Methods and apparatus for detecting anomalies in electronic data

• US 10,372,702 B2
• Filed: 12/28/2016
• Issued: 08/06/2019
• Est. Priority Date: 12/28/2016
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Harsha, Amith, Ashrafi, Ali
• Primary Examiner(s): Ly, Anh
• Application Number:
  US15/392,837
• Publication Number:
  US 20180181611A1
• Time in Patent Office: 951 Days
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/24578 using ranking

Abstract

Methods and apparatus for detecting anomalies in electronic data are described. An example apparatus includes a signature generator to generate a signature of context information for electronic transactions and to query a memorybase of previously received electronic transactions to identify a first entity associated with a subset of historical transactions that are associated with the signature, a neighborhood generator to query the memorybase to generate a neighborhood for the first entity, a target category identifier to determine a target category value for entities included in the neighborhood, and an anomaly detector to determine a score for the first entity based on the target category value and to present an alert indicating that the first entity is anomalous based on the score.

Claims

1. An apparatus to detect anomalies in electronic data, the apparatus comprising:

a signature generator to generate a signature of context information for electronic transactions and to query a memorybase of previously received electronic transactions to identify a first entity associated with a subset of historical transactions that are associated with the signature, wherein the memorybase is an associative memorybase and includes a first application programming interface to serve queries for connections and a second application programming interface to serve queries for analogies;

a neighborhood generator to query the memorybase to generate a neighborhood for the first entity;

a target category identifier to determine a target category value for entities included in the neighborhood; and

an anomaly detector to determine a score for the first entity based on the target category value and to present an alert indicating that the first entity is anomalous based on the score.

2. An apparatus as defined in claim 1, wherein the anomaly detector is further to take an action in response to detecting the first entity.

3. An apparatus as defined in claim 2, wherein the action includes preventing a transaction from the first entity.

4. An apparatus as defined in claim 1, further including a transaction extractor to receive a transaction from a client via a network.

5. An apparatus as defined in claim 4, further including a context extractor to receive context information associated with the transaction via the network.

6. An apparatus as defined in claim 1, wherein the signature generator is to transmit a query including the signature to the first application programming interface of the memorybase to identify the first entity.

7. An apparatus as defined in claim 6, wherein the query returns a plurality of entities.

8. An apparatus as defined in claim 1, wherein the neighborhood generator is to transmit a query including the first entity to the second application program interface to generate the neighborhood.

9. An apparatus as defined in claim 1, wherein the anomaly detector is to determine scores for a plurality of entities identified from the query of the memorybase of previously received electronic transactions.

10. A method to detect anomalies in electronic data, the method comprising:

generating a signature of context information for electronic transactions;

querying a memorybase of previously received electronic transactions to identify a first entity associated with a subset of historical transactions that are associated with the signature, wherein the memorybase is an associative memorybase and includes a first application programming interface to serve queries for connections and a second application programming interface to serve queries for analogies;

querying the memorybase to generate a neighborhood for the first entity;

determining a target category value for entities included in the neighborhood;

determining a score for the first entity based on the target category value; and

presenting an alert indicating that the first entity is anomalous based on the score.

11. A method as defined in claim 10, further including performing an action in response to detecting the first entity.

12. A method as defined in claim 11, wherein the action includes preventing a transaction from the first entity.

13. A method as defined in claim 10, further including receiving a transaction from a client via a network.

14. A method as defined in claim 13, further including receiving context information associated with the transaction via the network.

15. A method as defined in claim 10, further including transmitting a query including the signature to the first application programming interface of the memorybase to identify the first entity.

16. A method as defined in claim 15, wherein the query returns a plurality of entities.

17. A method as defined in claim 10, further including submitting a query including the first entity to the second application program interface to generate the neighborhood.

18. A method as defined in claim 17, further including determining scores for a plurality of entities identified from the query of the memorybase of previously received electronic transactions.

19. A non-transitory machine readable storage medium comprising instructions that, when executed, cause a machine to at least:

generate a signature of context information for electronic transactions;

query a memorybase of previously received electronic transactions to identify a first entity associated with a subset of historical transactions that are associated with the signature, wherein the memorybase is an associative memorybase and includes a first application programming interface to serve queries for connections and a second application programming interface to serve queries for analogies;

query the memorybase to generate a neighborhood for the first entity;

determine a target category value for entities included in the neighborhood;

determine a score for the first entity based on the target category value; and

present an alert indicating that the first entity is anomalous based on the score.

20. A non-transitory machine readable storage medium as defined in claim 19, wherein the instructions, when executed, cause the machine to perform an action in response to detecting the first entity.

21. A non-transitory machine readable storage medium as defined in claim 20, wherein the action includes preventing a transaction from the first entity.

22. A non-transitory machine readable storage medium as defined in claim 19, wherein the instructions, when executed, cause the machine to receive a transaction from a client via a network.

23. A non-transitory machine readable storage medium as defined in claim 22, wherein the instructions, when executed, cause the machine to receive context information associated with the transaction via the network.