Unusual Event Prediction Using Contrastive Learning

Abstract

Various techniques may include systems and methods for predicting anomalous events using contrastive learning in a data processing system. The method may include accessing an unstructured data file and contextual data associated with the unstructured data file. The method may also include generating an event data input element for the unstructured data file. The event data input element may include a set of feature vectors. The set of feature vectors may include a first feature vector generated by processing the unstructured file using a first encoder and a second feature vector generated by processing the contextual data using a second encoder. The method may also include generating a classification result for the unstructured data file by processing the event data input element using a machine learning model, the classification result including a prediction of whether a particular event corresponds to an anomalous event.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims priority to U.S. Provisional Patent Application No. 17 / 654,891, entitled "Anomalous Event Prediction Using Contrastive Learning," filed March 15, 2022, the contents of which are incorporated herein by reference in their entirety for all purposes.

[0002] Technical Field The present disclosure relates generally to predicting anomalous events in data processing systems, and more particularly to techniques for predicting anomalous events in data processing systems using contrastive learning. [Background technology]

[0003] background An anomalous event may refer to an event that is not associated with any existing category or classification already recognized by the system. An anomalous event (e.g., an unrecognizable transaction) may be predicted based on various factors, such as the location and time when the event occurred, information about the entity that triggered the event, and the content of the communication exchanged during the event. However, predicting anomalous events using existing machine learning techniques may be difficult. Existing machine learning techniques may include training a machine learning model using training data that is identified by a corresponding training label. If there are various types of anomalous events in a given domain, the training label may not represent all those types of anomalous events. In practice, the predictive accuracy of the machine learning model may become suboptimal. Summary of the Invention [Means for solving the problem]

[0004] overview In some embodiments, a system and method are provided for predicting anomalous events using contrastive learning in a data processing system. The method can include accessing an unstructured data file. The unstructured data file can identify an occurrence of a particular event. The method can also include accessing contextual data associated with the unstructured data file. The contextual data can include information describing an environment in which the particular event occurred.

[0005] The method may also include generating an event data input element for the unstructured data file. The event data input element may include a collection of feature vectors. The event data input element may be generated by (1) generating a first feature vector of the collection of feature vectors by processing the unstructured data file with a first encoder, and (2) generating a second feature vector of the collection of feature vectors by processing the context data with a second encoder. In some cases, the first feature vector represents the unstructured data file in a first feature space, and the second feature vector represents the context data in a second feature space.

[0006] The one or more parameters of the first encoder and the one or more parameters of the second encoder can be learned by (i) transforming the first training feature vector in a first feature space to generate a first training transformed feature vector representing the training unstructured data file in a shared feature space, the training unstructured data file identifying a training event, (ii) transforming the second training feature vector in a second feature space to generate a second training transformed feature vector representing the training context data in the shared feature space, the training context data identifying the same training event as the training event, and (iii) generating a vector in the shared feature space based on the first training transformed feature vector and the second training transformed feature vector. Generating the vector can include combining information from the first training transformed feature vector and the second training transformed feature vector to result in a vector with improved projected predictability than either the first training feature vector or the second training feature vector alone.

[0007] The method may also include generating a classification result for the unstructured data file by processing the event data input elements with the machine learning model. The classification result may include a prediction of whether a particular event corresponds to an anomalous event. The method may also include outputting the classification result for the unstructured data file.

[0008] Some embodiments of the present disclosure include a system including one or more data processors. In some embodiments, the system includes a non-transitory computer-readable storage medium including instructions that, when executed on the one or more data processors, cause the one or more data processors to perform some or all of the methods and / or some or all of the processes disclosed herein. Some embodiments of the present disclosure include a computer program product tangibly embodied in a non-transitory machine-readable storage medium including instructions configured to cause the one or more data processors to perform some or all of the methods and / or some or all of the processes disclosed herein.

[0009] The above, together with other features and embodiments, will become more apparent with reference to the following specification, claims, and accompanying drawings. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 illustrates an example computing environment for anomalous event prediction using contrastive learning, according to some embodiments. [Diagram 2] FIG. 1 is a schematic example for generating feature vectors for unstructured files using a convolutional neural network, according to some embodiments. [Diagram 3] FIG. 2 is a schematic diagram for training a first encoder using contrastive learning, according to some embodiments. [Figure 4] 1 is a schematic example of a recurrent neural network, according to some embodiments. [Diagram 5] FIG. 1 is a schematic diagram for training a second encoder using contrastive learning, according to some embodiments. [Figure 6] FIG. 1 is a schematic diagram for further training a first encoder and a second encoder using contrastive learning, according to some embodiments. [Figure 7] FIG. 1 is a schematic diagram for training a classification engine for predicting anomalous events, according to some embodiments. [Figure 8] 1 is a flowchart illustrating an example of a method for predicting anomalous events using contrastive learning, according to some embodiments. [Figure 9] FIG. 1 is a simplified diagram illustrating a distributed system for implementing one of the embodiments. [Figure 10] FIG. 1 is a simplified block diagram illustrating one or more components of a system environment. [Figure 11] FIG. 1 illustrates an exemplary computer system in which various embodiments of the present invention may be implemented.

[0011] Like reference numbers and symbols in the various drawings indicate like elements, according to certain example embodiments. Additionally, multiple instances of an element may be indicated by a first number for the element followed by a letter or a hyphen and a second number. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Detailed Description I. Overview In the following description, specific details are given to provide a thorough understanding of the embodiments. However, it will be understood that the embodiments can be practiced without these specific details. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form in order to avoid obscuring the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments.

[0013] It should also be noted that particular embodiments may be described as a process that is depicted as a flowchart, a flow diagram, a data flow diagram, a structure diagram, or a block diagram. Although a flowchart or diagram may describe operations as a sequential process, many of the operations may be performed in parallel or simultaneously. Additionally, the order of operations may be rearranged. A process terminates when its operations are completed, but may have additional steps not included in the diagram. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination may correspond to a return of the function to the calling function or to the main function.

[0014] The following description merely provides preferred exemplary embodiments and is not intended to limit the scope, applicability, or configuration of the present disclosure. Rather, the following description of preferred exemplary embodiments provides those skilled in the art with an enabling description for implementing various embodiments. It will be understood that various changes can be made in the function and arrangement of elements without departing from the spirit and scope as set forth in the appended claims.

[0015] In the following description, specific details are given to provide a thorough understanding of the embodiments. However, it will be understood that the embodiments can be practiced without these specific details. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form in order to avoid obscuring the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments.

[0016] It should also be noted that particular embodiments may be described as a process that is depicted as a flowchart, a flow diagram, a data flow diagram, a structure diagram, or a block diagram. Although a flowchart or diagram may describe operations as a sequential process, many of the operations may be performed in parallel or simultaneously. Additionally, the order of operations may be rearranged. A process terminates when its operations are completed, but may have additional steps not included in the diagram. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination may correspond to a return of the function to the calling function or to the main function.

[0017] Techniques, systems, and methods are provided for predicting anomalous events using contrastive learning. Contrastive learning is a self-supervised machine learning technique that can train a machine learning model using unlabeled and unannotated training data. For each training element of the training data, data augmentation can be applied to generate "similar" training elements by applying a transformation. An encoder can then be trained to generate a feature vector for each individual training element, where a loss is defined to penalize instances where the feature vectors of similar training elements are far apart in a given feature space and / or instances where the feature vectors of different training elements are close to each other in a given feature space. The trained encoder can then be used to generate a feature vector for each of one or more non-training data elements, and it can be determined whether each individual training data element represents an anomalous event based on the loss between a particular feature vector and each of the existing feature vectors. Contrastive learning can be advantageous in that it can predict various types of anomalous events while reducing the additional need to generate target labels to train the machine learning model.

[0018] The abnormal event prediction system can access an unstructured data file that identifies the occurrence of a particular event. The abnormal event prediction system can be a computer server that communicates with other systems and / or client devices in the same or different communication network to access the unstructured data file. The unstructured data file can include unstructured data. The unstructured data can include information that does not have a predefined data model or is not organized in a predefined manner. The unstructured data file can correspond to a particular file format, such as an email file format, an image file format, a web page format, a document file format, an audio file format, a video file format, and other types of file formats that may be contemplated by one skilled in the art.

[0019] The anomalous event prediction system may then parse or otherwise analyze content from the unstructured data file to identify the occurrence of a particular event. In some cases, the anomalous event prediction system extracts text data by processing the image using optical character recognition, where the text data identifies the occurrence of a particular event. The particular event may be any type of event that identifies one or more actions involving an entity (e.g., an employee of an organization). For example, the particular event may be the purchase of a particular item by the entity, and the unstructured data file may be an image of a receipt associated with such purchase. In another example, the particular event may identify the occurrence of a telephone conversation between an entity and another entity, and the unstructured data file may be an audio recording of such telephone conversation.

[0020] The abnormal event prediction system may also access contextual data associated with the unstructured data file. Contextual data includes any information describing the environment in which a particular event occurred. Contextual data may include unstructured data, including unstructured text. In some cases, the contextual data includes structured data formatted according to a corresponding database schema or document object model. The contextual data may be used along with the unstructured data to further improve the accuracy of the machine learning model because the contextual data provides additional data points that may be relevant to predicting an anomalous event. The contextual data may also facilitate prediction of an anomalous event without the need to generate target labels for the training data (e.g., the training unstructured data file). The abnormal event prediction system may access the contextual data from one or more data stores, including a user profile data store that stores user profile data of entities involved in a particular event. The contextual data may include, but is not limited to, the following information that the abnormal event detection system may access: (i) the location where the particular event occurred, (ii) the entities involved in the particular event, (iii) another preceding or subsequent event predicted to be related to the particular event, and / or (iv) the type or category associated with the transaction associated with the particular event.

[0021] The abnormal event prediction system can then generate an event data input element. The event data input element can be a data structure (e.g., a tuple) that includes a collection of feature vectors that can be used to predict whether a particular event corresponds to an anomalous event. The abnormal event prediction system can generate the collection of feature vectors of the event data input element by using one or more machine learning models to process the unstructured data file and the contextual data.

[0022] In some embodiments, the abnormal event prediction system generates a first feature vector representing the unstructured data file in a first feature space by processing the unstructured data file using a first encoder. The encoder can include a machine learning model that processes an input to generate a feature vector that can be represented in a corresponding feature space. In some cases, the first encoder is a convolutional neural network or a multi-layer perceptron neural network. A feature vector as used herein refers to an n-dimensional vector of values ​​that collectively represent an object. The feature space can be an n-dimensional space in which the feature vector can be identified by its corresponding position. For example, the first feature vector can be an n-dimensional vector that includes a set of values ​​representing the unstructured data file, where each value of the set identifies a corresponding position of the first feature vector in a dimension of the first feature space. One or more parameters of the first encoder can be learned based on a loss determined between two training feature vectors of a first set of training feature vectors in a first feature space, where a training feature vector of the first set of training feature vectors can represent a training unstructured data file that is identical or similar to that of another training feature vector of the first set. Thus, training of the first encoder can facilitate identifying features of the unstructured data file based on the loss determined between the first feature vector and each of the first set of training feature vectors. In some cases, the first encoder includes a first contrastive loss function for determining a loss, where the loss can be used to tune one or more parameters of the first encoder.

[0023] The abnormal event prediction system can also generate a second feature vector representing the context data in a second feature space by processing the context data using a second encoder. The second feature vector can be an n-dimensional vector including a set of values ​​representing the context data, where each value of the set identifies a corresponding location of the second feature vector in a dimension of the second feature space. The second encoder can have the same or different architecture as that of the first encoder. Thus, each of the first encoder and the second encoder can be trained to generate a feature vector in their respective feature space, and the first encoder and the second encoder may not share any parameters. One or more parameters of the second encoder can be learned based on another loss determined between two training feature vectors of the second set of training feature vectors in the second feature space, where a training feature vector of the second set of training feature vectors can represent training context data that is the same as or similar to that of another training feature vector of the second set. Thus, training the second encoder can facilitate identifying features of the context data based on a loss between the second feature vector and each of the first set of training feature vectors. The second encoder can include a second contrastive loss function that can be used to determine a further loss between two training feature vectors of the second set of training feature vectors, where the further loss can then be used to tune one or more parameters of the second encoder.

[0024] However, using a separate feature space for each feature vector can cause various problems. For example, some feature vectors may be considered "similar" in their respective feature spaces because they share loosely related characteristics (e.g., similar purchase stores, similar dates and times) rather than because they correspond to similar events. A shared feature space can be implemented to ensure that the first and second feature vectors represent the same specific event in their respective feature spaces. Training of the first and second encoders can further be performed based on a loss determined in the shared feature space between two training feature vectors that identify the same event. Contrastive learning of the first and second encoders in the shared feature space can reduce overfitting of feature vectors that rely on loosely related characteristics. In addition, contrastive learning in the shared feature space can facilitate prediction of specific data items (e.g., unstructured data files, contextual data) that indicate anomalous events.

