GRU Time-Series Anomaly Detection for Transaction Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting anomalies in large volumes of transaction data is challenging due to the predominance of normal data, which can lead to undiscovered errors in recurrent transactions, such as payroll, resulting in unnecessary cash outflows and fraudulent activities.
Innovation Solution
A method using a gated recurrent unit (GRU) network to learn the data distribution of transactional time series, predict expected future values, and set upper and lower bounds based on standard deviation, comparing new data entries to these bounds to identify anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If traditional anomaly detection methods are used on large volumes of transaction data, then the system can process the data volume, but the detection precision deteriorates because normal data comprises the majority and anomalies are like finding a needle in a haystack
Solution Approach 1:
The system performs preliminary learning of normal data distribution patterns using GRU networks before actual anomaly detection. By pre-training on historical normal transaction data to establish baseline patterns and expected ranges, the system prepares detection thresholds in advance, enabling precise identification of anomalies when they occur in large data volumes.
Solution Approach 2:
The GRU network acts as an intermediary between raw transaction data and anomaly detection. It processes and transforms raw data into learned distribution patterns and predicted ranges, serving as a mediator that extracts meaningful patterns from the majority normal data to facilitate precise anomaly detection amidst large volumes of transactions.
2Productivity
If simple typographical errors in payroll data are not identified, then data processing continues smoothly, but harmful effects occur resulting in large unnecessary cash outflows
Solution Approach 1:
The system implements continuous feedback by comparing new transaction data against learned normal patterns from historical data. When deviations occur beyond established thresholds, the system generates error notifications that provide immediate feedback, enabling timely correction of typographical errors before they result in harmful cash outflows while maintaining processing continuity.
Solution Approach 2:
The system takes preliminary anti-action by establishing detection thresholds and bounds based on learned normal data distributions before anomalies occur. This proactive approach prevents harmful effects by having detection mechanisms ready in advance to identify and flag errors like typographical mistakes in payroll data before they can cause large unnecessary cash outflows.
3Measurement precision
If a GRU network is used to learn data distribution and predict future values with upper and lower bounds, then anomaly detection precision improves, but device complexity increases
Solution Approach 1:
The system uses lightweight GRU network models that can be trained once on historical data and then deployed for continuous detection. The model serves as a disposable learning component that establishes detection thresholds and then repeatedly applies these thresholds to new data streams, providing high precision detection without requiring continuously complex computational resources.
Data Source
AI summary
A system includes one or more processors, coupled with memory, to identify, from a data repository, one or more states corresponding to a distribution of data learned by a neural network model, the neural network model trained using non-anomalous entries of a transaction type. The one more processors generate a plurality of predicted values based on the non-anomalous entries and the one or more states. The one or more processors determine an error range including an upper bound and a lower bound for the transaction type. The one or more processors receive an additional data entry of the transaction type. The one or more processors detect an anomaly by comparing a value of the additional data entry with the error range. The one or more processors cause, responsive to detection of the anomaly, a display, on a display device, of a notification that corresponds to the detected anomaly.