Anomaly Detection Expected Maximum Calculation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems face challenges in efficiently determining the expected maximum in a distribution of values, which is crucial for identifying anomalous events, due to the sensitivity of this calculation to the underlying distribution, often unknown in advance, and the complexity of algorithms required.
Innovation Solution
The proposed solution involves an apparatus and method that efficiently determine the expected maximum by summing the mean and the second highest value of a distribution, with adjustments based on feedback and error analysis, allowing for effective anomaly detection in various domains such as information security, fraud detection, and health monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If complex algorithms are used to determine the expected maximum, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent extracts only the essential components needed for expected maximum determination: the mean and second highest value from the distribution. By taking out only these critical elements rather than using complex algorithms that analyze the entire distribution, the system achieves accurate anomaly detection with reduced computational complexity.
Solution Approach 2:
The approach segments the distribution analysis into two simple components: calculating the mean and identifying the second highest value. This segmentation avoids the need for complex overall distribution analysis while still providing accurate expected maximum determination for anomaly detection.
2Measurement precision
If the expected maximum calculation is made sensitive to the underlying distribution, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent uses simple, easily computable statistics (mean and second highest value) as disposable proxies for complex distribution analysis. These simple metrics capture the essential characteristics needed for anomaly detection without requiring expensive or complex distribution modeling, making the system both accurate and efficient.
3Reliability
If complex algorithms are used for anomaly detection, then reliability is improved, but productivity decreases
Solution Approach 1:
The patent changes the parameters used for anomaly detection from complex distributional parameters to simple statistical parameters (mean and second highest value). This parameter transformation maintains detection reliability while dramatically improving computational efficiency and processing speed.
Data Source
AI summary
An apparatus may include a processor that may be caused to access a distribution of a plurality of values, each value of the plurality of values quantifying an event of an event type in a computer network. The processor may determine a mean of the plurality of values and a second highest value of the plurality of values, generate an expected maximum of the distribution based on the mean and the second highest value, and access a first value quantifying a first event of the event type in the computer network. The processor may further determine that the first event is an anomalous event based on the first value and the expected maximum.