[0025] In some embodiments, one or more parameters of the first encoder and one or more parameters of the second encoder are further trained to generate a vector in the shared feature space based on the first training transformed feature vector and the second training transformed feature vector. The vector can be generated by combining information from the first training transformed feature vector and the second training transformed feature vector, resulting in a vector with improved projected predictability than either the first training feature vector or the second training feature vector alone. The first training transformed feature vector can be generated by applying a first projection function to a first training feature vector representing a training unstructured data file identifying a training event. Similarly, the second training transformed feature vector can be generated by applying a second projection function to a second training feature vector representing training context data identifying the same training event. In some cases, the first contrast loss function and the second contrast loss function are combined and weighted by one or more weighting factors such that a loss can be determined using the combined loss function. The determined loss can then be used to adjust the parameters of each of the first and second encoders. The weighting factor can be a hyperparameter that can be tuned during training of the first and second encoders. Thus, the contrastive learning of the first and second encoders can ensure that the feature vectors associated with the unstructured data file and the contextual data correspond to the same particular event based on the losses determined in the shared feature space.

[0026] The abnormal event prediction system can generate a classification result by processing the event data input elements using a machine learning model. The classification result includes a prediction of whether a particular event corresponds to an anomalous event. In some cases, the machine learning model is a neural network or a tree-based classifier model. The classification result can also include a severity score of the anomalous event with a confidence interval. The severity score can predict whether a particular event corresponds to a particular type of anomalous event that requires a subsequent action (e.g., audit). The severity score can then be used to classify or cluster the predicted anomalous events. For example, the anomalous events can be clustered to rank the anomalous events based on the predicted severity score. Downstream pipeline tasks can use this information for subsequent actions. This allows the abnormal event prediction system to predict various types of anomalous events even when the encoder and machine learning model were trained without labeled training data. In some cases, the abnormal event prediction system further processes the feedback data to improve the accuracy of the machine learning model that predicts the classification result. In some cases, the feedback data is used to adjust the values ​​of the first feature vector and / or the second feature vector. The anomalous event prediction system may output the classification results, which may be used by another data processing system to perform subsequent actions to initiate an audit process for specific events identified in the unstructured data file. In some cases, the other data processing system may use the output classification results to reject or otherwise abort further processing of the unstructured data file.

[0027] II. A Computing Environment for Unusual Event Prediction Using Contrastive Learning 1 illustrates an example of a computing environment for anomalous event prediction using contrastive learning, according to some embodiments. The computing environment may include an anomalous event prediction system 100 that performs one or more operations to predict whether a particular event identified in an unstructured data file corresponds to an anomalous event. The anomalous event prediction system 100 may be a computer server that communicates with other systems and / or client devices to access the unstructured data file.

[0028] As an illustrative example, the abnormal event prediction system 100 may interact with or otherwise communicate with an enterprise resource planning (ERP) expense audit system. The ERP system may access data associated with the purchase of a flash memory device from a variety of data sources. An example data source may be an image repository that stores multiple receipt images. Another example data source may be a document repository that stores multiple scanned purchase orders. Thus, the ERP system may process the accessed data to determine whether to approve, deny, or further process the purchase of the flash memory device.

[0029] The abnormal event prediction system 100 can access the unstructured data file 102. The unstructured data file 102 can include unstructured data. Unstructured data can include information that does not have a predefined data model or is not organized in a predefined manner. The unstructured data file 102 can correspond to a particular file format, including email file formats (e.g., MSG), image file formats (e.g., JPG, JPEG, PNG, BMP), web page formats (e.g., HTML), document file formats (e.g., DOC, PDF, XPS, EPUB), audio file formats (e.g., MP3, M4A), video file formats (e.g., MPEG, MOV), and other types of file formats that may be contemplated by one of ordinary skill in the art. Continuing with the example, the unstructured data file 102 can be a receipt image file identifying a purchase of a flash memory device by an entity. The abnormal event detection system can access this receipt image from other receipt images stored in the image repository 104.

[0030] The anomalous event prediction system 100 can parse or otherwise analyze content from the unstructured data file to identify the occurrence of a particular event. Continuing with the example above, the anomalous event prediction system 100 can extract textual data by processing the unstructured data file 102 using optical character recognition. The textual data can identify the occurrence of a purchase, including the location of the purchase, the date and time of the purchase, and payment information used to purchase the flash memory device.

[0031] A first encoder 106 of the abnormal event prediction system 100 can generate a first feature vector 108 that represents the unstructured data file 102 in a first feature space. The first encoder 106 can include a first encoder that processes the unstructured data file 102 to generate the first feature vector 108. The first encoder 106 can be trained to generate the feature vector 108 for the unstructured data file 102, where a loss is defined to penalize instances where feature vectors of similar training elements (e.g., training unstructured data files) are located far apart in the first feature space and / or instances where feature vectors of different training elements are located close to each other in the first feature space.

[0032] The first encoder 106 may be a convolutional neural network or a multi-layer perceptron neural network. The first feature vector 108 may be an n-dimensional vector including a set of values ​​representing the unstructured data file 102, with each value of the set identifying a corresponding location of the first feature vector 108 in a dimension of the first feature space. The first encoder may be trained to facilitate identification of features of the unstructured data file 102 based on a loss between the first feature vector 108 and each of a first set of training feature vectors in the first feature space. Continuing with the above example, the first encoder 106 may be a convolutional neural network that generates the first feature vector 108 by processing text data extracted from the unstructured data file 102.

[0033] The anomalous event prediction system 100 may also have access to context data 110 associated with the unstructured data file 102. The context data 110 may include any information that describes the environment in which a particular event occurred (e.g., where a particular event occurred, other preceding or subsequent events that are predicted to be related to a particular event). The context data 110 may provide additional data points that may be relevant to processing the unstructured data file 102 to predict anomalous events.

[0034] Continuing with the above example, the context data 110 may include one or more data records accessed from a user profile data store 112, where the one or more data records identify an entity that approved the purchase of the flash memory device. The context data 110 may also include one or more data records accessed from an expense report data store 114, where the one or more data records include an expense report submitted on behalf of the entity that approved the purchase of the flash memory device. In some embodiments, the data records accessed from the user profile data store 112 include information (e.g., an entity identifier) ​​that may also be identified in the data records accessed from the expense report data store 114.

[0035] In some cases, the context data 110 includes structured data formatted according to a corresponding database schema or document object model. For example, the context data 110 can be formatted according to an SQL database schema of the user profile data store 112, where the schema defines one or more data fields such as "user_id", "timestamp", "job_id", "location_id", "role_id", "duty_id", "privilege_id", and "assignment_id". In another example, the context data 110 can be formatted according to an XML document object model of the expense report data store 114, where the document object model defines one or more data fields such as "user_id", "expense_id", and "description", "justification", "expense_type", and "expense_category".

[0036] In some cases, the context data 110 is further processed by a pre-processing module 116 of the abnormal event prediction system 100. The pre-processing module 116 can apply one or more data operations (e.g., normalization, filtering) to the context data 110 to improve the performance of an encoder that processes the context data 110. For example, the pre-processing module 116 can include a flattening operation that processes the context data 110 by merging data records accessed from one or more data stores (e.g., the user profile data store 112, the expense report data store 114) into a single or reduced number of tables and removing any redundant data. Continuing with the above example, the pre-processed context data 110 can include information that merges data records from the user profile data store 112 and the expense report data store 114. The information from the merged data records may be defined by different database schemas including one or more data fields such as "user_id", "timestamp", "job_id", "location_id", "role_id", "duty_id", "privilege_id", "assignment_id", "expense_id", and "description", "justification", "expense_type", "expense_category", etc.

[0037] The second encoder 118 of the abnormal event prediction system 100 can process the context data 110 to generate a second feature vector 120 representing the context data 110 in a second feature space. The second encoder 118 can be trained to generate the feature vector 120 for the context data 110, where a separate loss is defined to penalize instances where the feature vectors of similar training elements (e.g., training context data) are far apart in the second feature space and / or instances where the feature vectors of different training elements are close to each other in the second feature space. Thus, training the second encoder 118 can facilitate identifying features of the context data 110 based on the loss between the second feature vector 120 and each of the first set of training feature vectors.

[0038] The second encoder 118 may be a convolutional neural network or a multi-layer perceptron neural network. The second encoder 118 may have the same or different architecture as that of the first encoder 106. Thus, each of the first encoder 106 and the second encoder 118 may be trained to generate feature vectors 108 and 120 in their respective feature spaces, where the first encoder 106 and the second encoder 118 may not share any parameters.

[0039] The second feature vector 120 may be an n-dimensional vector including a set of values ​​representing the context data 110, where each value in the set identifies a corresponding location of the second feature vector 120 in a dimension of the second feature space. The second encoder 118 may be trained to facilitate identifying characteristics of the context data 110 based on the loss between the second feature vector 120 and each of the first set of training feature vectors in the second feature space. Continuing with the above example, the second encoder 118 may be a multi-layer perceptron neural network that generates the second feature vector 120 by processing the pre-processed context data 110.

[0040] The first encoder 106 and the second encoder 118 may be further trained such that the first feature vector 108 and the second feature vector 120 represent the same particular event in their respective feature spaces. For example, the first encoder 106 and the second encoder 118 may be further trained by generating their respective vectors in a shared feature space. The training of the first encoder 106 and the second encoder 118 may be further performed based on a loss between two training feature vectors that identify the same event in the shared feature space. In some cases, the training includes generating vectors in the shared feature space based on (i) a first training transformed feature vector generated by applying a first projection function to the first feature vector 108 and (ii) a second training transformed feature vector generated by applying a second projection function to the second feature vector 110. A vector can be generated by combining information from the first training transformed feature vector and the second training transformed feature vector, resulting in a projected vector with improved predictive power than either the first training feature vector or the second training feature vector alone. Contrastive training of the first and second encoders in a shared feature space can reduce overfitting of feature vectors that rely on loosely related characteristics. Thus, contrastive training of the first encoder 106 and the second encoder 118 can ensure that feature vectors associated with the unstructured data file 102 and the contextual data 110 correspond to the same event (e.g., the purchase of a flash memory device).

[0041] The abnormal event prediction system 100 can generate an event data input element 122 of the unstructured data file 102 based on the first feature vector 108 and the second feature vector 120. The event data input element 122 of the unstructured data file 102 can be a data structure (e.g., a tuple) including at least the first feature vector 108 and the second feature vector 120 that can be processed by a machine learning model (e.g., a classifier model) to predict whether a particular event identified in the unstructured data file 102 corresponds to an anomalous event. Continuing with the example, the event data input element 122 can be identified by a tuple defined by "event(u,v)," where (1) the variable name "event" identifies that the event data input element corresponds to the unstructured data file 102, (2) "u" represents the first feature vector 108, and (3) "v" represents the second feature vector 120. Thus, the first feature vector 108 and the second feature vector 120 of the event data input element 122 may represent one or more characteristics associated with a particular event (e.g., the purchase of a flash memory device) associated with the unstructured data file 102.

[0042] The classification engine 124 can be configured to process the event data input element 122 using another machine learning model to generate a classification result. The classification result can include a prediction of whether a particular event identified in the unstructured data file 102 corresponds to an anomalous event. The classification result can also include a severity score of the anomalous event with a confidence interval. The severity score can then be used to classify or cluster the predicted anomalous events. For example, the anomalous events can be clustered to rank the anomalous events based on the predicted severity score. Downstream pipeline tasks can use this information for subsequent actions. In some cases, the machine learning model is a neural network or a tree-based classifier model.

[0043] In some cases, the machine learning model of the classification engine 124 further processes the feedback data 126 to improve the accuracy of the machine learning model of the classification engine 124 predicting the classification result. In some cases, the feedback data 126 includes data manually entered by another user in response to the abnormal event prediction system 100 predicting that one of the first feature vector 108 and the second feature vector 120 deviates from an expected vector value. For example, the first deviation of the first feature vector from a first expected vector value can be predicted based on (1) generating a distribution of first training feature vectors in a first feature space, (2) determining that the first feature vector corresponds to an outlier in the generated distribution, and (3) determining that the first feature vector deviates from the expected vector value.

[0044] The classification engine 124 may output the classification results. The output classification results may be used by another data processing system to perform subsequent actions to initiate an audit process for a particular event identified in the unstructured data file 102. For example, an audit system may perform a review of a purchase of a flash memory device to determine whether such purchase was an approved transaction. In some cases, the other data processing system may use the output classification results to reject or otherwise abort further processing of the unstructured data file 102.

