associated with an individual who is an operator or administrator of network system 302, and who uses user device 306 to monitor and analyze data and / or correct (e.g., remove) data anomalies.

[0011] The user device 306 interfaces with the network system 302 through a connection to the network 304. Depending on the configuration of the user device 306, any of a variety of types of connection and network 304 may be used. For example, the connection may be a Code Division Multiple Access (CDMA) connection, a Global System for Mobile communications (GSM) connection, or another type of cellular connection. Such a connection may implement any of a variety of types of data transfer technologies, such as single-carrier radio transmission technology (1xRTT), Evolution-Data Optimized (EVDO) technology, General Packet Radio Service (GPRS) technology, Enhanced Data rates for GSM Evolution (EDGE) technology, or other data transfer technologies (e.g., fourth-generation wireless, 4G networks, 5G networks). When such technologies are used, the network 304 includes a cellular network having multiple cell sites with overlapping geographic coverage interconnected by a cellular telephone exchange. These cellular telephone switches are connected to a network backbone (eg, the public switched telephone network (PSTN), a packet-switched data network, or other type of network).

[0012] In another example, the connection to network 304 is a Wireless Fidelity (Wi-Fi, IEEE 802.11x type) connection, a Worldwide Interoperability for Microwave Access (WiMAX) connection, or another type of wireless data connection. In such an example, network 304 includes one or more wireless access points connected to a local area network (LAN), a wide area network (WAN), the Internet, or another packet-switched data network. In yet another example, the connection to network 304 is a wired connection (e.g., an Ethernet link), and network 304 is a LAN, a WAN, the Internet, or another packet-switched data network. Accordingly, a variety of different configurations are expressly contemplated.

[0013] The user devices 306 may include, but are not limited to, smartphones, tablets, laptops, multiprocessor systems, microprocessor-based or programmable consumer electronics, game consoles, set-top boxes, servers, or any other communication devices capable of accessing the network system 302. The user devices 306 may include a display component (not shown) for displaying information (e.g., in the form of a user interface). The user devices 306 may be operated by a human user and / or a machine user.

[0014] With particular reference to network system 302, an application programming interface (API) server 308 and a web server 310 are coupled to one or more networking servers 312 and provide a programmatic interface and a web interface, respectively. The one or more networking servers 312 host various systems, including a data processing system 314 and a data analysis system 316, each of which may comprise multiple components and be embodied as hardware, software, firmware, or any combination thereof.

[0015] In particular, data processing system 314 includes components that generate data in network system 302. The data may include logistics data, financial data, social networking data, transactional data, or any other type of data, and may be structured or unstructured. For example, if network system 302 is associated with a banking site, data processing system 314 may generate data related to banking transactions, account lookup operations, loan applications, etc. In another example, if network system 302 is associated with a commerce site, data processing system 314 may generate data related to sales transactions, revenue information, the number of users performing various operations (e.g., search, add to wishlist, purchase, return), etc. The data may be generated by different components or sources.

[0016] The data analysis system 316 analyzes the data generated by the data processing system 314. Specifically, the data analysis system 316 aggregates and monitors the data generated by the data processing system 314 and detects any data anomalies. Although the data analysis system 316 is shown within the network system 302, in alternative embodiments, the data analysis system 316 may be located outside the network system 302 but communicatively coupled via the network 304. The data analysis system 316 is described in more detail in connection with FIG. 4 below.

[0017] The one or more networking servers 312 are connected to one or more database servers 318 that provide access to one or more storage repositories or data stores 320. Data stores 320 are storage devices that store user accounts, including user profiles, and data generated by data processing system 314.

[0018] Any of the systems, servers, data storage devices, or devices (collectively "components") shown in or associated with FIG. 3 may be, include, or otherwise be implemented as a special-purpose (e.g., specialized or otherwise non-general-purpose) computer that can be modified (e.g., configured or programmed with software, such as one or more software components of an application, operating system, firmware, middleware, or other program) to perform one or more of the functions described herein for that system or machine. For example, a special-purpose computer system capable of implementing any one or more of the methods described herein is described below with respect to FIG. 6, where such a special-purpose computer is a means for performing any one or more of the methods described herein. Within the technical field of such special-purpose computers, a special-purpose computer modified with the structures described herein to perform the functions described herein is a technical improvement compared to other special-purpose computers that lack the structures described herein or that are otherwise incapable of performing the functions described herein. Thus, special purpose machines constructed in accordance with the systems and methods described herein offer an improvement over the art of similar special purpose machines.

