Large-scale anomaly detection with relative density-ratio estimation

Patent metadata

Field	Value
Publication number	US-2016253598-A1
Application number	US-201514634515-A
Country	US
Kind code	A1
Filing date	Feb 27, 2015
Priority date	Feb 27, 2015
Publication date	Sep 1, 2016
Grant date	—

Abstract

In one embodiment, a set of training data consisting of inliers may be obtained. A supervised classification model may be trained using the set of training data to identify outliers. The supervised classification model may be applied to generate an anomaly score for a data point. It may be determined whether the data point is an outlier based, at least in part, upon the anomaly score.

First claim

What is claimed is:

1 . A method, comprising:
obtaining a set of training data consisting of inliers; training a supervised classification model using the set of training data to identify outliers; applying the supervised classification model to generate an anomaly score for a data point; and determining whether the data point is an outlier based, at least in part, upon the anomaly score.

2 . The method as recited in claim 1 , wherein the supervised classification model comprises a supervised two-class classification model that estimates a relative importance measure, the relative importance measure being a ratio of training and test data densities.

3 . The method as recited in claim 1 , wherein the supervised classification model comprises a gradient boosted decision tree (GBDT) algorithm.

4 . The method as recited in claim 1 , wherein the supervised classification model performs feature selection to select one or more features upon which to generate anomaly scores for data points.

5 . The method as recited in claim 1 , wherein the set of training data comprises email account data corresponding to non-spammers, and wherein determining whether the data point is an outlier comprises determining whether the data point is a compromised email account.

6 . The method as recited in claim 1 , wherein the set of training data comprises images of semiconductors, and wherein determining whether the data point is an outlier comprises determining whether the data point corresponds to a faulty semiconductor.

7 . The method as recited in claim 1 , wherein the set of training data comprises speaker data.

8 . An apparatus, comprising:
a processor; and a memory storing thereon computer-readable instructions, the computer-readable instructions being configured to: obtain a set of training data consisting of inliers; train a supervised classification model using the set of training data to identify outliers; apply the supervised classification model to generate an anomaly score for a data point; and determine whether the data point is an outlier based, at least in part, upon the anomaly score.

9 . The apparatus as recited in claim 8 , wherein the supervised classification model comprises a supervised two-class classification model that estimates a relative importance measure, the relative importance measure being a ratio of training and test data densities.

10 . The apparatus as recited in claim 8 , wherein the supervised classification model comprises a gradient boosted decision tree (GBDT) algorithm.

11 . The apparatus as recited in claim 8 , wherein the supervised classification model performs feature selection to select one or more features upon which to generate anomaly scores for data points.

12 . The apparatus as recited in claim 8 , wherein the set of training data comprises email account data corresponding to non-spammers, and wherein determining whether the data point is an outlier comprises determining whether the data point is a compromised email account.

13 . The apparatus as recited in claim 8 , wherein the set of training data comprises images of semiconductors, and wherein determining whether the data point is an outlier comprises determining whether the data point corresponds to a faulty semiconductor.

14 . The apparatus as recited in claim 8 , wherein the set of training data comprises speaker data.

15 . A non-transitory computer-readable storage medium, comprising:
instructions for obtaining a set of training data consisting of inliers; instructions for training a supervised classification model using the set of training data to identify outliers; instructions for applying the supervised classification model to generate an anomaly score for a data point; and instructions for determining whether the data point is an outlier based, at least in part, upon the anomaly score.

16 . The non-transitory computer-readable storage medium as recited in claim 15 , wherein the supervised classification model comprises a supervised two-class classification model that estimates a relative importance measure, the relative importance measure being a ratio of training and test data densities.

17 . The non-transitory computer-readable storage medium as recited in claim 15 , wherein the supervised classification model comprises a gradient boosted decision tree (GBDT) algorithm.

18 . The non-transitory computer-readable storage medium as recited in claim 15 , wherein the supervised classification model performs feature selection to select one or more features upon which to generate anomaly scores for data points.

19 . The non-transitory computer-readable storage medium as recited in claim 15 , wherein the set of training data comprises email account data corresponding to non-spammers, and wherein determining whether the data point is an outlier comprises determining whether the data point is a compromised email account.

20 . The non-transitory computer-readable storage medium as recited in claim 15 , wherein the set of training data comprises image data or speaker data.

Assignees

• Yahoo Inc

Inventors

• Yamada Makoto
• Qin Chao
• Ouyang Hua
• Thomas Achint
• Chang Yi

Classifications

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06N20/00 Primary

  Machine learning · CPC title

• G06N99/005 Primary

  Physics · mapped topic

• G06N20/20 Primary

  Ensemble learning · CPC title

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title