[0045] III. Training Techniques for Predicting Abnormal Events Training a machine learning model to predict anomalous events can include two processes: (1) training one or more encoders to generate event data input elements that represent a given unstructured data file; and (2) training another machine learning model to predict whether a particular event identified in the unstructured data file corresponds to an anomalous event. With respect to the first stage, one or more encoders can be trained to generate respective feature vectors that encode one or more characteristics associated with a particular event identified in the unstructured data file (e.g., image receipt, video file). Each of the encoders can be trained using unsupervised learning, where the training data is not labeled or annotated. Each of the encoders can be trained using training data from a corresponding data source (e.g., image repository, user profile data store). The feature vectors can be used to generate the event data input elements.

[0046] With respect to the second stage, a machine learning model can be trained to process the event data input elements to generate a classification result. The classification result includes a prediction as to whether a particular event corresponds to an anomalous event. In some cases, training the machine learning model includes appending feedback data to the event data input elements to improve the predictive accuracy of other machine learning models.

[0047] The encoder and the machine learning model can be trained using different types of training data to predict anomalous events in various domains. For example, the encoder and the machine learning model can be trained to predict anomalous events in an expense auditing system using receipt images and expense reports. In another example, the encoder and the machine learning model can be trained to predict anomalous events in a video surveillance system using sensor data (e.g., text, voice, images). Other examples include (1) training the encoder and the machine learning model to predict anomalous events in a call center system using voice recordings, and (2) training the encoder and the machine learning model to predict anomalous events in a customer support system using email files.

[0048] A. First Encoder for Processing Unstructured Data Files The first encoder can be trained to process a particular unstructured data file using unlabeled training data and generate a feature vector. The feature vector can represent the unstructured data file in a first feature space. For example, the first feature vector can be an n-dimensional vector that includes a set of values ​​representing the particular unstructured data file, where each value in the set identifies a corresponding location of the first feature vector in a dimension of the first feature space. The first feature vector generated by the trained first encoder can encode or otherwise represent one or more characteristics associated with a particular event identified in the unstructured data file.

[0049] 1. Training Data In some embodiments, the training data of the first encoder includes a first training set of unstructured data files. Each unstructured data file of the first training set can include unstructured data that includes information that does not have a predefined data model or is not organized in a predefined manner. In some cases, each unstructured data file of the first training set does not include any training labels or annotations. Thus, the training process of the first encoder includes training the first encoder using unlabeled training data.

[0050] The unstructured data files of the first training set may correspond to a particular file format, including email file formats (e.g., MSG), image file formats (e.g., JPG, JPEG, PNG, BMP), web page formats (e.g., HTML), document file formats (e.g., DOC, PDF, XPS, EPUB), audio file formats (e.g., MP3, M4A), video file formats (e.g., MPEG, MOV), and other types of file formats that may be contemplated by one of ordinary skill in the art. Based on the file format, one or more data preprocessing processes may be performed on each unstructured data file of the first training set. For example, if the unstructured data files of the first training set correspond to a voice recording file format, a speech-to-text conversion algorithm may be applied to each unstructured data file of the first training set to convert the audio data into text data. In another example, if the unstructured data files of the first training set correspond to a video file format, a video frame extraction algorithm may be applied to each unstructured data file of the first training set to generate image data from the video data.

[0051] Each unstructured data file in the first training set may identify the occurrence of a corresponding event in a particular domain. For example, an unstructured data file in the first training set for an expense report writing domain may identify an entity's subscription to a network monitoring service. In another example, an unstructured data file in the first training set for a video surveillance domain may identify the occurrence of one or more objects from a video file.

[0052] 2. Choosing a Machine Learning Model Then, one or more machine learning models of the first encoder can be selected for training. The machine learning model of the first encoder can be a convolutional neural network, an inception neural network, a residual neural network, a recurrent neural network, a long short-term memory model, a gated recurrent unit model, or other variations of a deep neural network. The machine learning model can also be any other suitable model that can be trained to generate feature vectors from unstructured data files, such as a naive Bayes classifier, a linear classifier, a support vector machine, a bagging model such as a random forest model, a boosting model, a shallow neural network, or a combination of one or more of such techniques, for example, a multi-scale convolutional neural network. In some cases, the first encoder has a Siamese network architecture, where the machine learning model is trained twice in each iteration to penalize instances where the locations of similar training feature vectors are far apart in the first feature space and instances where the locations of different training feature vectors are close to each other in the first feature space.

[0053] The first encoder may include a convolutional neural network. Figure 2 shows an example schematic 200 for using a convolutional neural network to generate feature vectors for an unstructured file, according to some embodiments. For illustrative purposes, the process implemented in the schematic 200 is described with reference to the components shown in Figure 1, although other implementations are possible. For example, program code for the first encoder 106 of Figure 1 stored on a non-transitory computer-readable medium may be executed by one or more processing devices to cause the devices to perform the operations described herein.

[0054] An unstructured data file 205 can be provided to a first encoder configured to apply one or more layers of a deep convolutional neural network model. The unstructured data file 205 can be an image file of a receipt that can be represented by a set of pixels, where each pixel includes a set of color values ​​(e.g., RGB values). In some cases, the color value corresponding to a given pixel is associated with (for example) a general luminance value and / or luminance values ​​associated with each of one or more colors.

[0055] The first encoder may perform a series of operations on pixel values ​​corresponding to the unstructured data file 205, which may include several types of convolutional neural network architectures, namely: (1) convolution, (2) nonlinear transformation (e.g., ReLU), (3) pooling or subsampling, and (4) forming a single convolutional layer versus a fully connected layer. In some cases, the convolutional operations of the first encoder preserve spatial relationships between pixels by learning image features using small squares of input data. For example, the unstructured data file 205 may be considered as a matrix of pixel values, where each pixel region of the matrix may be assigned a value. In addition, the unstructured data file 205 may be a black and white image with pixel values ​​ranging from 0 to 1. The unstructured data file 205 may alternatively or additionally include a color image with three assigned RGB values, each ranging from 0 to 255.

[0056] After the unstructured data file 205 is accessed, the first encoder can generate the feature map 210 based on the unstructured data file 205. In some embodiments, the feature extractor includes one or more kernels or filters that include a matrix of values ​​that can "slide over" a matrix corresponding to the unstructured data file 205 to generate the feature map 210. For example, the kernels are configured to detect edges, sharpen images, or identify sets of pixels that represent objects to preprocess the data and provide details relevant to the image analysis of the classifier. In some cases, a set of hyperparameters corresponding to the feature extraction is predefined (e.g., based on manual input). The feature extraction hyperparameters can specify (for example) the stride (e.g., 1-step, 2-step), padding size, kernel size, and / or kernel shape of each filter.

[0057] 2, the first encoder may perform a nonlinear (e.g., ReLU) transformation that replaces all negative pixel values ​​in the feature map 210 with zero. The ReLU operation of the first encoder may introduce nonlinearity into the convolutional neural network model because the convolution operation produces a linear function output from the matrix values ​​representing the unstructured data file 205. The nonlinear transformation may additionally or alternatively include using a sigmoid function and / or a tanh function.

[0058] After the ReLU operation, the first encoder may perform a pooling operation on the feature maps 210 to reduce the spatial size of the feature maps 210 and subsequently generate the pooled feature maps 215. In some embodiments, the pooling reduces the dimensionality of each feature map generated by the kernel of the feature extractor, but preserves the image-defining features (e.g., image edges) captured in the unstructured data file 205. In some cases, the first encoder performs a max pooling operation that accesses a region in the feature map (e.g., a 5×5 matrix in the feature map) and selects the element associated with the highest value. This operation may be repeated to traverse the entirety of the feature map 210, upon which the max pooling operation completes the generation of the pooled feature map 215. The first encoder may alternatively or additionally perform an average pooling operation instead of a max pooling operation that selects the sum or average value of the elements captured in the region in the feature map 210. By performing a pooling operation, the first encoder can achieve several technical advantages, including scaling of an immutable representation of the unstructured data file 205, along with the ability to generate an input representation of the unstructured data file 205 that allows for a reduction in the number of parameters and calculations in the convolutional neural network model.

[0059] Continuing with the example of Figure 2, the first encoder can continue to apply one or more additional convolutional layers to the unstructured data file 205, where convolution, ReLU, and pooling operations can be performed on the pooled feature map 215. In some cases, a second convolutional layer produces feature map 220, pooled feature map 225, etc. These operations are repeated until the extracted features are equivariant to the scale and translation of the fully connected layer.

[0060] After applying several convolutional layers, the first encoder may apply a fully connected layer 230, which may be a multi-layer perceptron network incorporating a softmax activation function or other types of linear or non-linear functions, at an output layer 235. In some embodiments, the first encoder uses a fully connected layer that accesses the extracted features and generates a first feature vector representing the unstructured data file 205. In some cases, the first feature vector encodes one or more characteristics (e.g., time, location, price) associated with a particular event identified from the unstructured data file 205. The first feature vector may be used to generate an event data input element that is subsequently processed by another machine learning model that predicts whether a particular event identified in the unstructured data file 205 corresponds to an anomalous event.

[0061] In some cases, the first feature vector includes graph coordinates for identifying a location (e.g., location coordinates) of the unstructured data file in the first feature space. In some cases, an embedding layer is applied to the first feature vector to reduce its dimensionality. For example, the first feature vector may be associated with values ​​having 20 dimensions, where the embedding layer may reduce the dimensionality of the values ​​to 10.

[0062] While FIG. 2 illustrates the use of two convolutional layers to process the unstructured data file 205, it will be understood that a different number of convolutional layers may be used (e.g., this may have an iterative effect, where the first encoder may repeat these operations one or more times). For example, the output is determined by applying 10 or more convolutional layers to extract features from the unstructured data file 205. In some embodiments, the pooling operation is omitted for one or more convolutional layers applied by the classifier. In some embodiments, the classifier uses different versions of convolutional neural network model architectures, including, but not limited to, AlexNet, ZFNet, GoogLeNet, VGGNet, ResNets, DenseNet, etc.

[0063] 3. Training the Machine Learning Model After the machine learning model is selected, a first encoder can be trained using the training data. The first encoder can be trained using contrastive learning to generate a first feature vector representing the unstructured data file. Thus, the contrastive learning allows the first encoder to be trained using training data that is not labeled or annotated.

[0064] 3 shows a schematic diagram 300 for training a first encoder using contrastive learning according to some embodiments. As shown in FIG. 3, training the first encoder includes at least the following steps: (1) augmenting a training unstructured data file to generate a first training augmented unstructured data file and a second training augmented unstructured data file, (2) generating a first training feature vector for the first training augmented unstructured data file in a first feature space, (3) generating a second training feature vector for the second training augmented unstructured data file in the first feature space, (4) determining a loss between the first training feature vector and the second training feature vector, and (5) adjusting one or more parameters of the first encoder based on the determined loss.

[0065] Training of the first encoder can begin by applying data augmentation 302 to a training unstructured data file 304 of the training data to generate a first augmented training unstructured data file 306 and a second augmented training unstructured data file 308. Data augmentation 302 can include transforming the training unstructured data file 304 to generate two or more modified versions of the training unstructured data file. Data augmentation ensures that the two or more modified versions are "similar" to the training unstructured data file 304.

[0066] The modified version can be used to perform contrastive learning of the first encoder 310. For example, data augmentation of a training image (e.g., a receipt image) can include geometric transformation, inversion, color modification, cropping, rotation, noise injection, and random erasure. In another example, data augmentation of a training audio file (e.g., a voice recording of a customer representative) can include noise injection, time shifting, pitch modification, and playback speed modification. In yet another example, data augmentation of a training video file can include piecewise affine transformation, superpixel processing, Gaussian blur, color inversion, random rotation, random resizing, translation, frame addition, frame shifting, inversion, downsampling, and upsampling. In FIG. 3, the first augmented training unstructured data file 306 shows a rotated version of the training unstructured data file 304, and the second augmented training unstructured data file 308 shows a color-inverted version of the training unstructured data file 304.

[0067] The first encoder 310 may process the first augmented training unstructured data file 306 into a first training feature vector 312 in a first feature space 316. The first training feature vector 312 may be an n-dimensional vector of values ​​that collectively represent the first augmented training unstructured data file 306. The first feature space 316 may be an n-dimensional space in which the first training feature vector 312 may be identified by its corresponding location. In some cases, a first encoder convolutional neural network is applied to the first augmented training unstructured data file 306 to generate the first training feature vector 312.

[0068] The first encoder 310 may also process the second augmented training unstructured data 308 file into a second training feature vector 314 in a first feature space 316. Similar to the first training feature vector 312, the second training feature vector 314 may be an n-dimensional vector of values ​​that collectively represent the second augmented training unstructured data file 308. In some cases, the convolutional neural network of the first encoder 310 is also applied to the second augmented training unstructured data file 308 to generate a second training feature vector. Training of the first encoder may be performed such that the first training feature vector 312 and the second training feature vector together may encode one or more characteristics of the training unstructured data file.

