US 12,341,791 B1
Machine learning techniques for predictive anomaly detection
Tran DePalo, Dover, NH (US); Jacob Miller, Newburgh, IN (US); Gary Bergeron, Dover, NH (US); and Cristiano Costa, Manchester, NH (US)
Assigned to Liberty Mutual Insurance Company, Boston, MA (US)
Filed by Liberty Mutual Insurance Company, Boston, MA (US)
Filed on Aug. 31, 2022, as Appl. No. 17/823,703.
Claims priority of provisional application 63/248,816, filed on Sep. 27, 2021.
Int. Cl. G06F 11/00 (2006.01); G06F 11/34 (2006.01); H04L 9/40 (2022.01); H04L 41/16 (2022.01)
CPC H04L 63/1425 (2013.01) [G06F 11/3419 (2013.01); G06F 11/3452 (2013.01); G06F 11/3466 (2013.01); H04L 41/16 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for generating an inferred anomaly classification score for an input operational monitoring timeseries trend for a monitored computer system during a target monitoring period, the computer-implemented method comprising:
generating, using one or more processors and an initial anomaly designation machine learning model, and based at least in part on the input operational monitoring timeseries trend, an initial anomaly designation for the input operational monitoring timeseries trend;
in response to determining that the initial anomaly designation for the input operational monitoring timeseries trend is a positive initial anomaly designation, generating, using the one or more processors and an anomalous operational state detection machine learning model, and based at least in part on the input operational monitoring timeseries trend, the inferred anomaly classification score for the input operational monitoring timeseries trend, wherein: (i) the anomalous operational state detection machine learning model is trained using one or more positive training entries corresponding to one or more positive operational monitoring timeseries trends and one or more negative training entries corresponding to one or more negative operational monitoring timeseries trends, (ii) each positive operational monitoring timeseries trend is detected in accordance with one or more ground-truth validation criteria, and (iii) the one or more ground-truth validation criteria comprise a first ground-truth validation criterion that is defined based at least in part on an inferred outlier score for a decomposed residual component of a given operational monitoring timeseries trend; and
initiating, using the one or more processors, the performance of a prediction-based action based at least in part on the inferred anomaly classification score, wherein the prediction-based action comprises one or more of generating user interface data for an output user interface, instructing a system reboot for the monitored computer system, instructing a system shutdown for the monitored computer system, or limiting user access to the monitored computer system.