Interpretable Supervised Anomaly Detection for Decision Reasoning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning-based anomaly detection systems are opaque and lack the ability to provide reasoning behind their decisions, leading to hesitancy in their adoption and suboptimal security practices.
Innovation Solution
Implement an interpretable supervised anomaly detection model in conjunction with an unsupervised model to determine anomaly decisions and provide reasons for those decisions using ensemble techniques and self-supervision, enhancing transparency and accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning-based anomaly detection models are used to improve detection accuracy, then anomaly detection capability is improved, but the system becomes opaque and lacks explainability
Solution Approach 1:
The patent introduces an interpretable supervised anomaly detection model as an intermediary component that translates the opaque decisions of the unsupervised model into explainable reasoning. This mediator model takes the same input features, learns from labeled anomaly data, and produces both detection decisions and human-readable explanations, thereby bridging the gap between high accuracy and interpretability
Solution Approach 2:
The system segments the anomaly detection function into two separate models: an unsupervised model for high-accuracy anomaly detection and a supervised interpretable model for explanation generation. Each model performs a specific function, with the unsupervised model handling detection and the supervised model handling explanation, allowing both requirements to be satisfied simultaneously
2Reliability
If unsupervised anomaly detection models are used to avoid bad actor evasion techniques, then detection accuracy is improved, but the system complexity increases and becomes cumbersome
Solution Approach 1:
The interpretable supervised model serves multiple functions: it acts as an alternative detection model, provides explanations for unsupervised model decisions, and can be trained using both labeled and unlabeled data through self-supervision. This multi-functionality reduces overall system complexity by consolidating multiple needs into a single model component
3Reliability
If machine learning-based anomaly detection solutions are deployed to identify anomalous activity, then security against fraudulent activity is improved, but employee and customer usability experience deteriorates due to lack of transparency
Solution Approach 1:
The system provides feedback to users by generating human-readable explanations that detail why a transaction or access attempt was flagged as anomalous. This feedback mechanism allows employees and customers to understand the security decisions, improving usability experience while maintaining strong security through the unsupervised model's sophisticated detection capabilities
Data Source
AI summary
Techniques are provided for determining reasons for unsupervised anomaly decisions. One method comprises obtaining values of predefined features associated with a remote user device; applying the predefined feature values to an unsupervised anomaly detection model that generates an unsupervised anomaly decision; applying the predefined feature values to a supervised anomaly detection model that generates a supervised anomaly decision; determining a third anomaly decision using the unsupervised anomaly decision; and determining reasons for the third anomaly decision by analyzing the supervised anomaly decision. The supervised anomaly detection model can be trained using the unsupervised anomaly decision and/or anomalous training data based on known anomalies. The third anomaly decision can be based on the supervised anomaly decision and the unsupervised anomaly decision using ensemble techniques.