[0069] A loss 318 may be determined between the first training feature vector 312 and the second training feature vector 314. The determined loss 318 may identify a performance level of the first encoder 310 during the training phase. For example, if the first encoder predicts that the first training feature vector 312 and the second training feature vector 314 are similar to each other, the determined loss 318 may be decreased. Conversely, if the first encoder predicts that the first training feature vector 312 and the second training feature vector 314 are different from each other, the determined loss 318 may be increased. The loss may be determined by (1) determining a loss (e.g., cosine similarity, distance) between the first training feature vector and the second training feature vector, and (2) applying a first contrastive loss function to the determined loss. In some cases, the first contrast loss function is a cross-entropy loss function defined to penalize instances where the first training feature vector 312 and the second training feature vector 314 are far apart in the first feature space 316.

[0070] The first encoder may adjust one or more of its parameters 320 based on the determined loss 318. Adjustment of the parameters of the first encoder may be performed to minimize the loss between the first and second training feature vectors in the first feature space 316. By identifying "similar" unlabeled and unannotated unstructured data files, training the first encoder may facilitate identifying characteristics of a particular unstructured data file.

[0071] B. A second encoder that processes the context data Similar to the first encoder, the second encoder can be trained to process the context data using unlabeled training data and generate another feature vector. The other feature vector can represent the context data in a second feature space. For example, the second feature vector can be an n-dimensional vector that includes a set of values ​​representing the context data, where each value of the set identifies a corresponding location of the second feature vector in a dimension of the second feature space. Thus, the second feature vector generated by the trained second encoder can encode or otherwise represent one or more features associated with the same events identified in the corresponding unstructured data file.

[0072] 1. Training Data In some embodiments, the training data for the second encoder includes a second training set of context data objects. The context data includes any information describing an environment associated with a particular event identified by a corresponding unstructured data file of the first training set. The training context data objects can include unstructured data including unstructured text. In some cases, the context data objects of the second training set include structured data formatted according to a corresponding database schema or document object model. The context data objects of the second training set provide additional data points that can be used in place of training labels or annotations. The context data objects of the second training set can be used to train the second encoder to generate feature vectors in a second feature space. The anomalous event detection system can use the feature vectors in the second feature space to predict anomalous events without the need to generate target labels for the training data.

[0073] The second training set of contextual data objects may be obtained from one or more data stores (e.g., a user profile data store). The second training set of contextual data objects may include, but are not limited to, the following information to which the anomalous event detection system has access: (i) the location where the particular event occurred, (ii) the entities involved in the particular event, (iii) other preceding or subsequent events predicted to be related to the particular event, and / or (iv) the type or category associated with the transaction associated with the particular event.

[0074] 2. Choosing a Machine Learning Model One or more machine learning models of the second encoder can then be selected for training. As with the first encoder, the machine learning model of the second encoder can be a convolutional neural network, an inception neural network, a residual neural network, a recurrent neural network, a long short-term memory model, a gated recurrent unit model, or other variations of a deep neural network. The machine learning model can also be any other suitable model that can be trained to generate feature vectors from unstructured data files, such as a naive Bayes classifier, a linear classifier, a support vector machine, a bagging model such as a random forest model, a boosting model, a shallow neural network, or a combination of one or more of such techniques, e.g., a multi-scale convolutional neural network. In some cases, the second encoder has a Siamese network architecture, where the machine learning model is trained twice in each iteration to penalize instances where the locations of similar training feature vectors are far apart in the second feature space and instances where the locations of different training feature vectors are close to each other in the second feature space.

[0075] In some cases, the second encoder has an architecture that is the same as or different from that of the first encoder. Thus, the first encoder and the second encoder can each be trained to generate feature vectors in their respective feature spaces, where the first encoder and the second encoder may not share parameters.

[0076] The second encoder can be a convolutional neural network or a multi-layer perceptron neural network. In some cases, the second encoder is a recurrent neural network. FIG. 4 illustrates an example schematic 400 of a recurrent neural network, according to some embodiments. A recurrent neural network includes a chain of repeating modules ("cells") of a neural network. Specifically, the operation of a recurrent neural network includes repeating a single cell indexed by the position of a text section (t) within a text section of a contextual data object. To provide its recurrent behavior, a recurrent neural network stores a hidden state s t , which is provided as input to the next iteration of the network. As shown in the left part of Figure 4, the recurrent neural network calculates the number of text sections x t The hidden state value s determined using the feature representation of t-1 The following formula is the hidden state s t is determined,

[0077]

number

[0078] In the formula, U and W are x t and s t-1 is the weighting value applied to

[0079]

number

[0080] is a nonlinear function such as tanh or ReLU. The output of the recurrent neural network is o t = softmax(Vs t ) where V is the hidden state value s tis the weighting value applied to

[0081] Therefore, the hidden state s t can be called the memory of the network. t may depend on information associated with the input and output that has been used or that has been derived from one or more preceding text sections. t The output at is a set of values ​​used to identify the section identifier of the text section, which is calculated at least in part based on the memory at the text section position t.

[0082] 3. Training the Machine Learning Model After selecting a machine learning model (e.g., convolutional neural network, recurrent neural network), a second encoder can be trained using the training data. Similar to the first encoder, the second encoder can be trained using contrastive learning to generate a second feature vector representing the context data. With contrastive learning, the second encoder can be trained using a second training set that is neither labeled nor annotated.

[0083] 5 shows a schematic diagram 500 for training a second encoder using contrastive learning according to some embodiments. As shown in FIG. 5, training the second encoder includes at least the following steps: (1) augmenting a training context data object, (2) generating a first training feature vector in a second feature space, (3) generating a second training feature vector in the second feature space, (4) determining a loss between the first training feature vector and the second training feature vector, and (5) adjusting one or more parameters of the second encoder based on the determined loss.

[0084] Training of the second encoder can begin by applying data augmentation 502 to the training context data object 504 of the training dataset to generate a first augmented training context data object 506 and a second augmented training unstructured context data object 508. Data augmentation 502 can include transforming the training context data object 504 to generate two or more modified versions of the training context data object. Data augmentation ensures that the two or more modified versions are "similar" to the training context data object 504. The modified versions can be used to perform contrastive learning of the second encoder 510. For example, data augmentation of the context data object can include back-translation of text data, where the context data object can be translated from an original source language (e.g., English) to a target language (e.g., German) and translated back to the original source language. Other examples of text augmentation of the context data object can include random replacement of one or more words in the training context data object 504 and random synonym replacement of one or more words in the context data object 504.

[0085] The second encoder 510 may process the first extended training context data object 506 into a first training feature vector 512 in a second feature space 516. The first training feature vector 512 may be an n-dimensional vector of values ​​that collectively represent the first extended training context data object 506. The second feature space 516 may be an n-dimensional space in which the first training feature vector 512 of the training context data object may be identified by its corresponding position. In some cases, a residual neural network of the second encoder is applied to the first extended training context data object 506 to generate the first training feature vector 512.

[0086] The second encoder 510 may also process the second extended training context data object 508 into a second training feature vector 514 in a second feature space 516. Similar to the first training feature vector 512, the second training feature vector 514 may be an n-dimensional vector of values ​​that collectively represent the second extended training context data object 508. In some cases, the second encoder 510's residual neural network is also applied to the second extended training context data object 508 to generate the second training feature vector 514. Training of the second encoder 510 may be performed such that the first training feature vector 512 and the second training feature vector 514 together may encode one or more characteristics of the training context data object 504.

[0087] A loss 518 may be determined between the first training feature vector 512 and the second training feature vector 514. The determined loss 518 may identify a performance level of the second encoder 510 during the training phase. For example, if the second encoder 510 predicts that the first training feature vector 512 and the second training feature vector 514 are similar to each other, the determined loss 518 may be decreased. Conversely, if the second encoder 510 predicts that the first training feature vector 512 and the second training feature vector 514 are different from each other, the determined loss 518 may be increased. The loss 518 may be determined by (1) determining a loss (e.g., cosine similarity, distance) between the first training feature vector 512 and the second training feature vector 514 and (2) applying a second contrastive loss function to the determined loss. In some cases, the second contrast loss function is a cross-entropy loss function defined to penalize instances where the first training feature vector 512 and the second training feature vector 514 are far apart in location in the second feature space.

[0088] The second encoder may adjust one or more of its parameters 520 based on the determined loss. Adjustment of the parameters 520 of the second encoder 510 may be performed to minimize the determined loss between the first training feature vector 512 and the second training feature vector 514 in the second feature space 516. By identifying "similar" contextual data objects that have no labels or annotations, training of the second encoder 510 may facilitate identifying characteristics of the contextual data.

[0089] C. Additional training of the first and second encoders In addition to training the first and second encoders separately, the training phase may further include training the first and second encoders together in a shared feature space. The additional training may ensure that the first and second feature vectors represent the same specific event in their respective feature spaces. Thus, the training of the first and second encoders may be performed based on a loss determined between a first training feature vector generated by the first encoder and a second training feature vector generated by the second encoder in the shared feature space. In some cases, the training includes generating vectors in the shared feature space based on (i) a first training transformed feature vector generated by applying a first projection function to the first feature vector 108 and (ii) a second training transformed feature vector generated by applying a second projection function to the second feature vector 110. The vector can be generated by combining information from the first training transformed feature vector and the second training transformed feature vector, resulting in a vector with improved projected predictability than either the first training feature vector or the second training feature vector alone.

[0090] 6 shows a schematic diagram 600 for further training the first encoder and the second encoder using contrastive learning according to some embodiments. As shown in FIG. 6, training the first encoder and the second encoder can include at least the following steps: (1) selecting a matching training unstructured data file and a training context data object, (2) generating a first transformed training feature vector of the training unstructured data file in a shared feature space, (3) generating a second transformed training feature vector of the training context data object in the shared feature space, (4) determining a loss between the first transformed training feature vector and the second transformed training feature vector, and (5) adjusting one or more parameters of the first encoder and one or more parameters of the second encoder based on the determined loss.

[0091] The additional training can begin by selecting matching training unstructured data files 602 and training context data objects 604. The selection can include determining that there is overlapping data between the matching training unstructured data files 602 and the training context data objects 604. For example, expense report data identified in the training context data objects 604 can include purchase descriptions, entity information, dates, and purchase times, much of which matches corresponding information identified in the training unstructured data files 602. In some cases, the matching information can be identified by extracting text data from the training unstructured data files 602 using optical character recognition.

[0092] The first encoder 606 can process the training unstructured data file 602 into a first training feature vector 610 in a first feature space. The second encoder 608 can process the training context data object 604 into a second training feature vector 612 in a second feature space. To train the first encoder 606 to recognize that the training unstructured data file 602 and the training context data object 604 correspond to the same particular event, a first projection function 614 can be applied to transform the first feature vector 610 into a first transformed training feature vector 618 in a shared feature space 622. Similarly, to train the second encoder 608 to recognize that the training unstructured data file 602 and the training context data object 604 correspond to the same particular event, a second projection function 616 can be applied to transform the second feature vector 612 into a second transformed training feature vector 620 in the shared feature space 622. The shared feature space 622 can be an n-dimensional space in which both the first transformed training feature vector 618 and the second transformed training feature vector 620 can be identified by their respective positions. The first projection function 614 and the second projection 616 can transform the training feature vectors such that the transformed feature vectors can be directly compared within the same shared feature space 622 during control learning.

[0093] Loss 624 between the first transform training feature vector 618 and the second transform training feature vector 620. The determined loss 624 can identify the performance level of both the first encoder 606 and the second encoder 608 in predicting whether the training unstructured data file and the training context data object identify the same particular event. For example, if the first transform training feature vector 618 and the second transform training feature vector 620 are predicted to be generated similar to each other, the determined loss 624 can be decreased. Conversely, if the first transform training feature vector 618 and the second transform training feature vector 620 are predicted to be different from each other, the determined loss 618 can be increased. The loss 624 can be determined by (1) determining a loss (e.g., cosine similarity, distance) between the first transform training feature vector 618 and the second transform training feature vector 620 and (2) applying a contrastive loss function combined to the determined loss. In some cases, the combined contrast loss function is a cross-entropy loss function defined to penalize instances where the locations of the first transformed training feature vector 618 and the second transformed training feature vector 620 are far apart in the shared feature space 622.

[0094] In some cases, the first and second contrastive loss functions are combined and weighted by one or more weighting factors to enable the combined loss function to be used during additional training. The weighting factors may be hyperparameters that may be adjusted during additional training of the first and second encoders 606 and 608. Thus, the contrastive learning of the first and second encoders 606 and 608 may ensure that the unstructured data file and the corresponding contextual data identify the same specific events based on the losses determined in the shared feature space 622.

[0095] For example, a first weighting factor applied to the first transformation training feature vector 618 can be increased relative to a second weighting factor applied to the second transformation training feature vector 620. The increase in the first weighting factor can be performed in response to a determination that the unstructured data file is more predictive of an event. Conversely, the second weighting factor can be increased relative to the first weighting factor. The increase in the second weighting factor can be performed in response to another determination that the context data is more predictive of an event. The adjustment of the weighting factor can be performed before or during the training of the first encoder and the second encoder. As a result, the combined loss function can determine a weighted loss that can be used to adjust parameters of the first encoder and the second encoder such that the first encoder and the second encoder can improve their predictiveness of detecting anomalous events.

