AUTOMATIC GENERATION OF TRAINING DATA FOR ANOMALY DETECTION USING OTHER USER'S DATA SAMPLES
First Claim
Patent Images
1. A method, comprising:
- for a system or application used by a plurality of users, providing an access to a memory device storing user data samples for all users of the plurality of users;
selecting a target user from among the plurality of users; and
using a processor on a computer and using data samples for the target user and data samples for other users of the plurality of users, generating a normal sample data set and an abnormal (anomalous) sample data set to serve as a training data set for training a model for an anomaly detection monitor for the target user.
3 Assignments
0 Petitions
Accused Products
Abstract
A method (and structure) generates a classifier for an anomalous detection monitor for a target user on a system or application used by a plurality of users and includes providing an access to a memory device storing user data samples for all users of the plurality of users. A target user is selected from among the plurality of users. Data samples for the target user and data samples for other users of the plurality of users are used to generate a normal sample data set and an abnormal (anomalous) sample data set to serve as a training data set for training a model for an anomaly detection monitor for the target user.
-
Citations
20 Claims
-
1. A method, comprising:
-
for a system or application used by a plurality of users, providing an access to a memory device storing user data samples for all users of the plurality of users; selecting a target user from among the plurality of users; and using a processor on a computer and using data samples for the target user and data samples for other users of the plurality of users, generating a normal sample data set and an abnormal (anomalous) sample data set to serve as a training data set for training a model for an anomaly detection monitor for the target user. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11)
-
-
12. An apparatus, comprising:
-
a memory device; and a processor having access to the memory device, the memory device storing a series of machine-readable instructions to execute a method of generating a normal sample data set and an abnormal (anomalous) sample data set to serve as a classifier for training a model for an anomalous detection monitor for a target user, the target user being one of a plurality of users sharing a system or application, wherein the method comprises; providing an access to a memory device storing user data samples for all users of the plurality of users; selecting a target user from among the plurality of users; and using the processor to generate the normal sample data set and the abnormal sample data set using data samples for the target user and data samples for other users of the plurality of users. - View Dependent Claims (13, 14, 15, 16, 17)
-
-
18. An anomaly detector, as executed by a processor on a computer, the anomaly detector comprising a monitor for detecting anomalous behavior by any user of a plurality of users sharing a system or application, the anomaly detector comprising:
-
an input receiving data related to a current operation of the system or application by the users; a monitor module for each user as a target user, the monitor module for each target user executing a model of the target user to detect whether the target user'"'"'s current operation of the system or application comprises anomalous behavior; and an output to provide an alert signal if any user is detected as demonstrating anomalous behavior, wherein the model for each target user is developed from a classifier based on a normal sample data set and an abnormal sample data set for the target user, and wherein data samples for the target user and data samples for other users of the plurality of users are used to generate the normal sample data set and the abnormal sample data set to serve as a classifier for training the model for the anomalous detection monitor module for the target user. - View Dependent Claims (19, 20)
-
Specification