Anomaly Detection Event Tree for Computational Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods face inefficiencies due to handling large numbers of variables with unknown priorities or relevance, continuous variables with unknown value ranges, and unknown splitting effectiveness, leading to high computational complexity and potential false alarms.
Innovation Solution
The implementation of an anomaly detection technique based on an event tree structure, which leverages domain knowledge and known characteristics of event variables to apply more computationally efficient isolation, requiring fewer decision trees and avoiding bias through deterministic n-way splitting based on attribute importance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing anomaly detection methods use large numbers of variables with unknown priorities and continuous variables with unknown value ranges, then detection coverage is improved, but computational complexity increases and detection efficiency deteriorates
Solution Approach 1:
The patent transforms continuous variables into discrete variables by defining specific value ranges and splitting values based on domain knowledge. This parameter transformation reduces computational complexity while maintaining detection coverage, as discrete variables require fewer comparison operations and can be efficiently handled by decision tree structures.
Solution Approach 2:
The patent segments the variable space by dividing continuous variables into discrete ranges with predetermined splitting values. This segmentation creates a structured decision tree where each node handles specific variable ranges, reducing the overall computational burden compared to evaluating all continuous variables against all data points.
2Adaptability or versatility
If existing methods handle variables with unknown splitting effectiveness, then comprehensive anomaly detection is achieved, but false alarms increase and detection precision decreases
Solution Approach 1:
The patent performs preliminary analysis to determine domain knowledge and characteristics of network event variables before constructing the decision tree. Splitting values and value ranges are predetermined based on this preliminary action, which eliminates the need to evaluate all possible splitting points during anomaly detection, thereby reducing false alarms and improving detection precision.
3Productivity
If deterministic n-way splitting based on attribute importance is used, then computational efficiency is improved and resource usage is reduced, but the requirement for domain knowledge increases
Solution Approach 1:
The patent changes the parameter representation from continuous variables requiring random splitting to discrete variables with predetermined splitting values. This transformation enables deterministic n-way splitting where each node divides data into multiple branches based on attribute importance, significantly improving computational efficiency while the domain knowledge requirement is confined to the initial parameter definition phase.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and software can be used for anomaly detection. In some aspect, a number of training events are obtained. A data structure represented by a decision tree is generated based on the number of training events. A to-be-scored event is obtained and a traversed path is determined for the to-be-scored event. An anomaly score is computed based on the traversed path and the to-be-scored event is determined to be an anomalous or normal event based on the anomaly score.