Event anomaly analysis and prediction

Patent metadata

Field	Value
Publication number	US-2016371489-A1
Application number	US-201615184607-A
Country	US
Kind code	A1
Filing date	Jun 16, 2016
Priority date	Jun 17, 2015
Publication date	Dec 22, 2016
Grant date	—

Abstract

According to an example, event anomaly analysis and prediction may include accessing a master directed graph that specifies known events and transitions between the known events, and ranking each of the known events. Each of the ranked known events may be clustered into a plurality of anomaly categories. A plurality of rules to analyze new events may be determined based on the plurality of anomaly categories. A determination may be made, based on an application of the plurality of rules to data that is to be analyzed for an anomaly, whether the data includes the anomaly. In response to a determination that the data includes the anomaly, a device associated with the data may be controlled.

First claim

What is claimed is:

1 . An event anomaly analysis and prediction apparatus comprising:
a processor; and a memory storing machine readable instructions that when executed by the processor cause the processor to:
access at least one master directed graph that specifies known events and transitions between the known events;
rank each of the known events, wherein
the ranking of each of the known events is based on a probability of anomalousness assigned to each of the known events, and
the probability of anomalousness assigned to a known event of the known events is determined relative to each of the other known events;

cluster each of the ranked known events into a plurality of anomaly categories;
determine, based on the plurality of anomaly categories, a plurality of rules to analyze new events;
access data that is to be analyzed for an anomaly;
determine, based on an application of the plurality of rules to the data, whether the data includes the anomaly; and
in response to a determination that the data includes the anomaly, control a device associated with the data.

2 . The event anomaly analysis and prediction apparatus according to claim 1 , wherein the machine readable instructions to rank each of the known events further comprise machine readable instructions to cause the processor to:
rank each of the known events in an ascending order in accordance with the probability of anomalousness assigned to each of the known events.

3 . The event anomaly analysis and prediction apparatus according to claim 2 , wherein the machine readable instructions to rank each of the known events further comprise machine readable instructions to cause the processor to:
identify a most anomalous known event as an event with a lowest probability of occurrence associated with the ranking of each of the known events.

4 . The event anomaly analysis and prediction apparatus according to claim 1 , wherein the machine readable instructions to cluster each of the ranked known events into the plurality of anomaly categories further comprise machine readable instructions to cause the processor to:
cluster each of the ranked known events into the plurality of anomaly categories that include at least two of a very-high, a high, a medium, a low, and a very-low probability of being an anomaly.

5 . The event anomaly analysis and prediction apparatus according to claim 1 , wherein the machine readable instructions to cluster each of the ranked known events into the plurality of anomaly categories further comprise machine readable instructions to cause the processor to:
apply k-means clustering to cluster each of the ranked known events into the plurality of anomaly categories.

6 . The event anomaly analysis and prediction apparatus according to claim 1 , wherein the machine readable instructions to determine, based on the application of the plurality of rules to the data, whether the data includes the anomaly further comprise machine readable instructions to cause the processor to:
determine, based on the master directed graph, a baseline activity graph; determine, based on the data, a real-time activity graph; and compare the baseline activity graph to the real-time activity graph to determine whether the data includes the anomaly.

7 . The event anomaly analysis and prediction apparatus according to claim 6 , wherein the machine readable instructions to compare the baseline activity graph to the real-time activity graph to determine whether the data includes the anomaly further comprise machine readable instructions to cause the processor to:
determine if the real-time activity graph includes an event that is not present in the baseline activity graph.

8 . The event anomaly analysis and prediction apparatus according to claim 6 , wherein the machine readable instructions to compare the baseline activity graph to the real-time activity graph to determine whether the data includes the anomaly further comprise machine readable instructions to cause the processor to:
determine if the real-time activity graph includes a transition between events that is not present in the baseline activity graph.

9 . A method for event anomaly analysis and prediction, the method comprising:
accessing at least one master directed graph that specifies known events and transitions between the known events; ranking each of the known events, wherein
the ranking of each of the known events is based on a probability of anomalousness assigned to each of the known events, and
the probability of anomalousness assigned to a known event of the known events is determined relative to each of the other known events;
clustering each of the ranked known events into a plurality of anomaly categories; determining, based on the plurality of anomaly categories, a plurality of rules to analyze new events; accessing data that is to be analyzed for anomalies; identifying, based on an application of the plurality of rules to the data, selected ones of the anomalies in the data; determining, for the data, a plurality of objects of different sizes that represent different ones of the selected ones of the anomalies; and generating a display of the plurality of objects.

10 . The method according to claim 9 , further comprising:
controlling, based on the identified selected ones of the anomalies in the data, a device associated with the data.

11 . The method according to claim 9 , further comprising:
filtering the master directed graph by removing edges for which a number of times an event sequence has transitioned between nodes that are associated with the edges to be removed is less than a specified threshold, wherein a node represents a known event of the master directed graph, and an edge represents a transition between associated known events.

12 . The method according to claim 9 , wherein ranking each of the known events further comprises:
ranking each of the known events in an ascending order in accordance with the probability of anomalousness assigned to each of the known events.

13 . The method according to claim 12 , wherein ranking each of the known events further comprises:
identifying a most anomalous known event as an event with a lowest probability of occurrence associated with the ranking of each of the known events.

14 . The method according to claim 9 , wherein clustering each of the ranked known events into the plurality of anomaly categories further comprises:
clustering, by applying k-means clustering, each of the ranked known events into the plurality of anomaly categories that include at least two of a very-high, a high, a medium, a low, and a very-low probability of being an anomaly.

15 . A non-transitory computer readable medium having stored thereon machine readable instructions for event anomaly analysis and prediction, the machine readable instructions, when executed, cause a processor to:
access at least one master directed graph that specifies known events and transitions between the known events; rank each of the known events, wherein
the ranking of each of the known events is based on a probability of anomalousness assigned to each of the known events, and
the probability of anomalousness assigned to a known event of the known events is determined relative to each of the other known events;
cluster each of the ranked known events into a plurality of anomaly categories; determine, based on the plurality of anomaly categories, a plurality of rules to analyze new events; access data that is to be analyzed for an anomaly; determine, based on an application of the plurality

Assignees

• Accenture Global Services Ltd

Inventors

• Puri Colin Anil
• Joyce Patrick
• Humpert Brandon Eugene
• Johnson Stephen David
• Craighead Jonte Demetrio

Classifications

• G06N99/005

  Physics · mapped topic

• G06F17/30563

  Physics · mapped topic

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06N20/00 Primary

  Machine learning · CPC title