Association Rule Mining for Anomaly Explanation Clarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection techniques struggle to provide clear and concise explanations for detected anomalies, leading to issues with false alerts and remediation processes, particularly in Zero Trust ecosystems.
Innovation Solution
The use of association rules and frequent pattern mining to identify anomalies and generate explanations, which involves computing outlier scores, boolean transactions, and risk ratios to select itemsets and derive association rules that explain anomalies and their root causes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly detection techniques are used to identify abnormal events, then detection capability is improved, but explanation clarity and conciseness deteriorate
Solution Approach 1:
The patent introduces association rules as an intermediary element that bridges anomaly detection and explanation generation. The system detects anomalies using AD techniques, then applies association rule mining to the time series data to generate human-readable explanations that clarify why certain events are classified as anomalies, thus preserving explanation clarity while maintaining detection capability
Solution Approach 2:
The patent segments the explanation generation process into distinct phases: (1) anomaly detection phase that identifies abnormal events, (2) association rule mining phase that discovers patterns in the data, and (3) explanation generation phase that combines results to produce clear explanations. This segmentation allows each phase to optimize for its specific function while contributing to overall explanation quality
2Adaptability or versatility
If user-defined thresholds are used for anomaly detection, then detection flexibility is improved, but explanation interpretability deteriorates
Solution Approach 1:
The patent changes the parameter representation from raw threshold values to association rule metrics (support, confidence, lift). Instead of presenting users with numerical thresholds that lack context, the system transforms these into interpretable rules with meaningful metrics that explain the relationships between features and anomalies, making explanations more understandable while preserving detection flexibility
3Ease of operation
If visual analysis methods are used for anomaly interpretation, then visual understanding is improved, but quantitative evaluation capability deteriorates
Solution Approach 1:
The patent merges visual analysis capabilities with quantitative association rule metrics. The system generates visual representations of anomalies while simultaneously providing quantitative measures (support, confidence, lift) that allow for precise evaluation and comparison of different anomalies and explanations, thus combining the strengths of both visual and quantitative approaches
Data Source
AI summary
One example method includes evaluating a set of itemsets, based on the evaluating, computing association rules corresponding to the itemsets, filtering the association rules to identify relevant association rules, sorting the relevant association rules according to their respective metrics of support, confidence, lift, and conviction, and the relevant association rules are sorted from best metrics to worst metrics, storing (1) best itemsets of the set of itemsets, and (2) the association rules with the best metrics, as thresholds, mapping the thresholds to the stored association rules and to feature-value ranges, and identifying the stored association rules and the feature-value ranges as root causes of an anomaly, and explanations of the anomaly, respectively.