Unsupervised anomaly detection using lookahead pairs

Abstract

Systems and methods for detecting anomalies in sequences of actions using lookahead pairs (LAPs) are disclosed. An example method is performed by one or more processors of an unsupervised anomaly detection system and includes receiving, over a communications network, a sequence of actions, generating one or more LAPs of interest based on the received sequence of actions, each LAP of interest indicating a target action, an origin action, and a number of gap actions, and selectively flagging the LAPs of interest as anomalies based on whether they appear in a LAP database, the selective flagging including refraining from flagging the LAP of interest as an anomaly if it is associated with a number of observances greater than a threshold, and flagging the LAP as an anomaly if it is associated with a number of observances less than the threshold or if the LAP does not appear in the LAP database.