Organization Segmentation for Anomaly Detection Threshold Tuning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems face challenges in setting optimal threshold values for generating alerts, leading to false positives or false negatives, especially when dealing with diverse environments and data from various sources, such as different countries or organizational practices.
Innovation Solution
A system that groups organizations with similar features into segments, trains a neural network model for each segment to analyze events, and provides a decision score to determine anomaly priority, allowing for tailored threshold tuning and efficient anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single threshold profile is used for all organizations, then the system complexity is reduced and ease of operation is improved, but the measurement precision and reliability of anomaly detection deteriorate due to environmental differences
Solution Approach 1:
The patent segments organizations into different groups based on their environmental characteristics (geography, industry, size, etc.). Each segment receives a customized threshold profile trained on segment-specific data, allowing the system to maintain high detection accuracy across diverse environments while automatically managing the complexity through unsupervised clustering algorithms.
2Reliability
If threshold values are tuned aggressively to reduce false negatives, then the reliability of anomaly detection is improved, but the quantity of false positives increases leading to resource overload
Solution Approach 1:
The patent applies local quality by creating segment-specific threshold profiles that are optimized for each organization group's characteristics. Instead of using a uniform threshold across all organizations, each segment has locally optimized thresholds that account for their specific operational patterns and environmental factors, reducing both false positives and false negatives simultaneously.
3Measurement precision
If custom threshold tuning is performed for each organization to account for local features, then the measurement precision is improved, but the device complexity and difficulty of operation increase significantly
Solution Approach 1:
The patent performs preliminary action by automatically segmenting organizations and training threshold profiles for each segment before actual anomaly detection begins. The system pre-processes organizational metadata, performs clustering, and generates optimized threshold profiles in advance, eliminating the need for manual threshold tuning by operators while maintaining high detection accuracy.
4Adaptability or versatility
If more training data is collected from diverse organizations to improve model generalization, then the adaptability is improved, but the difficulty of detecting and measuring optimal thresholds increases due to environmental heterogeneity
Solution Approach 1:
The patent addresses the difficulty of threshold optimization with diverse data by segmenting the heterogeneous dataset into homogeneous groups. This segmentation transforms the complex problem of finding a single optimal threshold across diverse environments into multiple simpler problems of finding optimal thresholds for each segment, where environmental heterogeneity is minimized within each group.
Data Source
AI summary
A method of detecting and handling anomalies in a network, including, collecting meta-data related to an environment of each organization using the network; wherein each organization deploys one or more computers connected to the network, extracting features from the meta-data, clustering organizations having common features into segments, collecting training data from all organizations, grouping the training data according to the segments, training a model for each segment with event data to detect and handle anomalies, analyzing event data of a segment with a respective model for that segment, providing a decision score responsive to the analyzing; and handling the anomaly based on the decision score.