Extraction of anomaly related rules using data mining and machine learning

Patent metadata

Field	Value
Publication number	US-11568181-B2
Application number	US-201916260679-A
Country	US
Kind code	B2
Filing date	Jan 29, 2019
Priority date	Jan 29, 2019
Publication date	Jan 31, 2023
Grant date	Jan 31, 2023

Abstract

Techniques are provided for extracting anomaly related rules from organizational data. One method comprises obtaining anomaly analysis data integrated from multiple data sources of an organization, wherein the multiple data sources comprise at least one set of labeled anomaly data related to anomalous transactions; extracting features from the integrated anomaly analysis data that correlate with an indication of an anomaly; training multiple machine learning models using the extracted features, where the machine learning models are trained using different combinations of the extracted features; evaluating a performance of the trained machine learning models; and extracting rules from the trained machine learning models based on the performance, wherein the extracted rules are used to classify transactions as anomalous. The trained machine learning models comprise a decision tree comprising paths to an anomaly classification. The extracted rules are optionally in a human-readable format.

First claim

What is claimed is:

1. A method, comprising:
A method, comprising:
obtaining anomaly analysis data integrated from a plurality of data sources of an organization, wherein the plurality of data sources comprises at least one set of labeled anomaly data comprising information related to transactions that have been labeled as anomalous transactions;
extracting features from the integrated anomaly analysis data that correlate with an indication of an anomaly, based on predefined correlation criteria;
initiating a training, using at least one processing device, of a plurality of machine learning models using the extracted features, wherein each of the plurality of machine learning models is trained using different combinations of the extracted features, wherein one or more of the trained machine learning models comprise at least one decision tree, wherein the at least one decision tree comprises a plurality of paths to an anomaly classification, wherein each path comprises a logical combination of conditions to a leaf node;
evaluating a performance of the plurality of trained machine learning models; and
extracting one or more rules from one or more of the trained machine learning models based on the performance, wherein the extracted one or more rules are used to classify transactions as anomalous, wherein each extracted rule is associated with a given leaf node of the at least one decision tree and is extracted by aggregating the conditions associated with at least some of the nodes in the at least one decision tree along the respective path to the given leaf node;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

2. The method of claim 1 , wherein an integration of the anomaly analysis data from the plurality of data sources of an organization comprises one or more of merging tables, removing irrelevant information and removing redundant information.

3. The method of claim 1 , wherein the extracted features comprise at least one engineered feature relevant to anomaly classification based on domain knowledge.

4. The method of claim 1 , wherein the extracted features comprise one or more of contact information features; online activity features and order processing features.

5. The method of claim 1 , wherein the anomaly classification comprises a predefined significance.

6. The method of claim 1 , wherein one or more properties of the extracted one or more rules are tunable by a user.

7. The method of claim 1 , further comprising the step of adjusting a distribution of instances of at least one label in the anomaly analysis data to address an imbalance of the at least one label.

8. The method of claim 1 , wherein one or more of the extracted rules are in a human-readable format for one or more of configuration and modification by a user.

9. A system, comprising:
a memory; and
at least one processing device, coupled to the memory, operative to implement the following steps:
obtaining anomaly analysis data integrated from a plurality of data sources of an organization, wherein the plurality of data sources comprises at least one set of labeled anomaly data comprising information related to transactions that have been labeled as anomalous transactions;
extracting features from the integrated anomaly analysis data that correlate with an indication of an anomaly, based on predefined correlation criteria;
initiating a training, using at least one processing device, of a plurality of machine learning models using the extracted features, wherein each of the plurality of machine learning models is trained using different combinations of the extracted features, wherein one or more of the trained machine learning models comprise at least one decision tree, wherein the at least one decision tree comprises a plurality of paths to an anomaly classification, wherein each path comprises a logical combination of conditions to a leaf node;
evaluating a performance of the plurality of trained machine learning models; and
extracting one or more rules from one or more of the trained machine learning models based on the performance, wherein the extracted one or more rules are used to classify transactions as anomalous, wherein each extracted rule is associated with a given leaf node of the at least one decision tree and is extracted by aggregating the conditions associated with at least some of the nodes in the at least one decision tree along the respective path to the given leaf node.

10. The system of claim 9 , wherein an integration of the anomaly analysis data from the plurality of data sources of an organization comprises one or more of merging tables, removing irrelevant information and removing redundant information.

11. The system of claim 9 , wherein the extracted features comprise at least one engineered feature relevant to anomaly classification based on domain knowledge.

12. The system of claim 9 , wherein the anomaly classification comprises a predefined significance.

13. The system of claim 9 , wherein one or more properties of the extracted one or more rules are tunable by a user.

14. The system of claim 9 , wherein one or more of the extracted rules are in a human-readable format for one or more of configuration and modification by a user.

15. A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:
obtaining anomaly analysis data integrated from a plurality of data sources of an organization, wherein the plurality of data sources comprises at least one set of labeled anomaly data comprising information related to transactions that have been labeled as anomalous transactions;
extracting features from the integrated anomaly analysis data that correlate with an indication of an anomaly, based on predefined correlation criteria;
initiating a training, using at least one processing device, of a plurality of machine learning models using the extracted features, wherein each of the plurality of machine learning models is trained using different combinations of the extracted features, wherein one or more of the trained machine learning models comprise at least one decision tree, wherein the at least one decision tree comprises a plurality of paths to an anomaly classification, wherein each path comprises a logical combination of conditions to a leaf node;
evaluating a performance of the plurality of trained machine learning models; and
extracting one or more rules from one or more of the trained machine learning models based on the performance, wherein the extracted one or more rules are used to classify transactions as anomalous, wherein each extracted rule is associated with a given leaf node of the at least one decision tree and is extracted by aggregating the conditions associated with at least some of the nodes in the at least one decision tree along the respective path to the given leaf node.

16. The computer program product of claim 15 , wherein an integration of the anomaly analysis data from the plurality of data sources of an organization comprises one or more of merging tables, removing irrelevant information and removing redundant information.

17. The computer program product of claim 15 , wherein the extracted features comprise at least one engineered feature relevant to anomaly classification based on domain knowledge.

18. The computer program product of claim 15 , wherein th

Assignees

• Emc Ip Holding Co Llc

Inventors

• Sagi Omer
• Savir Amihai
• Gefen Avitan

Classifications

• G06K9/6262

  Physics · mapped topic

• G06V10/98

  Detection or correction of errors, e.g. by rescanning the pattern or by human intervention; Evaluation of the quality of the acquired patterns · CPC title

• G06N20/20

  Ensemble learning · CPC title

• G06K9/6267 Primary

  Physics · mapped topic

• G06F18/24

  Classification techniques · CPC title