US 12,333,451 B2
Interpretable supervised anomaly detection for determining reasons for unsupervised anomaly decision
Sashka T. Davis, Vienna, VA (US); and Alex Zaslavsky, Brookline, MA (US)
Assigned to RSA Security USA, LLC, Burlington, MA (US)
Filed by RSA Security LLC, Bedford, MA (US)
Filed on Nov. 27, 2019, as Appl. No. 16/697,483.
Prior Publication US 2021/0158193 A1, May 27, 2021
Int. Cl. G06N 5/045 (2023.01); G06N 5/046 (2023.01); G06N 20/20 (2019.01)
CPC G06N 5/045 (2013.01) [G06N 5/046 (2013.01); G06N 20/20 (2019.01)] 14 Claims
OG exemplary drawing
 
1. A method, comprising:
receiving at a network monitoring device implemented by a cloud infrastructure values of one or more predefined features associated with a remote user device that is separate from the cloud infrastructure;
applying the values of the one or more predefined features to an unsupervised anomaly detection model that generates an unsupervised anomaly decision by identifying at least one previously-unknown pattern in the values of the one or more features associated with the remote user device;
applying the values of the one or more predefined features to a supervised anomaly detection model that generates a supervised anomaly decision based on at least one input-output pair in a labeled training dataset, wherein the supervised anomaly detection model is trained at least in part using anomalous training data based on known anomalies and supplemental training data that includes generated fraudulent attacks that are underrepresented in the anomalous training data;
determining a third anomaly decision based on the supervised anomaly decision with the unsupervised anomaly decision using ensemble techniques;
determining one or more reasons for the third anomaly decision by analyzing the supervised anomaly decision to identify one or more instances in which a value associated with a feature violated a rule of the supervised anomaly detection model,
executing a predefined remediation step in response to the third anomaly decision, wherein the predefined remediation step includes restricting the remote user device from accessing a network in response to the third anomaly decision by autonomously adjusting a network permission that controls which resources the remote user device and a user account associated with the remote user device may access; and
performing a feature importance analysis to identify one or more features that are most predictive in detecting an anomaly for a future anomaly detection instance, wherein the feature importance analysis includes a feature interaction analysis to identify two or more features that have a dependency relationship;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.