Incorporating feedback in anomaly detection performed by unsupervised learning

Abstract

According to an aspect, a system performs a first machine learning (ML) technique and a second ML technique on a large set of data items. The first ML technique identifies a primary cluster containing data items classified as non-anomalous, with the rest of the data items classified as anomalous. The second ML technique identifies a set of secondary clusters. Upon receiving feedback on the classification of at least some of the data items, the system maintains a feedback data associating the feedback with each secondary cluster. Upon receiving an indication to find a classification of a data item, the system identifies as a result, whether the data item is non-anomalous or anomalous based on whether the data item belongs to the primary cluster or not. The system also determines based on a secondary cluster to which the data item belongs and the feedback associated with the secondary cluster, whether the result is to be modified. If the result is to be modified, the system reverses the result (from anomalous to non-anomalous and vice versa). The system then provides the result as the classification for the data item.