[0019] 3 may be combined, and the functionality described herein for any single component may be subdivided among multiple components. Functionality of a particular system may, in alternative examples, be embodied in different systems. For example, any number of user devices 306 or data storage devices 320 may be embodied within network environment 300. While only a single network system 302 is shown, alternatively, two or more network systems 302 may be included (e.g., localized to a particular region).

[0020] 4 is a diagram illustrating components of a data analysis system 316 in communication with downstream systems, according to an exemplary embodiment. The data analysis system 316 accesses data generated by the data processing system 314 and analyzes the data to detect one or more data anomalies. To enable these processes, the data analysis system 316 includes a data access component 402, a coordinate component 404, an anomaly detection component 406, a notification component 408, a data correction component 410, and a downstream data component 412, all of which are configured to communicate with each other (e.g., via a bus, shared memory, or switch). The data analysis system 316 may include other components not necessary for the operation of an embodiment of the inspector.

[0021] The data access component 402 is configured to access data generated by the data processing system 314. The data may be accessed periodically (e.g., nightly, once a week), when a certain amount of data is generated, and / or when triggered (e.g., by an administrator via the user device 306). The data access component 402 may obtain data directly from the data processing system 314, from the data storage device 320, or a combination of both. The data accessed (e.g., aggregated) may be from different sources or components of the data processing system 314.

[0022] The coordinate component 404 is configured to generate a new, optimal coordinate system and transform the data into the new coordinate system. The exemplary embodiment uses principal component analysis (PCA) to generate the new coordinate system without reducing the dimensionality. PCA is commonly used to reduce the dimensionality of data. However, the coordinate component 404 uses PCA to construct the new coordinate system but imposes the strict condition that the dimensionality of the data is not reduced. Assume that the data has m rows, and each row of data has n features. The input data is a matrix, where m is the number of observations and n is the number of dimensions per observation. Thus, if the number of features in the input data is n, the output of the PCA is also n. Referring back to FIG. 2 , if PCA is used to reduce the dimensionality of the data, PCA picks up values ​​on the X-axis and ignores values ​​on the Y-axis. However, the outlier (data point A) is on the Y-axis. Thus, using PCA, the coordinate component 404 ensures that the number of dimensions of the input and the output remain the same.

[0023] In one embodiment, the generation of a new optimal coordinate system is based on maximizing the variance. To find the new X axis, the coordinate component 404 assumes that X is a vector with three unknown variables (u, v, w). Then, the coordinate component 404 maps all data points onto X. The values ​​on X and the variance on X are determined. The variance is an equation with the unknown variable X. For example, if the equation is -3X 2 If +4X-5, then X is max(-3X 2 +4X-5). This results in a straight line with maximum variance being the X axis.

[0024] A similar approach can be used to determine the Y and Z axes. For example, once the X axis is determined, the coordinate component 404 can identify a plane perpendicular to the X axis. The coordinate component 404 can map the data points onto this plane and maximize the variance to construct the Y axis. Once the Y axis is determined, the Z axis can be determined similarly.

[0025] While exemplary embodiments are described above based on maximizing variance, alternative embodiments can use linear regression for two-dimensional data. Linear regression attempts to obtain a linear function, such as y = ax + b, by determining values ​​for the parameters a and b. The values ​​of a and b are determined by minimizing the loss. For example, the loss for a particular observation or point is the distance along the Y-axis. The smaller the loss, the better the fit of the function. Linear regression obtains the sum of the losses for all observations. Thus, the values ​​of a and b are obtained by minimizing the sum of the losses for all data points in the data. By determining the linear function, a new X-axis is determined. Next, a new Y-axis perpendicular to the new X-axis is identified.

[0026] Once the new coordinate system is generated by the coordinate component 404, the coordinate component transforms the data into the new coordinate system without reducing the number of dimensions. The anomaly detection component 406 detects data anomalies on the transformed data on the new coordinate system. In an exemplary embodiment, the anomaly detection component 406 applies a sigma rule to the transformed data on the new coordinate system. In one embodiment, the sigma rule is a 3 sigma rule. Any data point that falls outside the range of the sigma rule is considered a data anomaly.

[0027] The notification component 408 is configured to provide notifications or alerts regarding detected data anomalies. In an exemplary embodiment, the notification component 408 generates a report or other form of alert indicating the data anomaly. The notification component 408 then transmits the report or alert to appropriate systems or individuals. For example, the notification component 408 can send an email to the administrator's user device 306 or trigger an alert to be displayed on a monitoring user interface of a device associated with the administrator.

