| CPC G06F 11/3688 (2013.01) [G06F 11/3608 (2013.01)] | 20 Claims |
|
1. A computer-implemented method comprising:
generating, by one or more processors, a target event data object, wherein: (i) the target event data object comprises a target event code subset, (ii) the target event code subset comprises event codes described by a primary event code subset corresponding to a primary event data object and a related event code subset corresponding to a related event data object, (iii) the primary event code subset and related event code subset each comprise one or more event codes and each event code of the primary event code subset and related event code subset is associated with an event weight, and (iv) each event code of the target event code subset is associated with a target event weight;
determining, by one or more processors, a plurality of event code pairs, wherein each event code pair is associated with a first event code and a second event code;
for each event code pair, determining, by the one or more processors and using a pairwise interaction score determination machine learning model, a pairwise interaction score based at least in part on a first corresponding target event weight for the first event code associated with the event code pair and a second corresponding target event weight for the second event code associated with the event code pair;
performing, by the one or more processors, a computationally requisite number of event code space refinement iterations until a terminal event code space refinement iteration in which a target anomaly detection matrix data object is generated, wherein performing a particular event code space refinement iteration comprises:
during each non-initial event code space refinement iteration, updating the target event code subset generated by a preceding event code space refinement iteration to remove n target event codes;
determining an event interaction matrix data object, wherein: (i) each row of the event interaction matrix data object is associated with a row-wise event code that is selected from either the first event code or second event code of the event code pair, (ii) each column of the event interaction matrix data object is associated with a column-wise event code that is selected from either the first event code or second event code of the event code pair, and (iii) each value of the event interaction matrix data object describes the pairwise interaction score whose first event code corresponds to the row-wise event code for the value and whose second event code corresponds to the column-wise event code for the value;
determining a row-wise interaction triangular matrix data object, wherein each non-null value of the row-wise interaction triangular matrix data object is determined based at least in part on a corresponding event interaction matrix value of the event interaction matrix data object, a row-wise mean measure for a corresponding row of the event interaction matrix data object, and a row-wise standard deviation measure for a corresponding row of the event interaction matrix data object;
determining a column-wise interaction triangular matrix data object, wherein each non-null value of the column-wise interaction triangular matrix data object is determined based at least in part on the corresponding event interaction matrix value of the event interaction matrix data object, a column-wise mean measure for a corresponding row of the event interaction matrix data object, and a column-wise standard deviation measure for a corresponding row of the event interaction matrix data object; and
generating an anomaly detection matrix data object, wherein each non-null value of the anomaly detection matrix data object is determined based at least in part on a corresponding row-wise matrix value of the row-wise interaction triangular matrix data object and a corresponding column-wise matrix value of the column-wise interaction triangular matrix data object;
determining, by the one or more processors, an anomalous code subset of the plurality of event code pairs based at least in part on the n target event codes for the terminal event code space refinement iteration; and
initiating, by the one or more processors, the performance of one or more actions based at least in part on the anomalous code subset.
|