Capital One Services, LLC

Vannia Gonzalez Macias

Scott Garcia

Peter Terrana

Paul Cho

Rahul Gupta

Adithya Ramanathan

Sarvani Kare

Patrick Sofo

Boshika Tara

Justin Essert

Pratik Gandhi

Stephen Fletcher

Farshid Marbouti

Michael Langford

Alan Rozet

Zhengqing Liu

Mark Roberts

Urvish Patel

Mengfei Shao

Adam Beauregard

Michal Hyrc

Talha Koc

Prarthana Bhattarai

Phanindra Rao

Mark Davis

Methods and systems are described herein for detecting anomalous access to system resources. An anomaly detection system may access system events from one or more computing devices and may generate entries from the system events. Each entry may include a corresponding timestamp indicating a time when a corresponding system event occurred, a corresponding user identifier indicating a user account within a computing environment associated with the corresponding system event, a corresponding location identifier indicating a location within the computing environment, and a corresponding action identifier indicating an action that the user account performed with respect to the location or an object within the computing environment. The generated entries may be aggregated and input into an anomaly detection model to obtain anomalous activity identified by the model.

Anomaly detection in computing system events

Methods and systems are described herein for facilitating generation of synthetic datasets having anomalies. The system may receive a command to generate a synthetic time series dataset. The system may generate data points for components of the synthetic dataset, the components including a seasonality function, a trend function, and a noise function. The system may determine minimum and maximum changes relative to the variance of the noise data points. The system may generate anomalies by replacing values of one or more noise data points with values between the minimum and maximum changes. The system may then generate the synthetic time series dataset having anomalies by combining the seasonality data points, the trend data points, and the noise data points into corresponding time slots of the synthetic time series dataset.

Generating synthetic time series datasets having anomalies

Methods and systems are described herein for facilitating generation of synthetic datasets having a change point. The system may receive a command to generate a synthetic time series dataset. The system may generate data points for components of the synthetic dataset, the components including a seasonality function, a trend function, and a noise function. The system may modify the trend function to a different trend function by modifying a level or a slope of the trend function. The system may generate a change point by replacing a subset of consecutive data points generated using the trend function with consecutive data points generated using the different trend function. The system may then generate the synthetic time series dataset having a change point by combining the seasonality data points, the trend data points, and the noise data points into corresponding time slots of the synthetic time series dataset.

Generating synthetic time series datasets having change points

Methods and systems are described herein for improving anomaly detection in timeseries datasets. Different machine learning models may be trained to process specific types of timeseries data efficiently and accurately. Thus, selecting a proper machine learning model for identifying anomalies in a specific set of timeseries data may greatly improve accuracy and efficiency of anomaly detection. Another way to improve anomaly detection is to process a multitude of timeseries datasets for a time period (e.g., 90 days) to detect anomalies from those timeseries datasets and then correlate those detected anomalies by generating an anomaly timeseries dataset and identifying anomalies within the anomaly timeseries dataset. Yet another way to improve anomaly detection is to divide a dataset into multiple datasets based on a type of anomaly detection requested.

Anomaly detection in a split timeseries dataset

Methods and systems are disclosed herein for using anomaly detection in timeseries data of user sentiment to detect incidents in computing systems and identify events within an enterprise. An anomaly detection system may receive social media messages that include a timestamp indicating when each message was published. The system may generate sentiment identifiers for the social media messages. The sentiment identifiers and timestamps associated with the social media messages may be used to generate a timeseries dataset for each type of sentiment identifier. The timeseries datasets may be input into an anomaly detection model to determine whether an anomaly has occurred. The system may retrieve textual data from the social media messages associated with the detected anomaly and may use the text to determine a computing system or event associated with the detected anomaly.

Detecting system events based on user sentiment in social media messages

Methods and systems are described herein for determining auxiliary parameters within datasets, the auxiliary parameters being used to segregate the datasets such that anomaly detection may be performed on the segregated datasets. Based on anomaly detection, alert conditions may then be identified. In particular, a system may, using a machine learning model, determine for a particular target feature (e.g., a parameter being monitored) one or more auxiliary features (other parameters) that effect the values of that parameter and transmit the target feature and the auxiliary features in a message to a monitoring system indicating which features to monitor. The collected data may then be received by the system and transformed into a timeseries dataset, which may then be used to detect anomalies within the data and thereby identify any anomalous points.

Automatic selection of data for target monitoring

Methods and systems are disclosed for using a feature hierarchy with multiple levels with a different number of features at different levels to segment a dataset. The mechanism may use the first level of the hierarchy to segment a dataset into multiple datasets and then generate a timeseries dataset for each segment. Those timeseries datasets may be input into an anomaly detection model to identify a number of anomalies detected within those segments. Based on the number of anomalies not reaching a threshold, a second level of the hierarchy may be used to segment the dataset. Those segments may be input into the anomaly detection model to determine a number of anomalies for the second level. This process may continue until a level of the hierarchy is determined such that the number of anomalies reaches the threshold. The mechanism may then generate a security rule to deal with the anomalies.

Automatic segmentation using hierarchical timeseries analysis

Anomaly detection data workflow for time series data

Anomaly detection in computing computing system events

Automatic model selection for a time series

Growing community of inventors

McLean, VA, United States of America

Vannia Gonzalez Macias