[0028] The data correction component 410 is configured to remove or correct data anomalies detected by the anomaly detection component 406. In one embodiment, the data correction component 410 automatically removes data anomalies to generate corrected data. The automatic removal may be based on a set of rules that indicate when data may be automatically removed and when the data needs to be reviewed before removal. In other embodiments, the data correction component 410 flags data anomalies, and a human or machine user can review the flagged data anomalies and trigger their removal.

[0029] Once the data anomalies have been removed and the data has been corrected, the downstream data component 412 can send the corrected data to a downstream component for further processing or operation. As an example, the downstream data component 412 can send the data to a machine learning system 414.

[0030] In embodiments in which the data correction component 410 flags data anomalies but does not correct them, the downstream data component 412 can send the uncorrected data with the data anomalies to a downstream component that can correct the uncorrected data (e.g., remove the data anomalies). For example, instead of or in addition to sending a notification generated by the notification component 408, the downstream data component 412 can send the uncorrected data flagged by the data correction component 410 to a component external to the data analysis system 316 (e.g., a component similar to the data correction component 410) for correction, or can send the uncorrected data to a user (e.g., an administrator), a machine, or a machine learning system for review before correction.

[0031] In embodiments in which the modified data is sent to the machine learning system 414, the machine learning system 414 is configured to train one or more machine learning (ML) models to determine probabilities for particular tasks. The machine learning system 414 also refines the ML models by further retraining them with the modified (training) data. The machine learning system 414 can then apply new data, which may be new modified data from the data analysis system 316, to the trained ML models to obtain results. Thus, the machine learning system 414 includes a training component 416 and an evaluation component 418.

[0032] In some embodiments, the training component 416 trains one or more ML models using the corrected data. Because the corrected data has data anomalies removed, training results in more accurate ML models. Machine learning can be performed using artificial intelligence, such as neural networks, and training the ML model(s) can include training probability estimates.

[0033] At runtime, or inference time, the evaluation component 418 of the machine learning system 414 can be configured to use the trained ML model to determine probabilities or other outcomes. In some cases, the corrected data is the data that is to be evaluated by the evaluation component 418. As with training, removing data anomalies prior to evaluation by the evaluation component 418 can yield more accurate results.

[0034] In preferred embodiments, the trained ML model from the machine learning system 414 is the recommendation model. In these cases, the evaluation component 418 uses the recommendation model to generate recommendations.

[0035] In some embodiments, the notifications generated by notification component 408, the uncorrected data, and / or the modified data are sent (e.g., by downstream data component 412) to anomaly analysis system 420. Anomaly analysis system 420 performs analysis of the data anomalies. For example, anomaly analysis system 420 may attempt to determine what the cause of each data anomaly was. For example, anomaly analysis system 420 may attempt to identify components or systems that may have caused the anomaly. In other cases, anomaly analysis system 420 may attempt to correlate anomalies with trends, current events, or other data to identify the cause of the anomaly or the relationship between the trends, current events, and other data and the anomaly.

[0036] 5 is a flowchart illustrating the operations of a method 500 for detecting data anomalies using the Sigma rule, according to an example embodiment. Each operation in the method 500 may be performed by the data analysis system 316 using the components described above with respect to FIG. 4 . Accordingly, the method 500 is illustratively described with reference to the data analysis system 316. However, it should be noted that at least some of the operations of the method 500 may be deployed on a variety of other hardware configurations or may be performed by similar components residing elsewhere in the network environment 300. Accordingly, the method 500 is not intended to be limited to the data analysis system 316.

[0037] In operation 502, the data access component 402 accesses data generated by the data platform (e.g., data processing system 314). The data may be accessed periodically, when a certain amount of data is generated, or when triggered by a user. The data access component 402 may aggregate / collect data directly from the data processing system 314, from the data storage device 320, or a combination of both. In an exemplary embodiment, the data access component 402 may be configured or directed to access, for example, a particular type of data, data for a particular date range, and / or data generated by a particular component(s) for analysis. The data may be from any source associated with the data processing system 314.

[0038] In operation 504, the coordinate component 404 generates a new optimal coordinate system. In an exemplary embodiment, the coordinate component 404 uses PCA to generate the optimal coordinate system without reducing the dimensionality of the data. In one embodiment, the generation of the optimal coordinate system is based on maximizing variance. To find the new X-axis, the coordinate component 404 maps all data points onto X. The values ​​on X and the variance on X are identified. The variance is then maximized. Once the X-axis is determined, the coordinate component 404 identifies a plane perpendicular to the X-axis. The coordinate component 404 then maps the data points onto this plane and maximizes the variance to construct the Y-axis. A similar process can be used to find the Z-axis, if desired.

