US 12,355,794 B1
Multi-dimensional anomaly source detection
Jason Black, Columbus, OH (US); Bradley Glenn, Columbus, OH (US); and Cameron Conte, Columbus, OH (US)
Assigned to THE HUNTINGTON NATIONAL BANK, Columbus, OH (US)
Filed by THE HUNTINGTON NATIONAL BANK, Columbus, OH (US)
Filed on Feb. 24, 2025, as Appl. No. 19/060,868.
Application 19/060,868 is a continuation of application No. 18/763,469, filed on Jul. 3, 2024, granted, now 12,267,349.
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) 20 Claims
OG exemplary drawing
 
1. A computer-implemented method, comprising:
detecting, by a computing device, an anomaly based at least in part on an anomalous value of a first time series data instance that is associated with an entity;
identifying, from a hierarchy comprising a plurality of levels that are individually associated with a respective set of entities, a first level to which the entity is associated;
identifying, by the computing device, a first entity peer that is associated with a second level of the hierarchy that is different from the first level, the first entity peer being identified based at least in part on a second time series data instance corresponding to the first entity peer;
identifying, by the computing device, a second entity peer based at least in part on identifying that the second entity peer and the entity are associated with a common attribute, the second entity peer being identified further based at least in part on a third time series data instance corresponding to the second entity peer;
identifying, by the computing device, a source of the anomaly, the source being identified as being associated with at least one of: 1) the first level or the second level of the hierarchy or 2) the common attribute with which the entity and the second entity peer are both associated, wherein identifying the source is based at least in part on determining whether the first time series data instance conforms to the second time series data instance corresponding to the first entity peer or to the third time series data instance corresponding to the second entity peer; and
in response to identifying the source of the anomaly:
estimating, by the computing device, an impact of the anomaly; and
performing, by the computing device and based on estimating the impact of the anomaly, one or more remedial actions.