[0096] In another example, the first weighting factor and the second weighting factor can be configured to be the same value. The configuration of the first weighting factor and the second weighting factor can train the first encoder and the second encoder without supervision. In addition, the configuration can be performed until the predictability for detecting the abnormal event can reach the intended result (e.g., loss minimized to be below a predetermined threshold).

[0097] Additionally or alternatively, the one or more weighting coefficients are parameters that can be adjusted based on the loss determined by the combined loss function. In effect, the one or more weighting coefficients can be learned along with the parameters of the first and second encoders. The learning of the weighting coefficients during training can be unsupervised. Additionally, the learning of the weighting coefficients can facilitate improved prediction of anomalous events based on information that may have initially been deemed less relevant.

[0098] The first encoder 606 may then adjust one or more of its parameters 626 based on the determined loss 624, and the second encoder 608 may adjust one or more of its parameters 628 based on the determined loss 624. The adjustment of the parameters 626 of the first encoder 606 and the adjustment of the parameters 628 of the second encoder 608 may both be performed to minimize the determined loss between the first transform training feature vector 618 and the second transform training feature vector 620 in the shared feature space 622. By learning effectively "similar" events, additional training of the first encoder 606 and the second encoder 608 may facilitate characterization of unlabeled and unannotated events.

[0099] D. Machine learning technology for predicting abnormal events The first feature vector generated by the first encoder and the second feature vector generated by the second encoder can be used by another machine learning model to predict whether a particular event identified in the unstructured data file corresponds to an anomalous event. In some cases, a classification engine (e.g., classification engine 124 of FIG. 1) is trained to generate a classification result by (1) processing a training context data object and / or a training unstructured data file associated with a particular event to generate an intermediate output, (2) determining a loss between the intermediate output and an event data input element including the first training feature vector and the second training feature vector, and (3) adjusting one or more parameters of the machine learning model of the classification engine based on the determined loss. The event data input element can be configured as a target label of the context data object. In some cases, the parameters of the first encoder and the second encoder remain unchanged during the training of the classification engine. In some cases, the classification engine further processes feedback data to improve the accuracy of the machine learning model predicting the classification result. In some cases, the feedback data is used to adjust the values ​​of the first feature vector and / or the second feature vector of the event data input element.

[0100] 1. Training Data In some embodiments, the training data for the classification engine includes a third training set of labeled contextual data objects. The training contextual data objects include any information describing an environment associated with a particular event identified by a corresponding training unstructured data file of the first training set. The training contextual data objects may include unstructured data including unstructured text. In some cases, the training contextual data objects include structured data formatted according to a corresponding database schema or document object model. Additionally or alternatively, each labeled contextual data object may be associated with a corresponding training unstructured data file.

[0101] In some cases, each training context data object of the third training set is labeled with a corresponding event data input element. The event data input element can be a data structure (e.g., a tuple) that includes a collection of feature vectors that can be used to predict whether a particular event corresponds to an anomalous event. The collection of feature vectors can include a first feature vector generated by processing the training unstructured data file with a first encoder and a second feature vector generated by processing the training context data object with a second encoder. The event data input elements can be used as target labels for the context data objects, and the classification engine can be trained to predict anomalous events without manually labeling or annotating each training context data object.

[0102] Additionally or alternatively, each training context data object of the third training set can be associated with feedback data for the training context data object. The feedback data can include data manually entered by a user to adjust values ​​of the first and / or second feature vectors of the event data input element. The feedback data can be configured to enhance or update a training label of the corresponding training context data object. The training context data object can be associated with the feedback data in response to another prediction that one of the first and second training feature vectors of the event data input element deviates from an expected vector value.

[0103] 2. Choosing a Machine Learning Model One or more machine learning models of the classification engine can then be selected for training. The machine learning model of the first encoder can be an artificial neural network, a convolutional neural network, an inception neural network, a residual neural network, a recurrent neural network, a long short-term memory model, a gated recurrent unit model, or other variations of a deep neural network. The machine learning model can also be any other suitable model that can be trained to generate feature vectors from unstructured data files, such as a naive Bayes classifier, a linear classifier, a support vector machine, a bagging model such as a random forest model, a boosting model, a shallow neural network, or a combination of one or more of such techniques, e.g., a multi-scale convolutional neural network. In some cases, the classification engine has a multi-class classifier model, where the classification result corresponds to the class associated with the highest prediction score.

[0104] 3. Training the Machine Learning Model FIG. 7 illustrates a schematic diagram 700 for training a classification engine for predicting anomalous events, according to some embodiments. As illustrated in FIG. 7, training a machine learning model of the classification engine may include using the training context data objects and corresponding event data input elements of the third training set as inputs. An intermediate output may be generated from the machine learning model by processing the training context data objects and the corresponding event data input elements. The intermediate output may predict the probability that an event identified by the training context data object corresponds to a particular type of event (e.g., normal event, anomalous event). A loss may be determined by applying a loss function (e.g., cross-entropy loss function) to the intermediate output and the event data input element configured as a target label of the training context data object. The determined loss may be used to adjust parameters of the machine learning model of the classification engine, such that the loss may be minimized by using the training data.

[0105] Training of the classification engine can begin by accessing a training context data object 702 and a training event data input element 706. The training event data input element 706 includes a first training feature vector 708 and a second training feature vector 710. The first training feature vector 708 can be generated by processing a corresponding training unstructured data file using a first encoder (e.g., the first encoder 410 of FIG. 4). In addition, the second training feature vector 710 can be generated by processing the context data object 702 using a second encoder (e.g., the second encoder 610 of FIG. 6). The event data input element can be used as a target label for the context data object, allowing the classification engine to be trained to predict anomalous events without manually labeling or annotating each training context data object.

[0106] In some cases, the training context data object 702 can be associated with feedback data 704. The association of the feedback data can be performed in response to another prediction that one of the first training feature vector 708 and the second training feature vector 710 of the event data input element 706 deviates from an expected vector value. For example, the first deviation of the first feature vector 708 from a first expected vector value can be predicted by (1) generating a distribution of the first training feature vectors in a first feature space, (2) determining that the first feature vector 708 corresponds to an outlier of the generated distribution, and (3) determining that the first feature vector 708 deviates from the expected vector value. In some cases, the outlier is determined by determining an interquartile range value of the generated distribution and determining that the first feature vector falls below or exceeds the interquartile range value. Outliers may also be determined by (1) determining a z-score of a first feature vector and (2) determining that the z-score is below a first predetermined threshold (e.g., −3) or above a second predetermined threshold (e.g., 3).

[0107] The classification engine 712 may process the training context data object 702 to generate intermediate results 714. The intermediate results 714 may include one or more values ​​that represent the training context data object 702. In some cases, the classification engine may include an artificial neural network that generates the intermediate results 714.

[0108] A loss 716 may be determined between the intermediate results 714 and the training event data input elements 706. The determined loss 716 may identify a performance level of the classification engine 712 with respect to whether the classification engine 712 can predict whether a particular event corresponds to an anomalous event. For example, if the classification engine 712 predicts that the intermediate results 714 and the training event data input elements 706 are similar to one another, the determined loss 716 may decrease. Conversely, if the classification engine 712 predicts that the intermediate results 714 and the training event data input elements 706 are dissimilar to one another, the determined loss 716 may increase.

[0109] The classification engine may adjust one or more of its parameters 718 based on the determined loss. Adjustment of the parameters 718 of the classification engine 712 may be performed to minimize the determined loss 716 between the intermediate results 714 and the training event data input elements 706. By using the event data input elements to identify "similar" contextual data objects, training of the classification engine 712 may be used to predict that a particular event corresponds to an anomalous event if the determined loss between a given contextual data and the corresponding event data input element exceeds a predefined threshold.

[0110] IV. Predicting Abnormal Events Using Contrastive Learning FIG. 8 includes a flowchart 800 illustrating an example of a method for predicting anomalous events using contrastive learning, according to some embodiments. Some of the operations described in the flowchart 800 may be performed by a computer system. Although the flowchart 800 may describe the operations as a sequential process, in various embodiments, many of the operations may be performed in parallel or simultaneously. In addition, the order of the operations may be rearranged. The operations may have additional steps not shown in the figure. Furthermore, some embodiments of the method may be implemented by hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented in software, firmware, middleware, or microcode, the program code or code segments for performing the associated tasks may be stored in a computer-readable medium, such as a storage medium.

[0111] In step 802, an abnormal event prediction system (e.g., the abnormal event prediction system 100) can access an unstructured data file. The unstructured data file identifies the occurrence of a particular event. The unstructured data file 102 can correspond to a particular file format, including email file formats (e.g., MSG), image file formats (e.g., JPG, JPEG, PNG, BMP), web page formats (e.g., HTML), document file formats (e.g., DOC, PDF, XPS, EPUB), audio file formats (e.g., MP3, M4A), video file formats (e.g., MPEG, MOV), and other types of file formats.

[0112] In step 804, the abnormal event prediction system may access context data associated with the unstructured data file. The context data includes information describing the environment in which a particular event occurred. For example, the context data may identify where a particular event occurred, or another preceding or subsequent event that is predicted to be related to the particular event. In some cases, the abnormal event prediction system may apply one or more pre-processing operations (e.g., normalization, filtering) to the context data to improve the performance of the encoder that processes the context data. For example, a flattening operation may be applied to the context data by merging data records (e.g., duplicate data records) accessed from one or more data stores into a single or reduced number of tables and removing any redundant data.

[0113] In step 806, the abnormal event prediction system can generate a first feature vector of the set of feature vectors by processing the unstructured data file using a first encoder. The first feature vector represents the unstructured data file in a first feature space. In some cases, the first encoder includes a residual neural network or a convolutional neural network. The first encoder can be trained to generate the first feature vector for the unstructured data file, where a loss is defined to penalize instances in which feature vectors of similar training elements (e.g., training unstructured data files) are located far apart in the first feature space and / or instances in which feature vectors of different training elements are located close to each other in the first feature space.

[0114] In step 808, the abnormal event prediction system can generate a second feature vector of the set of feature vectors by processing the context data using a second encoder. The second feature vector represents the context data in a second feature space. The second encoder can be trained to generate the second feature vector for the context data, where another loss is defined to penalize instances where feature vectors of similar training elements (e.g., training context data) are located far apart in the second feature space and / or instances where feature vectors of different training elements are located close to each other in the second feature space.

[0115] In some cases, the second encoder includes another convolutional neural network. The second encoder can have the same or a different architecture as that of the first encoder. Thus, the first encoder and the second encoder can each be trained to generate feature vectors in their respective feature spaces, where the first encoder and the second encoder may not share parameters.

[0116] In some cases, the one or more parameters of the first encoder and the one or more parameters of the second encoder have been learned by including: (i) transforming a first training feature vector in a first feature space to generate a first training transformed feature vector representing a training unstructured data file in a shared feature space, where the training unstructured data file identifies training events; (ii) transforming the second training feature vector in a second feature space to generate a second training transformed feature vector representing training context data in the shared feature space, where the training context data identifies the same training events; and (iii) generating a third training vector in the shared feature space based on the first training transformed feature vector and the second training transformed feature vector, where combining information from the first training transformed feature vector and the second training transformed feature vector results in a third training vector with improved projected predictability than either the first training feature vector or the second training feature vector alone.

[0117] In some cases, training the first encoder and the second encoder includes determining a loss between the first transformed training feature vector and the second transformed training feature vector using a combined loss function, and adjusting one or more parameters of the first encoder and one or more parameters of the second encoder based on the determined loss. The combined loss function can include a first contrast loss function and a second contrast loss function. The combined loss function can be weighted by one or more weighting factors, which can be adjusted based on the relative predictiveness of the training unstructured data file and / or the context data.

[0118] In step 810, the anomalous event prediction system can generate an event data input element for the unstructured data file. The event data input element can include a set of feature vectors. The set of feature vectors can include a first feature vector and a second feature vector that are processed by a machine learning model (e.g., a classifier model) to predict whether a particular event identified in the unstructured data file corresponds to an anomalous event.

[0119] In step 812, the anomalous event prediction system can generate a classification result for the unstructured data file by processing the event data input elements using the machine learning model. In some cases, the classification result includes a prediction of whether a particular event corresponds to an anomalous event. The classification result can also include a severity score for the anomalous event with a confidence interval. The severity score can then be used to classify or cluster the predicted anomalous events. For example, the anomalous events can be clustered to rank the anomalous events based on the predicted severity score. Downstream pipeline tasks can use this information for subsequent actions. The machine learning model can be trained to process the context data and / or the unstructured data file to generate an intermediate output. The intermediate output can be compared to the event data input elements that are being used as target labels. Based on the comparison, the machine learning model can generate a prediction of whether a particular event corresponds to an anomalous event. The machine learning model can include an artificial neural network or a tree-based classifier.