[0039] In operation 506, coordinate component 604 transforms the data into an optimal coordinate system, without reducing the dimensionality of the data. In operation 508, the anomaly detection component 406 applies a sigma rule to the transformed data on the optimal coordinate system to detect anomalies. The sigma rule provides a normal range for the data. Any data point outside the normal range is considered a data anomaly. In one embodiment, the sigma rule applied to the transformed data is a 3 sigma rule.

[0040] In operation 510, the notification component 408 provides a notification or alert regarding the detected data anomalies. In an exemplary embodiment, the notification component 408 generates a report or other form of notification or alert indicating the data anomaly. The notification component 408 then sends the notification to an appropriate system or causes the notification to be displayed on an appropriate system. In some cases, the notification can be sent to the anomaly analysis system 420 along with the corresponding or corrected data. The anomaly analysis system 420 can then attempt to determine what the cause of each data anomaly was, or correlate the anomaly with trends, current events, or other data to identify causes or relationships.

[0041] In operation 512, the data correction component 410 removes data anomalies detected by the anomaly detection component 406. In one embodiment, the data correction component 410 automatically removes data anomalies to generate updated data. The automatic removal may be based on a set of rules that indicate when data may be automatically removed and when the data must be verified before removal. In some cases, the data correction component 410 flags data anomalies, and a human or machine user triggers the removal of the flagged data after verification.

[0042] It should be noted that operations 510 and 512 may be optional. Furthermore, operation 512 may be performed before operation 510. 6 illustrates components of a machine 600 capable of reading instructions from a machine storage medium (e.g., a machine storage device, a non-transitory machine storage medium, a computer storage medium, or any suitable combination thereof) and performing any one or more of the methods described herein, according to some example embodiments. Specifically, FIG. 6 illustrates a schematic diagram of the machine 600 in the example form of a computing device (e.g., a computer) on which instructions 624 (e.g., software, programs, applications, applets, apps, or other executable code) may be executed, in whole or in part, to cause the machine 600 to perform any one or more of the methods described herein.

[0043] For example, instructions 624 may cause machine 600 to perform the flow diagram of Figure 5. In particular embodiments, instructions 624 may transform machine 600 into a specific machine (e.g., a specially configured machine) that is programmed to perform the functions described and illustrated in the manner described.

[0044] In alternative embodiments, machine 600 operates as a standalone device or may be connected (e.g., networked) to other machines. In a networked configuration, machine 600 may operate as a server or client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. Machine 600 may be a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a smartphone, a web appliance, a network router, a network switch, a network bridge, a compute beacon, or any machine capable of executing (sequentially or otherwise) instructions 624 that specify operations to be performed by the machine. Furthermore, although only a single machine is shown, the term “machine” should also be interpreted to include a collection of machines that individually or together execute instructions 624 to perform any one or more of the methods described herein.

[0045] Machine 600 includes one of a processor 602 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), or any suitable combination thereof), a main memory 604, and a static memory 606, which are configured to communicate with each other via a bus 608. Processor 602 may include microcircuits that are temporarily or permanently configurable with some or all of instructions 624 such that processor 602 is configurable, in whole or in part, to perform any one or more of the methods described herein. For example, a set of one or more microcircuits in processor 602 may be configurable to execute one or more modules (e.g., software modules) described herein.

[0046] In some embodiments, machine 600 may further include a graphics display 610 (e.g., a plasma display panel (PDP), a light-emitting diode (LED) display, a liquid crystal display (LCD), a projector, or a cathode ray tube (CRT), or any other display capable of displaying graphics or moving images). Machine 600 may also include input devices 612 (e.g., a keyboard), cursor control devices 614 (e.g., a mouse, touchpad, trackball, joystick, motion sensor, or other pointing device), a storage unit 616, a signal generation device 618 (e.g., a sound card, amplifier, speaker, headphone jack, or any suitable combination thereof), and a network interface device 620.

[0047] Storage unit 616 includes machine storage medium 622 (e.g., tangible machine storage medium) on which are stored instructions 624 (e.g., software) that embody any one or more of the methods or functions described herein. The instructions 624 may also reside, completely or at least partially, in main memory 604, in processor 602 (e.g., in a processor's cache memory), or both before or during execution of the instructions by machine 600. Thus, main memory 604 and processor 602 can be considered machine storage media (e.g., tangible and non-transitory machine storage media). The instructions 624 can be transmitted or received over network 626 via network interface device 620.

