Anomaly Detection by Multi-Level Tolerance Relations

Trevor Martin (Inventor), Ben Azvine (Inventor)

Research output: Patent

Abstract

A method for partitioning a plurality of entities each associated with a plurality of ordered sequences of events received by a computer system, the method comprising: defining a minimal directed acyclic graph data structure representing the sequences of events to define a plurality of categories of behaviour of the entities; defining a threshold degree of similarity as an xmu number, the xmu number having cardinality that is able to vary across a normalised range; defining a relation for each entity including a degree of association of the entity with each of the categories; defining a cluster of entities as a set of entities comprising a first entity; and comparing a relation for the first entity with a relation for a second entity to define a xmu Jaccard similarity coefficient for the first and second entities; responsive to the coefficient meeting the threshold degree of similarity, adding the second entity to the cluster.
Original languageEnglish
Patent numberWO2016156115
Priority date27/03/15
Publication statusPublished - 6 Oct 2016

Fingerprint Dive into the research topics of 'Anomaly Detection by Multi-Level Tolerance Relations'. Together they form a unique fingerprint.

Cite this