Lookahead Pair Anomaly Detection Without Manual Behavior Labeling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems in online platforms require extensive manual labeling of normal versus anomalous behavior, making them resource-intensive and impractical, especially in high-throughput systems, and unsupervised models risk misinterpreting anomalies due to learning from erroneous data.
Innovation Solution
Anomaly detection using lookahead pairs (LAPs) generated from unlabeled sequences of user actions, stored in an unsupervised LAP database, flags anomalies based on frequency thresholds and absence from the database, reducing false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If supervised learning models are used for anomaly detection, then detection accuracy can be improved, but extensive manual labeling of normal versus anomalous behavior is required, making the system resource-intensive and impractical
Solution Approach 1:
Instead of manually labeling anomalous behavior as done in supervised learning, the patent inverts the approach by automatically learning normal behavior patterns from unlabeled data and flagging deviations as anomalies. The system generates lookahead pairs from unlabeled sequences and uses frequency thresholds to identify anomalies without requiring any manual labeling, thus achieving practical scalability while maintaining detection capability
Solution Approach 2:
The system performs self-service by automatically generating training data through lookahead pair generation from unlabeled sequences. The anomaly detection model trains itself on synthesized normal behavior patterns and autonomously identifies anomalies using frequency-based thresholds, eliminating the need for external manual labeling resources
2Productivity
If unsupervised models are used for anomaly detection, then resource requirements are reduced, but the models risk misinterpreting anomalies due to learning from erroneous data
Solution Approach 1:
The patent segments the sequence data into discrete lookahead pairs with specific structures (origin action, gap actions, target action). This segmentation creates well-defined training units that capture temporal relationships without the complexity of full sequence processing, enabling efficient unsupervised learning while maintaining reliable pattern recognition through structured data organization
Solution Approach 2:
The system changes parameters by using frequency thresholds and observation counts as quantitative criteria for anomaly detection. Instead of relying on complex unsupervised learning interpretations, the patent transforms the problem into a parameter-based decision system where anomalies are identified by their frequency characteristics, improving reliability through objective measurable criteria
3Measurement precision
If frequency thresholds are used for anomaly detection, then false positives and negatives are reduced, but the system requires a LAP database with historical data
Solution Approach 1:
The system performs preliminary action by pre-processing unlabeled sequences into lookahead pairs and storing them in a LAP database with frequency counts before actual anomaly detection occurs. This preliminary organization of data into structured pairs with observation metrics enables efficient threshold-based detection without requiring extensive raw historical data during operation
Data Source
AI summary
Systems and methods for detecting anomalies in sequences of actions using lookahead pairs (LAPs) are disclosed. An example method is performed by one or more processors of an unsupervised anomaly detection system and includes receiving, over a communications network, a sequence of actions, generating one or more LAPs of interest based on the received sequence of actions, each LAP of interest indicating a target action, an origin action, and a number of gap actions, and selectively flagging the LAPs of interest as anomalies based on whether they appear in a LAP database, the selective flagging including refraining from flagging the LAP of interest as an anomaly if it is associated with a number of observances greater than a threshold, and flagging the LAP as an anomaly if it is associated with a number of observances less than the threshold or if the LAP does not appear in the LAP database.