[0048] In some demonstrative embodiments, machine 600 may be a portable computing device and may have one or more additional input components (e.g., sensors or gauges). Examples of such input components include an image input component (e.g., one or more cameras), an audio input component (e.g., a microphone), a directional input component (e.g., a compass), a position input component (e.g., a global positioning system (GPS) receiver), an orientation component (e.g., a gyroscope), a motion detection component (e.g., one or more accelerometers), an altitude detection component (e.g., an altimeter), and a gas detection component (e.g., a gas sensor). Inputs collected by any one or more of these input components may be accessible and available for use by any of the components described herein.

[0049] Executable Instructions and Machine Storage Media Various memories (e.g., 604, 606, and / or memory of processor(s) 602) and / or storage units 616 may store one or more sets of instructions and data structures (e.g., software) 624 that embody or are utilized by any one or more of the methods or functions described herein. These instructions, when executed by one or more processors 602, cause various operations to be performed to implement the disclosed embodiments.

[0050] As used herein, the terms “machine storage medium,” “device storage medium,” and “computer storage medium” (collectively “machine storage medium 622”) mean the same thing and may be used interchangeably in this disclosure. These terms refer to single or multiple storage devices and / or media (e.g., centralized or distributed databases and / or associated caches and servers) that store executable instructions and / or data, as well as cloud-based storage systems or storage networks that include multiple storage devices or devices. Accordingly, these terms shall be interpreted to include, but not be limited to, solid-state memory, including memory internal or external to a processor, and optical and magnetic media. Specific examples of machine storage medium, computer storage medium, and / or device storage medium 622 include, for example, non-volatile memory, including semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), FPGAs, and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The terms "machine storage medium" or "computer storage medium" or "device storage medium" or "device storage medium" 622 specifically exclude carrier waves, modulated data signals, and other such media, at least some of which are covered under the term "signal media" described below. In this context, machine storage media are non-transitory.

[0051] signal medium The terms "signal media" or "transmission media" shall be interpreted to include any form of modulated data signal, carrier wave, etc. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.

[0052] Computer-readable medium The terms "machine-readable medium," "computer-readable medium," and "device-readable medium" mean the same thing and may be used interchangeably in this disclosure. These terms are defined to include both mechanical storage medium(s) and signal medium(s). Thus, these terms include both storage devices / medium and carrier wave / modulated data signals.

[0053] The instructions 624 may also be transmitted or received over a communications network 626 using a transmission medium via the network interface device 620 and utilizing any one of several well-known transfer protocols (e.g., HTTP). Examples of communications network 626 include a local area network (LAN), a wide area network (WAN), the Internet, a cellular network, a plain old telephone service (POTS) network, and a wireless data network (e.g., Wi-Fi, LTE, and WiMAX networks). The term “transmission medium” shall be taken to include any intangible medium capable of storing, encoding, or carrying the instructions 624 for execution by the machine 600, including digital or analog communications signals or other intangible media for enabling communication of such software.

[0054] Throughout this specification, multiple instances may implement a component, operation, or structure described as a single instance. Although individual operations of one or more methods are illustrated and described as separate operations, one or more of the individual operations may occur simultaneously, and there is no requirement that the operations occur in the order shown. Structures and functions presented as separate components in example configurations may be implemented as a combined structure or component. Similarly, structures and functions presented as a single component may be implemented as separate components. These and other variations, modifications, additions, and improvements are encompassed within the scope of the subject matter of this specification.

[0055] A "component" refers to a device, physical entity, or logic with boundaries defined, for example, by function or subroutine calls, branch points, application programming interfaces (APIs), or other techniques that provide partitioning or modularization of specific processing or control functions. Multiple components can be combined through interfaces with other components to perform machine processing. A component is a packaged functional hardware unit designed to be used in conjunction with other components, and may be part of a program that typically performs a specific function among multiple related functions. Multiple components can constitute either software components (e.g., code embodied in a machine-readable medium) or hardware components.

[0056] A "hardware component" is a tangible unit that can perform specific operations and can be configured or arranged in a specific physical manner. In various exemplary embodiments, one or more computer systems (e.g., standalone computer systems, client computer systems, or server computer systems) or one or more hardware components of a computer system (e.g., a processor or group of processors) can be configured by software (e.g., an application or application portion) as hardware components that operate to perform specific operations as described herein.