[0120] In some cases, the abnormal event prediction system determines that another loss between the second feature vector and another feature vector in the second feature space exceeds a predetermined threshold. In response to determining that the other loss exceeds the predetermined threshold, the abnormal event prediction system can receive feedback data associated with the context data. The feedback data can be processed using a machine learning model to generate a classification result.

[0121] In step 814, the abnormal event prediction system can output the classification results. For example, the classification results can be presented locally or transmitted to another device. The results can be output along with an identifier for the unstructured data file. Process 800 then ends.

[0122] V. Exemplary Systems 9 shows a simplified diagram of a distributed system 900 for implementing one of the embodiments. In the illustrated embodiment, the distributed system 900 includes one or more client computing devices 902, 904, 906, and 908 configured to execute and operate client applications, such as web browsers, proprietary clients (e.g., Oracle Forms), etc., via one or more networks 910. A server 912 can be communicatively connected to the remote client computing devices 902, 904, 906, and 908 via the network 910.

[0123] In various embodiments, the server 912 may be adapted to execute one or more services or software applications provided by one or more of the system's components. In some embodiments, these services may be provided to users of the client computing devices 902, 904, 906, and / or 908 as web-based or cloud services or under a Software as a Service (SaaS) model. Users operating the client computing devices 902, 904, 906, and / or 908 may then utilize one or more client applications to interact with the server 912 to utilize the services provided by these components.

[0124] In the illustrated configuration, the software components 918, 920, and 922 of the system 900 are shown as being implemented on the server 912. In other embodiments, one or more of the components of the system 900 and / or the services provided by these components may also be implemented by one or more of the client computing devices 902, 904, 906, and / or 908. A user operating a client computing device may then utilize one or more client applications to use the services provided by these components. These components may be implemented in hardware, firmware, software, or a combination thereof. It should be understood that a variety of different system configurations are possible that may differ from the distributed system 900. Thus, the illustrated embodiment is one example of a distributed system for implementing the system of the embodiments and is not intended to be limiting.

[0125] The client computing devices 902, 904, 906, and / or 908 may be portable handheld devices (e.g., iPhone, mobile phone, iPad, computing tablet, personal digital assistant (PDA)) or wearable devices (e.g., Google Glass head mounted display) running software such as Microsoft Windows Mobile and / or various mobile operating systems such as iOS, Windows Phone, Android, BlackBerry 10, Palm OS, and capable of Internet, e-mail, short message service (SMS), Blackberry, or other communication protocols. The client computing devices may be general purpose personal computers, including, by way of example, personal computers and / or laptop computers running various versions of Microsoft Windows, Apple Macintosh, and / or Linux operating systems. The client computing devices may be workstation computers running any of a variety of commercially available UNIX or UNIX-like operating systems, including, but not limited to, various GNU / Linux operating systems such as Google Chrome OS. Alternatively, or in addition, client computing devices 902, 904, 906, and 908 may be any other electronic device, such as a thin-client computer, an Internet-enabled gaming system (e.g., a Microsoft Xbox game console with or without a Kinect® gesture input device), and / or a personal messaging device, capable of communicating over network 910.

[0126] Although the exemplary distributed system 900 is shown with four client computing devices, any number of client computing devices may be supported. Other devices, such as devices with sensors, may interact with the server 912.

[0127] The network 910 in the distributed system 900 may be any type of network familiar to those skilled in the art capable of supporting data communications using any of a variety of commercially available protocols, including, but not limited to, TCP / IP (Transmission Control Protocol / Internet Protocol), SNA (Systems Network Architecture), IPX (Internet Packet Exchange), AppleTalk, and the like. By way of example only, the network 910 may be a local area network (LAN), such as one based on Ethernet, Token Ring, and the like. The network 910 may be a wide area network and the Internet. The network 910 may include virtual networks, including, but not limited to, a virtual private network (VPN), an intranet, an extranet, a public switched telephone network (PSTN), an infrared network, a wireless network (e.g., a network operating according to any of the Institute of Electrical and Electronics Engineers (IEEE) 802.91 protocol suite, Bluetooth, and / or any other wireless protocol), and / or any combination of these and / or other networks.

[0128] Servers 912 may comprise one or more general purpose computers, dedicated server computers (including, by way of example, PC (personal computer) servers, UNIX servers, mid-range servers, mainframe computers, rack-mounted servers, etc.), server farms, server clusters, or any other suitable arrangement and / or combination. In various embodiments, servers 912 may be adapted to execute one or more services or software applications described in the preceding disclosure. For example, servers 912 may correspond to servers for executing the processes described above in accordance with one embodiment of the present disclosure.

[0129] Server 912 may run operating systems, including any of those mentioned above, as well as any commercially available server operating system. Server 912 may also run any of a variety of additional server applications and / or mid-tier applications, including a HyperText Transfer Protocol (HTTP) server, a File Transfer Protocol (FTP) server, a Common Gateway Interface (CGI) server, a JAVA server, a database server, etc. Exemplary database servers include, but are not limited to, those commercially available from Oracle, Microsoft, Sybase, IBM (International Business Machines), etc.

[0130] In some embodiments, server 912 may include one or more applications for analyzing and consolidating data feeds and / or event updates received from users of client computing devices 902, 904, 906, and 908. By way of example, the data feeds and / or event updates may include, but are not limited to, Twitter® feeds, Facebook® updates, or real-time updates received from one or more third party information sources and continuous data streams, including real-time events associated with sensor data applications, financial tickers, network performance measurement tools (e.g., network monitoring and traffic management applications), clickstream analysis tools, automobile traffic monitoring, and the like. Server 912 may also include one or more applications for displaying the data feeds and / or real-time events via one or more display devices of client computing devices 902, 904, 906, and 908.

[0131] Distributed system 900 may also include one or more databases 914 and 916. Databases 914 and 916 may reside in a variety of locations. By way of example, one or more of databases 914 and 916 may reside on a non-transitory storage medium local to (and / or residing within) server 912. Alternatively, databases 914 and 916 may be remote from server 912 and communicate with server 912 via a network-based or dedicated connection. In one set of embodiments, databases 914 and 916 may reside on a storage area network (SAN). Similarly, any files necessary to perform functions ascribed to server 912 may be stored locally on server 912 and / or remotely, as appropriate. In one set of embodiments, databases 914 and 916 may include relational databases adapted to store, update, and retrieve data in response to SQL-formatted commands, such as those provided by Oracle.

[0132] 10 is a simplified block diagram of one or more components of a system environment 1000 according to one embodiment of the disclosure, which enables services provided by one or more components of the embodiment system to be offered as cloud services. In the illustrated embodiment, the system environment 1000 includes one or more client computing devices 1004, 1006, and 1008 that a user can use to interact with a cloud infrastructure system 1002 that provides cloud services. The client computing devices can be configured to run a client application, such as a web browser, a proprietary client application (e.g., Oracle Forms), or some other application, that a user of the client computing device can use to interact with the cloud infrastructure system 1002 to use the services offered by the cloud infrastructure system 1002.

[0133] It should be understood that the illustrated cloud infrastructure system 1002 may have other components than those shown. Additionally, the illustrated embodiment is merely one example of a cloud infrastructure system that may incorporate an embodiment of the present invention. In other embodiments, the cloud infrastructure system 1002 may have more or fewer components than those shown, may combine two or more components, or may have a different configuration or arrangement of components.

[0134] The client computing devices 1004 , 1006 , and 1008 may be devices similar to those described above for 902 , 904 , 906 , and 908 .

[0135] Although the exemplary system environment 1000 is shown with three client computing devices, any number of client computing devices may be supported. Other devices, such as devices with sensors, may interact with the cloud infrastructure system 1002.

[0136] Network 1010 can facilitate communication and data exchange between clients 1004, 1006, and 1008 and cloud infrastructure system 1002. Each network can be any type of network familiar to those skilled in the art that can support data communications using any of a variety of commercially available protocols, including those described above for network 910.

[0137] The cloud infrastructure system 1002 may include one or more computers and / or servers, which may include those described above for the server(s) 912 .

[0138] In some embodiments, the services provided by the cloud infrastructure system may include a host of services made available on demand to users of the cloud infrastructure system, such as online data storage and backup solutions, web-based email services, hosted office suites and document collaboration services, database processing, managed technical support services, etc. The services provided by the cloud infrastructure system may be dynamically scaled to meet the needs of its users. A particular instantiation of a service provided by the cloud infrastructure system is referred to herein as a "service instance." In general, any service made available to users from a cloud service provider's system over a communications network such as the Internet is referred to as a "cloud service." Typically, in a public cloud environment, the servers and systems that make up the cloud service provider's system are distinct from the customer's own on-premise servers and systems. For example, the cloud service provider's system may host an application that users can order and use on demand over a communications network such as the Internet.

[0139] In some examples, services in a cloud infrastructure of a computer network may include protected computer network access to storage, hosted databases, hosted web servers, software applications, or other services as provided to users by a cloud vendor or as otherwise known in the art. For example, a service may include password-protected access to remote storage on the cloud over the Internet. As another example, a service may include a web-services-based hosted relational database and scripting language middleware engine for private use by networked developers. As another example, a service may include access to an email software application hosted on a cloud vendor's website.

[0140] In some embodiments, cloud infrastructure system 1002 may include a suite of application, middleware, and database service offerings that are delivered to customers in a self-service, subscription-based, elastically scalable, reliable, highly available, and secure manner. One example of such a cloud infrastructure system is the Oracle Public Cloud, offered by the assignee of the present application.

[0141] In various embodiments, the cloud infrastructure system 1002 can be adapted to automatically provision, manage, and track customer subscriptions to the services provided by the cloud infrastructure system 1002. The cloud infrastructure system 1002 can provide cloud services through different deployment models. For example, the services may be provided under a public cloud model, where an organization that sells cloud services (e.g., owned by Oracle) owns the cloud infrastructure system 1002 and makes the services available to the general public or to companies in different industries. As another example, the services may be provided under a private cloud model, where the cloud infrastructure system 1002 is operated solely for a single organization and may provide services to one or more entities within that organization. The cloud services may be provided under a community cloud model, where the cloud infrastructure system 1002 and the services provided by the cloud infrastructure system 1002 are shared by several organizations within an associated community. The cloud services may be provided under a hybrid cloud model, which is a combination of two or more different models.

[0142] In some embodiments, the services provided by cloud infrastructure system 1002 may include one or more services provided under the Software as a Service (SaaS) category, the Platform as a Service (PaaS) category, the Infrastructure as a Service (IaaS) category, or other categories of services, including hybrid services. A customer may order one or more services provided by cloud infrastructure system 1002 via a subscription order. Cloud infrastructure system 1002 then performs processing to provide the services of the customer's subscription order.

[0143] In some embodiments, the services provided by the cloud infrastructure system 1002 may include, but are not limited to, application services, platform services, and infrastructure services. In some examples, application services may be provided by the cloud infrastructure system through a SaaS platform. The SaaS platform may be configured to provide cloud services that fall under the SaaS category. For example, the SaaS platform may provide the ability to build and deliver a suite of applications on demand on an integrated development and deployment platform. The SaaS platform may manage and control the underlying software and infrastructure to deliver the SaaS services. By utilizing the services provided by the SaaS platform, customers may utilize applications that run on the cloud infrastructure system. Customers may obtain application services without having to purchase separate licenses and support. A variety of different SaaS services may be provided. Examples include, but are not limited to, services that provide solutions for sales performance management, enterprise integration, and flexibility for large organizations.

[0144] In some embodiments, platform services can be provided by the cloud infrastructure system via a PaaS platform. The PaaS platform can be configured to provide cloud services that fall under the PaaS category. Examples of platform services can include, but are not limited to, services that allow an organization (such as Oracle) to consolidate existing applications onto a shared common architecture, and the ability to build new applications that leverage the shared services provided by the platform. The PaaS platform can manage and control the underlying software and infrastructure to provide the PaaS services. Customers can obtain the PaaS services provided by the cloud infrastructure system without the need to purchase separate licenses and support. Examples of platform services can include, but are not limited to, Oracle Java Cloud Service (JCS), Oracle Database Cloud Service (DBCS), etc.

[0145] By utilizing the services provided by the PaaS platform, customers can adopt programming languages ​​and tools supported by the cloud infrastructure system, and also control the deployed services. In some embodiments, the platform services provided by the cloud infrastructure system can include database cloud services, middleware cloud services (e.g., Oracle Fusion Middleware services), and Java cloud services. In one embodiment, the database cloud services can support a shared services deployment model that allows organizations to pool database resources and provide database as a service to customers in the form of a database cloud. The middleware cloud services can provide a platform for customers to develop and deploy various cloud applications, and the Java cloud services can provide a platform for customers to deploy Java applications in the cloud infrastructure system.

