Proactively detecting and remediating anomalous devices using supervised machine learning model and automated counterfactual generator

Abstract

A computer-implemented method for proactively detecting and remediating anomalous devices includes accessing, via a network, device attributes corresponding to enterprise devices within an enterprise network, providing the device attributes to a supervised machine learning model, and predicting, via the supervised machine learning model, whether each enterprise device is healthy or anomalous, where the enterprise device is predicted to be healthy unless the supervised machine learning model determines that the probability of the enterprise device being anomalous exceeds a specified confidence threshold. The method includes, for each enterprise device that is predicted to be anomalous, perturbing a portion of the corresponding device attributes via an automated counterfactual generator to generate synthetic data representative of counterfactual healthy devices. The method includes generating recommended remedial action(s) that will cause each enterprise device to approximate each counterfactual healthy device and causing surfacing, via a user interface, of the recommended remedial action(s).