[0057] In some embodiments, a hardware component may be implemented mechanically, electronically, or any suitable combination thereof. For example, a hardware component may comprise dedicated circuitry or logic permanently configured to perform specific operations. For example, a hardware component may be a special-purpose processor such as an FPGA (field programmable gate array) or an ASIC. A hardware component may comprise programmable logic or circuitry temporarily configured by software to perform specific operations. For example, a hardware component may comprise software embodied within a general-purpose processor or other programmable processor. Once configured by such software, the hardware component is no longer a general-purpose processor, as it becomes a specific machine (or specific component of a machine) uniquely tailored to perform the function for which it is configured. It will be appreciated that the decision to implement a hardware component mechanically, in dedicated permanently configured circuitry, or in temporarily configured circuitry (e.g., configured by software) may be driven by cost and time considerations.

[0058] Thus, the term "hardware component" should be understood to encompass a tangible entity that is physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a particular manner or to perform particular operations described herein. Given examples in which hardware components are temporarily configured (e.g., programmed), each of the hardware components need not be configured or instantiated at any one instance. For example, if a hardware component comprises a general-purpose processor configured by software to be a special-purpose processor, the general-purpose processor may be configured at different times as different special-purpose processors (e.g., with different hardware components). Thus, software may, for example, configure a processor to configure a particular hardware component at one instance of time, while configuring a different hardware component at a different instance of time.

[0059] Hardware components can provide information to and receive information from other hardware components. Accordingly, the described hardware components can be considered communicatively coupled. When multiple hardware components exist contemporaneously, communication can be achieved by signal transmission between or among two or more of the multiple hardware components (e.g., via appropriate circuits and buses). In examples where multiple hardware components are configured or instantiated at different times, communication between such hardware components can be achieved, for example, through the storage and retrieval of information in memory structures accessed by the multiple hardware components. For example, one hardware component can not only perform an operation but also store the output of that operation in a communicatively coupled memory device. Another hardware component can then subsequently retrieve and process the stored output by accessing the memory device. Multiple hardware components can initiate communication with input or output devices or operate on resources (e.g., collections of information).

[0060] Various operations of the example methods described herein may be performed, at least in part, by one or more processors that are temporarily (e.g., by software) or permanently configured to perform the associated operations. Whether temporarily or permanently configured, such processors may constitute processor-implemented components that operate to perform one or more operations or functions described herein. As used herein, "processor-implemented components" refers to hardware components that are implemented using one or more processors.

[0061] Similarly, methods described herein may be at least partially processor-implemented, where a processor is an example of hardware. For example, at least some of the operations of a method may be performed by one or more processors or processor-implemented components. Furthermore, one or more processors may operate to support execution of associated operations in a "cloud computing" environment or as "software as a service" (SaaS). For example, at least some of the operations may be performed by a group of computers (as an example of a machine including multiple processors), and these operations may be accessible via a network (e.g., the Internet) and one or more appropriate interfaces (e.g., application program interfaces (APIs)).

[0062] Specific performance of multiple operations may reside not only within a single machine, but may also be distributed among one or more processors deployed across multiple machines. In some exemplary embodiments, one or more processors or processor-implemented components may be located in a single geographic location (e.g., in a home environment, an office environment, or a server farm). In other exemplary embodiments, one or more processors or processor-implemented components may be distributed across multiple geographic locations.

[0063] Multiple Examples Example 1 is a method for detecting data anomalies, the method including: a server accessing data generated on a data platform; the server detecting one or more data anomalies in the accessed data, the detecting one or more data anomalies including generating an optimal coordinate system without reducing the number of dimensions using principal component analysis (PCA), transforming the data to the optimal coordinate system without reducing the number of dimensions, and applying a Sigma rule to the transformed data on the optimal coordinate system; and the server generating and sending notifications of the one or more data anomalies.

[0064] In Example 2, the subject matter of Example 1 may optionally include that the sigma rule includes a 3 sigma rule. In Example 3, the subject matter of any of Examples 1-2 can optionally include wherein the sigma rule includes one of a 2 sigma rule, a 4 sigma rule, or a 5 sigma rule.

[0065] In Example 4, the subject matter of any of Examples 1-3 may optionally include generating and sending a notification including providing an indication of the one or more data anomalies to an anomaly analysis system, the anomaly analysis system performing further analysis of the one or more data anomalies.

[0066] In Example 5, the subject matter of any of Examples 1-4 may optionally include automatically removing one or more data anomalies to generate corrected data. In Example 6, the subject matter of any of Examples 1-5 may optionally include training a machine learning model using the corrected data from which one or more data anomalies have been automatically removed.

[0067] In Example 7, the subject matter of any of Examples 1-6 may optionally include, wherein training the machine learning model includes training a recommendation model to provide recommendation information.