[0146] In a cloud infrastructure system, an IaaS platform may provide a variety of different infrastructure services that facilitate management and control of underlying computing resources such as storage, network, and other fundamental computing resources for customers who use the services provided by the SaaS and PaaS platforms.

[0147] In some embodiments, cloud infrastructure system 1002 may also include infrastructure resources 1030 for providing resources used to provide various services to customers of the cloud infrastructure system. In one embodiment, infrastructure resources 1030 may include a pre-integrated and optimized combination of hardware, such as servers, storage, and networking resources, for running the services offered by the PaaS and SaaS platforms.

[0148] In some embodiments, resources in the cloud infrastructure system 1002 may be shared by multiple users and dynamically reallocated per request. Additionally, resources may be allocated to users in different time zones. For example, the cloud infrastructure system 1030 may allow a first set of users in a first time zone to utilize resources in the cloud infrastructure system for a specified number of hours, and then allow the same resources to be reallocated to another set of users in a different time zone, thereby maximizing resource utilization.

[0149] In some embodiments, multiple internal shared services 1032 may be provided that are shared by different components or modules of cloud infrastructure system 1002 as well as by services provided by cloud infrastructure system 1002. These internal shared services may include, but are not limited to, security and identity services, integration services, enterprise repository services, enterprise manager services, virus scanning and whitelist services, high availability, backup and recovery services, services to enable cloud support, email services, notification services, file transfer services, etc.

[0150] In some embodiments, cloud infrastructure system 1002 may provide comprehensive management of cloud services (e.g., SaaS, PaaS, and IaaS services) in the cloud infrastructure system. In one embodiment, cloud management functions may include functionality for provisioning, managing, and tracking customer subscriptions, etc., received by cloud infrastructure system 1002.

[0151] In one embodiment, as shown, the cloud management functionality may be provided by one or more modules, such as an order management module 1020, an order orchestration module 1022, an order provisioning module 1024, an order management and monitoring module 1026, and an identity management module 1028. These modules may include or be provided using one or more computers and / or servers, which may be general purpose computers, dedicated server computers, server farms, server clusters, or any other suitable arrangement and / or combination.

[0152] In an example operation 1034, a customer using a client device, such as client device 1004, 1006, or 1008, may interact with cloud infrastructure system 1002 by requesting one or more services offered by cloud infrastructure system 1002 and placing an order for a subscription to one or more services offered by cloud infrastructure system 1002. In some embodiments, the customer may access cloud user interfaces (UIs), cloud UI 1012, cloud UI 1014, and / or cloud UI 1016, and place the subscription order via these UIs. Order information received by cloud infrastructure system 1002 in response to the customer placing the order may include information identifying the customer and one or more services offered by cloud infrastructure system 1002 to which the customer intends to subscribe.

[0153] After an order is placed by a customer, the order information is received via the cloud UI 1012, 1014, and / or 1016.

[0154] In an operation 1036, the order is stored in an order database 1018. The order database 1018 is operated by the cloud infrastructure system 1018 and may be one of several databases operated along with other system elements.

[0155] At operation 1038, the order information is forwarded to the order management module 1020. In some cases, the order management module 1020 may be configured to perform billing and accounting functions related to the order, such as validating the order and registering the order after validation.

[0156] At operation 1040, information regarding the order is communicated to the order orchestration module 1022. The order orchestration module 1022 can utilize the order information to orchestrate the provisioning of services and resources for the order placed by the customer. In some cases, the order orchestration module 1022 may orchestrate the provisioning of resources to support subscribed services that use the services of the order provisioning module 1024.

[0157] In some embodiments, the order orchestration module 1022 enables management of processes associated with each order and applies logic to determine whether the order should proceed to provisioning. In operation 1042, upon receiving an order for a new subscription, the order orchestration module 1022 sends a request to the order provisioning module 1024 to allocate and configure resources required to fulfill the subscription order. The order provisioning module 1024 enables allocation of resources for the services ordered by the customer. The order provisioning module 1024 provides a level of abstraction between the cloud services provided by the cloud infrastructure system 1000 and the physical implementation layer used to provision resources to provide the requested services. Thus, the order orchestration module 1022 can be insulated from implementation details such as whether the services and resources are actually provisioned on the fly or whether they are pre-provisioned and allocated / allocated only upon request.

[0158] In an operation 1044 , once the services and resources have been provisioned, a notification of the rendered services may be sent by the order provisioning module 1024 of the cloud infrastructure system 1002 to the customer at the client device 1004 , 1006 , and / or 1008 .

[0159] At operation 1046, the customer's subscription order may be managed and tracked by the order management and monitoring module 1026. In some cases, the order management and monitoring module 1026 may be configured to collect usage statistics for services in the subscription order, such as the amount of storage used, the amount of data transferred, the number of users, and the amount of system uptime and system downtime.

[0160] In some embodiments, cloud infrastructure system 1000 may include identity management module 1028. Identity management module 1028 may be configured to provide identity services, such as access management and authorization services in cloud infrastructure system 1000. In some embodiments, identity management module 1028 may manage information about customers who wish to utilize services provided by cloud infrastructure system 1002. Such information may include information authenticating the identities of such customers and information describing which operations those customers are authorized to perform with respect to various system resources (e.g., files, directories, applications, communication ports, memory segments, etc.). Identity management module 1028 may also include management of descriptive information about each customer and how and who may access and modify that descriptive information.

[0161] 11 illustrates an exemplary computer system 1100 in which various embodiments of the present invention may be implemented. The system 1100 may be used to implement any of the computer systems described above. As shown, the computer system 1100 includes a processing unit 1104 that communicates with a number of peripheral subsystems via a bus subsystem 1102. These peripheral subsystems may include a processing acceleration unit 1106, an I / O subsystem 1108, a storage subsystem 1118, and a communication subsystem 1124. The storage subsystem 1118 includes a tangible computer-readable storage medium 1122 and a system memory 1110.

[0162] The bus subsystem 1102 provides a mechanism for allowing the various components and subsystems of the computer system 1100 to communicate with each other as intended. Although the bus subsystem 1102 is shown diagrammatically as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses. The bus subsystem 1102 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. For example, such architectures may include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus that may be implemented as a Mezzanine bus manufactured in accordance with the IEEE P1386.1 standard.

[0163] The processing unit 1104, which may be implemented as one or more integrated circuits (e.g., conventional microprocessors or microcontrollers), controls the operation of the computer system 1100. The processing unit 1104 may include one or more processors. These processors may include single-core processors or multi-core processors. In some embodiments, the processing unit 1104 may be implemented as one or more independent processing units 1132 and / or 1134 with a single-core or multi-core processor included in each processing unit. In other embodiments, the processing unit 1104 may be implemented as a quad-core processing unit formed by integrating two dual-core processors into a single chip.

[0164] In various embodiments, the processing unit 1104 may execute various programs according to program code and may maintain multiple simultaneously executing programs or processes. At any given time, some or all of the program code to be executed may reside in the processor 1104 and / or in the storage subsystem 1118. Through suitable programming, the processor 1104 may provide various functions as discussed above. The computer system 1100 may further include a processing acceleration unit 1106, which may include a digital signal processor (DSP), a special purpose processor, or the like.

[0165] The I / O subsystem 1108 can include user interface input devices and user interface output devices. User interface input devices can include pointing devices such as keyboards, mice or trackballs, touchpads or touchscreens integrated into displays, scroll wheels, click wheels, dials, buttons, switches, keypads, voice input devices with voice command recognition systems, microphones, and other types of input devices. User interface input devices can include motion sensing and / or gesture recognition devices such as Microsoft Kinect® motion sensors that allow users to control and interact with input devices such as Microsoft Xbox® 360 game controllers through a natural user interface using gestures and spoken commands. User interface input devices can also include eye gesture recognition devices such as Google Glass® blink detectors that detect eye activity from a user (e.g., “blinking” during picture taking and / or menu selection) and translate eye gestures as input to an input device (e.g., Google Glass®). Additionally, the user interface input devices may include a voice recognition sensing device that allows a user to interact with a voice recognition system (e.g., the Siri® Navigator) via voice commands.

[0166] User interface input devices may also include, but are not limited to, three-dimensional (3D) mice, joysticks or pointing sticks, game pads and graphic tablets, as well as audio / visual devices such as speakers, digital cameras, digital video cameras, portable media players, webcams, image scanners, fingerprint scanners, barcode readers 3D scanners, 3D printers, laser distance measuring devices, and eye tracking devices. Additionally, user interface input devices may include medical image input devices such as, for example, computed tomography, magnetic resonance imaging, position emission tomography, medical ultrasound, etc. User interface input devices may also include audio input devices such as, for example, MIDI keyboards, digital musical instruments, etc.

[0167] User interface output devices may include a display subsystem, indicator lights, or non-visual displays such as audio output devices, and the like. The display subsystem may be a flat panel device such as one using a cathode ray tube (CRT), liquid crystal display (LCD) or plasma display, a projection device, a touch screen, and the like. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from computer system 1100 to a user or to another computer. For example, user interface output devices may include a variety of display devices that visually convey text, graphics, and audio / video information, such as, but not limited to, monitors, printers, speakers, headphones, automobile navigation systems, plotters, audio output devices, and modems.

[0168] Computer system 1100 may include a storage subsystem 1118, which includes software elements currently shown as located within system memory 1110. The system memory 1110 may store program instructions loadable into and executable by processing unit 1104, as well as data generated during the execution of these programs.

[0169] Depending on the configuration and type of computer system 1100, the system memory 1110 may be volatile (such as random access memory (RAM)) and / or non-volatile (such as read-only memory (ROM), flash memory, etc.). RAM typically contains data and / or program modules that are immediately accessible to and / or currently being operated on and executed by the processing unit 1104. In some implementations, the system memory 1110 may include a number of different types of memory, such as static random access memory (SRAM) or dynamic random access memory (DRAM). In some implementations, the ROM may typically store a basic input / output system (BIOS), which contains the basic routines that help to transfer information between elements within the computer system 1100, such as during start-up. By way of example and not limitation, the system memory 1110 also illustrates application programs 1112, which may include client applications, a web browser, a mid-tier application, a relational database management system (RDBMS), and the like, program data 1114, and an operating system 1116. By way of example, operating system 1116 may include various versions of Microsoft Windows®, Apple Macintosh®, and / or Linux operating systems, various commercially available UNIX® or UNIX-like operating systems (including, but not limited to, various GNU / Linux operating systems, Google Chrome® OS, etc.), and / or mobile operating systems such as iOS, Windows® Phone, Android® OS, BlackBerry® 10 OS, and Palm® OS operating systems.

[0170] The storage subsystem 1118 may also provide a tangible, computer-readable storage medium for storing the basic programming and data constructs that provide the functionality of some embodiments. The storage subsystem 1118 may store software (programs, code modules, instructions) that, when executed by the processor, provide the functionality described above. These software modules or instructions may be executed by the processing unit 1104. The storage subsystem 1118 may also provide a repository for storing data used in accordance with the present invention.

[0171] Storage subsystem 1100 may also include a computer-readable storage medium reader 1120 that may be further connected to a computer-readable storage medium 1122. Optionally in combination with system memory 1110, computer-readable storage medium 1122 may comprehensively represent remote, local, fixed, and / or removable storage devices, as well as storage media for containing, storing, transmitting, and retrieving computer-readable information on a temporary and / or more permanent basis.

[0172] The computer readable storage medium 1122 containing the code, or portions of the code, may include any suitable medium known or used in the art, including, but not limited to, storage media and communication media, such as volatile and non-volatile, removable and non-removable media, implemented in any manner or technology for storing and / or transmitting information. This may include tangible computer readable storage media, such as RAM, ROM, Electronically Erasable Programmable ROM (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disk (DVD), or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or other tangible computer readable medium. This may also include non-tangible computer readable media, such as data signals, data transmission, or any other medium that may be used to transmit the desired information and that may be accessed by the computing system 1100.

[0173] By way of example, the computer readable storage medium 1122 may include a hard disk drive that reads from or writes to non-removable, non-volatile magnetic media, a magnetic disk drive that reads from or writes to removable, non-volatile magnetic disks, and an optical disk drive that reads from or writes to removable, non-volatile optical disks, such as CD ROMs, DVDs, Blu-Ray® disks, or other optical media. The computer readable storage medium 1122 may include, but is not limited to, Zip® drives, flash memory cards, Universal Serial Bus (USB) flash drives, Secure Digital (SD) cards, DVD disks, digital video tapes, and the like. The computer-readable storage media 1122 may also include flash memory-based solid-state drives (SSDs), enterprise flash drives, SSDs based on non-volatile memory such as solid-state ROM, SSDs based on volatile memory such as solid-state RAM, dynamic RAM, static RAM, DRAM-based SSDs, magnetoresistive RAM (MRAM) SSDs, and hybrid SSDs using a combination of DRAM and flash memory-based SSDs. Disk drives and their associated computer-readable media may provide non-volatile storage of computer-readable instructions, data structures, program modules, and other data for the computer system 1100.

