US 12,267,349 B1
Multi-dimensional anomaly source detection
Jason Black, Columbus, OH (US); Bradley Glenn, Columbus, OH (US); and Cameron Conte, Columbus, OH (US)
Assigned to THE HUNTINGTON NATIONAL BANK, Columbus, OH (US)
Filed by THE HUNTINGTON NATIONAL BANK, Columbus, OH (US)
Filed on Jul. 3, 2024, as Appl. No. 18/763,469.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) 20 Claims
OG exemplary drawing
 
1. A computer-implemented method, comprising:
obtaining, by a computing device, a plurality of time series data instances individually corresponding to a respective entity of a plurality of entities;
detecting, by the computing device, an anomalous value in a first time series data instance of the plurality of time series data instances, the first time series data instance being associated with an entity of the plurality of entities;
identifying, from a predefined geographical hierarchy, a first level to which the entity is associated, the predefined geographical hierarchy comprising a plurality of levels corresponding to different geographical areas with which respective subsets of the plurality of entities are individually associated;
identifying, by the computing device, a first correlated entity peer from the plurality of entities based at least in part on executing a correlation analysis algorithm on the first time series data instance corresponding to the entity and a second time series data instance corresponding to a second entity of the plurality of entities, the second entity being associated with a second level of the predefined geographical hierarchy that is different from the first level with which the entity is associated;
identifying, by the computing device, a second correlated entity peer from the plurality of entities based at least in part on executing the correlation analysis algorithm on the first time series data instance corresponding to the entity and a third time series data instance corresponding to a third entity of the plurality of entities, the third entity being associated with a common attribute with which the entity is associated;
determining that an anomaly has occurred based at least in part on determining whether the anomalous value detected within the first time series data instance conforms to at least one of a first value of the second time series data instance corresponding to the first correlated entity peer or a second value of the third time series data instance corresponding to the second correlated entity peer; and
identifying a source of the anomaly as being associated with at least one of: 1) the first level or the second level of the predefined geographical hierarchy or 2) the common attribute with which the entity and the third entity are both associated.