[0068] In Example 8, the subject matter of any of Examples 1-7 can optionally include generating the optimal coordinate system based on maximizing variance. In Example 9, the subject matter of any of Examples 1-8 can optionally include generating the optimal coordinate system based on linear regression.

[0069] Example 10 is a system for detecting data anomalies. The system includes one or more processors and a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform a process including accessing data generated on a data platform, detecting one or more data anomalies in the accessed data, the one or more data anomalies including generating an optimal coordinate system without reducing the number of dimensions using principal component analysis (PCA), transforming the data to the optimal coordinate system without reducing the number of dimensions, and applying a sigma rule to the transformed data on the optimal coordinate system, and generating and sending notifications of the one or more data anomalies.

[0070] In Example 11, the subject matter of Example 10 can optionally include the sigma rule comprising a 3 sigma rule. In Example 12, the subject matter of any of Examples 10-11 can optionally include the sigma rule comprising one of a 2 sigma rule, a 4 sigma rule, or a 5 sigma rule.

[0071] In Example 13, the subject matter of any of Examples 10-12 may optionally include the step of generating and sending a notification including providing an indication of the one or more data anomalies to an anomaly analysis system, and the anomaly analysis system performing further analysis of the one or more data anomalies.

[0072] In Example 14, the subject matter of any of Examples 10-13 may optionally include, wherein the process further includes automatically removing one or more data anomalies to generate corrected data.

[0073] In Example 15, the subject matter of any of Examples 10-14 may optionally include, wherein the process further includes training a machine learning model using the corrected data from which the one or more data anomalies have been automatically removed.

[0074] In Example 16, the subject matter of any of Examples 10-15 may optionally include, wherein training the machine learning model includes training a recommendation model to provide recommendation information.

[0075] In Example 17, the subject matter of any of Examples 10-16 can optionally include generating the optimal coordinate system based on maximizing variance. In Example 18, the subject matter of any of Examples 10-17 can optionally include generating the optimal coordinate system based on linear regression.

[0076] Example 19 is a computer storage medium containing instructions that, when executed by one or more processors of the machine, cause the machine to perform a process for detecting data anomalies, the process including: accessing data generated on a data platform; detecting one or more data anomalies in the accessed data, the detecting the one or more data anomalies including generating an optimal coordinate system without reducing the number of dimensions using principal component analysis (PCA), transforming the data to the optimal coordinate system without reducing the number of dimensions, and applying a Sigma rule to the transformed data on the optimal coordinate system; and generating and sending notifications of the one or more data anomalies.

[0077] In Example 20, the subject matter of Example 19 can optionally include the sigma rule comprising a 3 sigma rule. Some portions of this specification are presented in terms of algorithms or symbolic representations of operations on data stored as bits or binary digital signals within a machine memory (e.g., a computer memory). These algorithms or symbolic representations are examples of techniques used by those skilled in the data processing arts to convey the substance of their work to others skilled in the art. As used herein, an "algorithm" is a self-consistent sequence of operations or similar processes leading to a desired result. In this context, algorithms and operations involve physical manipulation of physical quantities. Usually, though not necessarily, such quantities take the form of electrical, magnetic, or optical signals capable of being stored, accessed, transferred, combined, compared, and otherwise operated on (manipulated) by a machine. It is sometimes convenient, primarily for reasons of common usage, to refer to such signals using terms such as "data," "content," "bits," "values," "elements," "symbols," "characters," "terms," ​​"numbers," "digits," or the like. However, these terms are merely convenient labels and should be associated with the appropriate physical quantities.

[0078] Unless specifically stated otherwise, descriptions herein using terms such as "processing," "computing," "calculating," "determining," "presenting," "displaying," and the like refer to machine (e.g., computer) operations or processes that manipulate or transform data represented as physical (e.g., electronic, magnetic, or optical) quantities in one or more memories (e.g., volatile memory, non-volatile memory, or any suitable combination thereof), registers, or other machine components that receive, store, transmit, or display information. Furthermore, unless otherwise noted, the articles "a" or "an" are used herein to include one or more instances, as is common in patent documents. Finally, as used herein, the conjunction "or" refers to a non-exclusive "or" unless specifically stated otherwise.

[0079] Although the present subject matter has been generally described with reference to particular examples, various modifications and changes can be made to these examples without departing from the broader scope of the present invention. For example, various examples or features thereof may be mixed and matched or otherwise selected by those skilled in the art. Such examples of the present subject matter may be referred to herein, individually or collectively, by the term "invention" merely for convenience, and are not intended to spontaneously limit the scope of this application to any single invention or concept when in fact more than one is disclosed.