[0174] The communication subsystem 1124 provides an interface to other computer systems and networks. The communication subsystem 1124 serves as an interface for receiving data from the computer system 1100 and transmitting data from the computer system 1100 to other systems. For example, the communication subsystem 1124 may enable the computer system 1100 to connect to one or more devices via the Internet. In some embodiments, the communication subsystem 1124 may include a radio frequency (RF) transceiver component for accessing wireless voice and / or data networks (e.g., using cellular technology, advanced data network technologies such as 3G, 4G, or EDGE (enhanced data rates for global evolution), Wi-Fi (IEEE 802.91 family of standards, or other mobile communication technologies, or any combination thereof), a global positioning system (GPS) receiver component, and / or other components. In some embodiments, the communication subsystem 1124 may provide wired network connectivity (e.g., Ethernet) in addition to or instead of a wireless interface.

[0175] In some embodiments, the communications subsystem 1124 may also receive incoming communications in the form of structured and / or unstructured data feeds 1126, event streams 1128, event updates 1130, etc., on behalf of one or more users who may use the computer system 1100.

[0176] By way of example, the communications subsystem 1124 may be configured to receive data feeds 1126 in real time from users of social networks and / or other communications services, such as web feeds, such as Twitter® feeds, Facebook® updates, Rich Site Summary (RSS) feeds, and / or real-time updates from one or more third party sources.

[0177] Additionally, the communications subsystem 1124 may be configured to receive data in the form of a continuous data stream, which may include an event stream 1128 of real-time events and / or event updates 1130, which may be continuous or infinite in nature with no apparent end. Examples of applications that generate continuous data may include, for example, sensor data applications, financial tickers, network performance measurement tools (e.g., network monitoring and traffic management applications), clickstream analysis tools, automobile traffic monitoring, etc.

[0178] The communications subsystem 1124 may also be configured to output structured and / or unstructured data feeds 1126, event streams 1128, event updates 1130, etc. to one or more databases that can communicate with one or more streaming data source computers coupled to the computer system 1100.

[0179] The computer system 1100 may be one of a variety of types, including a handheld portable device (e.g., an iPhone® mobile phone, an iPad® computing tablet, a PDA), a wearable device (e.g., a Google Glass® head mounted display), a PC, a workstation, a mainframe, a kiosk, a server rack, or any other data processing system.

[0180] Because the nature of computers and networks is constantly changing, the description of the computer system 1100 shown in the figure is intended only as a specific example. Many other configurations are possible having more or fewer components than the system shown in the figure. For example, customized hardware may be used and / or particular elements may be implemented in hardware, firmware, software (including applets), or a combination. Furthermore, connections to other computing devices, such as network input / output devices, may be employed. Based on the disclosure and teachings provided herein, one of ordinary skill in the art will appreciate other manners and / or methods for implementing various embodiments.

[0181] In the foregoing specification, aspects of the invention have been described with reference to specific embodiments thereof, but those skilled in the art will recognize that the invention is not limited thereto. The various features and aspects of the invention described above can be used individually or jointly. Moreover, the embodiments can be utilized in any number of environments and applications beyond those described herein without departing from the broader spirit and scope of the specification. Accordingly, the specification and drawings should be regarded as illustrative rather than restrictive.

Claims

1. 1. A method comprising: accessing an unstructured data file, the unstructured data file identifying the occurrence of a particular event; The method further includes accessing context data associated with the unstructured data file, the context data including information describing an environment in which the particular event occurred; The method further includes generating an event data input element for the unstructured data file, the event data input element including a set of feature vectors; the event data input element is generated by using a first encoder to process the unstructured data file to generate a first feature vector of the set of feature vectors, and using a second encoder to process the context data to generate a second feature vector of the set of feature vectors; the first feature vector represents the unstructured data file in a first feature space, and the second feature vector represents the context data in a second feature space; the one or more parameters of the first encoder and the one or more parameters of the second encoder are learned by the following process: The following process includes (i) transforming a first training feature vector in the first feature space to generate a first training transformed feature vector representing a training unstructured data file in a shared feature space, the training unstructured data file identifying a training event; The following process includes (ii) transforming a second training feature vector in the second feature space to generate a second training transformed feature vector representing training context data in the shared feature space, the training context data identifying the same training event as the training event; the subsequent processing includes (iii) generating a vector in the shared feature space based on the first training transformed feature vector and the second training transformed feature vector, wherein generating the vector in the shared feature space includes combining information from the first training transformed feature vector and the second training transformed feature vector to result in the vector having improved projected predictability than either the first training feature vector or the second training feature vector alone; The method further includes generating a classification result for the unstructured data file by processing the event data input elements using a machine learning model, the classification result including a prediction of whether the particular event corresponds to an anomalous event; The method further includes outputting the classification results of the unstructured data file.

2. determining that the first feature vector or the second feature vector deviates from an expected vector value; receiving feedback data associated with the context data in response to determining that the first feature vector or the second feature vector deviates from the expected vector value; The method of claim 1 , wherein generating the classification result further comprises processing the feedback data using the machine learning model.

3. The first encoder is trained using a set of training unstructured data files, and the training of the first encoder comprises: augmenting a training unstructured data file of the set of training unstructured data files to generate a first training augmented unstructured data file and a second training augmented unstructured data file; generating a third training feature vector for the first training augmented unstructured data file in the first feature space; generating a fourth training feature vector for the second training augmented unstructured data file in the first feature space; determining a loss between the third training feature vector and the fourth training feature vector; and adjusting one or more parameters of the first encoder based on the determined loss.

4. the second encoder is trained using a set of training context data objects, and the training of the second encoder comprises: augmenting a training context data object of the set of training context data objects to generate a first training augmented context data object and a second training augmented context data object; generating a fifth training feature vector of the first training extended context data object in the second feature space; generating a sixth training feature vector of the second training extended context data object in the second feature space; determining another loss between the fifth training feature vector and the sixth training feature vector; and adjusting one or more parameters of the second encoder based on the further loss.

5. The method of claim 1 or 2, wherein the first encoder comprises a convolutional neural network.

6. The method of claim 1 or 2, wherein the machine learning model comprises a tree-based classifier.

7. 3. The method of claim 1, wherein the context data includes a first set of data records accessed from a first data store and a second set of data records accessed from a second data store, and the context data is generated by applying one or more pre-processing operations to merge one or more overlapping data records in the first set of data records and the second set of data records.

8. The method of claim 1 or 2, wherein the classification result further comprises a severity score of the particular event, the severity score predicting whether the particular event corresponds to a particular type of the anomalous event.

9. A computer program tangibly embodied in a machine-readable storage medium comprising instructions configured to cause one or more data processors to perform operations, The operations include accessing an unstructured data file, the unstructured data file identifying the occurrence of a particular event; the operations include accessing context data associated with the unstructured data file, the context data including information describing an environment in which the particular event occurred; the operations include generating an event data input element for the unstructured data file, the event data input element including a set of feature vectors; the event data input element is generated by using a first encoder to process the unstructured data file to generate a first feature vector of the set of feature vectors, and using a second encoder to process the context data to generate a second feature vector of the set of feature vectors; the first feature vector represents the unstructured data file in a first feature space, and the second feature vector represents the context data in a second feature space; the one or more parameters of the first encoder and the one or more parameters of the second encoder are learned by the following process: The following process includes (i) transforming a first training feature vector in the first feature space to generate a first training transformed feature vector representing a training unstructured data file in a shared feature space, the training unstructured data file identifying a training event; (ii) transforming a second training feature vector in the second feature space to generate a second training transformed feature vector representing training context data in the shared feature space, the training context data identifying the same training event as the training event; the subsequent processing includes (iii) generating a vector in the shared feature space based on the first training transformed feature vector and the second training transformed feature vector, wherein generating the vector in the shared feature space includes combining information from the first training transformed feature vector and the second training transformed feature vector to result in the vector having improved projected predictability than either the first training feature vector or the second training feature vector alone; the operations include generating a classification result for the unstructured data file by processing the event data input elements using a machine learning model, the classification result including a prediction of whether the particular event corresponds to an anomalous event; The computer program product, wherein the operations include outputting a classification result of the unstructured data file.

10. The instructions further cause one or more data processors to perform operations, the operations including: determining that the first feature vector or the second feature vector deviates from an expected vector value; receiving feedback data associated with the context data in response to determining that the first feature vector or the second feature vector deviates from the expected vector value; The computer program product of claim 9 , wherein generating the classification result further comprises processing the feedback data using the machine learning model.

11. The first encoder is trained using a set of training unstructured data files, and the training of the first encoder comprises: augmenting a training unstructured data file of the set of training unstructured data files to generate a first training augmented unstructured data file and a second training augmented unstructured data file; generating a third training feature vector for the first training augmented unstructured data file in the first feature space; generating a fourth training feature vector for the second training augmented unstructured data file in the first feature space; determining a loss between the third training feature vector and the fourth training feature vector; and adjusting one or more parameters of the first encoder based on the determined loss.

12. the second encoder is trained using a set of training context data objects, and the training of the second encoder comprises: augmenting a training context data object of the set of training context data objects to generate a first training augmented context data object and a second training augmented context data object; generating a fifth training feature vector of the first training extended context data object in the second feature space; generating a sixth training feature vector of the second training extended context data object in the second feature space; determining another loss between the fifth training feature vector and the sixth training feature vector; and adjusting one or more parameters of the second encoder based on the further loss.

13. 11. The computer program product of claim 9 or 10, wherein the first encoder comprises a convolutional neural network.

14. The computer program product of claim 9 or 10, wherein the classification result further comprises a severity score of the particular event, the severity score predicting whether the particular event corresponds to a particular type of the anomalous event.

15. one or more data processors; a computer-readable storage medium containing instructions that, when executed on said one or more data processors, cause said one or more data processors to perform operations; The operations include accessing an unstructured data file, the unstructured data file identifying the occurrence of a particular event; the operations include accessing context data associated with the unstructured data file, the context data including information describing an environment in which the particular event occurred; the operations include generating an event data input element for the unstructured data file, the event data input element including a set of feature vectors; the event data input element is generated by using a first encoder to process the unstructured data file to generate a first feature vector of the set of feature vectors, and using a second encoder to process the context data to generate a second feature vector of the set of feature vectors; the first feature vector represents the unstructured data file in a first feature space, and the second feature vector represents the context data in a second feature space; the one or more parameters of the first encoder and the one or more parameters of the second encoder are learned by the following process: The following process includes (i) transforming a first training feature vector in the first feature space to generate a first training transformed feature vector representing a training unstructured data file in a shared feature space, the training unstructured data file identifying a training event; (ii) transforming a second training feature vector in the second feature space to generate a second training transformed feature vector representing training context data in the shared feature space, the training context data identifying the same training event as the training event; the subsequent processing includes (iii) generating a vector in the shared feature space based on the first training transformed feature vector and the second training transformed feature vector, wherein generating the vector in the shared feature space includes combining information from the first training transformed feature vector and the second training transformed feature vector to result in the vector having improved projected predictability than either the first training feature vector or the second training feature vector alone; the operations include generating a classification result for the unstructured data file by processing the event data input elements using a machine learning model, the classification result including a prediction of whether the particular event corresponds to an anomalous event; The system, wherein the operations include outputting the classification results of the unstructured data file.

16. The instructions further cause one or more data processors to perform operations, the operations including: determining that the first feature vector or the second feature vector deviates from an expected vector value; and receiving feedback data associated with the contextual data in response to determining that the first feature vector or the second feature vector deviates from the expected vector value, wherein generating the classification result further comprises processing the feedback data using the machine learning model.

17. The first encoder is trained using a set of training unstructured data files, and the training of the first encoder comprises: augmenting a training unstructured data file of the set of training unstructured data files to generate a first training augmented unstructured data file and a second training augmented unstructured data file; generating a third training feature vector for the first training augmented unstructured data file in the first feature space; generating a fourth training feature vector for the second training augmented unstructured data file in the first feature space; determining a loss between the third training feature vector and the fourth training feature vector; and adjusting one or more parameters of the first encoder based on the determined loss.

18. the second encoder is trained using a set of training context data objects, the training of the second encoder comprising: augmenting a training context data object of the set of training context data objects to generate a first training augmented context data object and a second training augmented context data object; generating a fifth training feature vector of the first training extended context data object in the second feature space; generating a sixth training feature vector of the second training extended context data object in the second feature space; determining another loss between the fifth training feature vector and the sixth training feature vector; and adjusting one or more parameters of the second encoder based on the further loss.

19. 17. The system of claim 15 or 16, wherein the first encoder comprises a convolutional neural network.

20. The system of claim 15 or 16, wherein the classification result further comprises a severity score for the particular event, the severity score predicting whether the particular event corresponds to a particular type of the anomalous event.

Images