[0080] The examples provided herein are believed to be described in sufficient detail to enable those skilled in the art to practice the teachings disclosed. Other examples may be used and derived therefrom, such that structural and logical substitutions and changes may be made without departing from the scope of the disclosure. Therefore, the Detailed Description is not to be construed in a limiting sense, and the scope of the various examples is defined only by the appended claims, along with the full scope of equivalents to which such claims are entitled.

[0081] Furthermore, instances may be provided for resources, operations, or structures described herein as a single instance. In addition, boundaries between various resources, operations, modules, engines, and data stores are somewhat arbitrary, with particular operations being illustrated in the context of specific illustrative configurations. Other allocations of functionality are contemplated and may be included within the scope of various examples of the present invention. In general, structures and functionality presented as separate resources in an illustrative configuration may be implemented as combined structures or resources. Similarly, structures and functionality presented as a single resource may be implemented as separate resources. These and other variations, modifications, additions, and improvements are within the scope of the examples of the present invention as expressed by the appended claims. Accordingly, the specification and drawings are to be regarded in an illustrative and not a restrictive sense.

Claims

1. 1. A method comprising: a server accessing data generated on the data platform; the server detecting one or more data anomalies in the accessed data, Using principal component analysis (PCA) to generate an optimal coordinate system without reducing the number of dimensions; transforming the data into the optimal coordinate system without reducing the number of dimensions; applying a Sigma rule to the transformed data on the optimal coordinate system; and the server generating and transmitting a notification of the one or more data anomalies.

2. The method of claim 1 , wherein the sigma rule comprises a three-sigma rule.

3. The method of claim 1 , wherein the sigma rule comprises one of a 2 sigma rule, a 4 sigma rule, or a 5 sigma rule.

4. 10. The method of claim 1, wherein the generating and sending a notification comprises providing an indication of the one or more data anomalies to an anomaly analysis system, the anomaly analysis system performing further analysis on the one or more data anomalies.

5. The method of claim 1 , further comprising automatically removing the one or more data anomalies to generate corrected data.

6. The method of claim 5 , further comprising training a machine learning model using the corrected data from which the one or more data anomalies have been automatically removed.

7. The method of claim 6 , wherein training the machine learning model comprises training a recommendation model to provide recommendation information.

8. The method of claim 1 , wherein generating the optimal coordinate system is based on maximizing variance.

9. The method of claim 1 , wherein generating the optimal coordinate system is based on linear regression.

10. 1. A system comprising: one or more processors; and a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to: accessing the data generated on the data platform; detecting one or more data anomalies in the accessed data, Using principal component analysis (PCA) to generate an optimal coordinate system without reducing the number of dimensions; transforming the data into the optimal coordinate system without reducing the number of dimensions; applying a Sigma rule to the transformed data on the optimal coordinate system; and generating and transmitting a notification of the one or more data anomalies.

11. The system of claim 10 , wherein the sigma rule comprises a three sigma rule.

12. The system of claim 10 , wherein the sigma rule comprises one of a 2 sigma rule, a 4 sigma rule, or a 5 sigma rule.

13. 11. The system of claim 10, wherein generating and sending the notification comprises providing an indication of the one or more data anomalies to an anomaly analysis system, the anomaly analysis system performing further analysis on the one or more data anomalies.

14. The process comprises: The system of claim 10 , further comprising automatically removing the one or more data anomalies to generate corrected data.

15. The process comprises:

15. The system of claim 14, further comprising training a machine learning model using the corrected data from which the one or more data anomalies have been automatically removed.

16. The system of claim 15 , wherein training the machine learning model comprises training a recommendation model to provide recommendation information.

17. The system of claim 10 , wherein generating the optimal coordinate system is based on maximizing variance.

18. The system of claim 10 , wherein generating the optimal coordinate system is based on linear regression.

19. 1. A machine storage medium containing instructions that, when executed by one or more processors of a machine, cause the machine to: accessing the data generated on the data platform; detecting one or more data anomalies in the accessed data; Using principal component analysis (PCA) to generate an optimal coordinate system without reducing the number of dimensions; transforming the data into the optimal coordinate system without reducing the number of dimensions; applying a Sigma rule to the transformed data on the optimal coordinate system; and and generating and transmitting a notification of the one or more data anomalies.

20. The machine-storage medium of claim 19 , wherein the sigma rule comprises a three-sigma rule.

Images