US 12,079,375 B2
Automatic segmentation using hierarchical timeseries analysis
Adam Beauregard, Powhatan, VA (US); Michal Hyrc, McLean, VA (US); Peter Gaspare Terrana, Mechanicsville, VA (US); and Vannia Gonzalez Macias, Glen Allen, VA (US)
Assigned to Capital One Services, LLC, McLean, VA (US)
Filed by Capital One Services, LLC, McLean, VA (US)
Filed on May 25, 2022, as Appl. No. 17/824,206.
Prior Publication US 2023/0385456 A1, Nov. 30, 2023
Int. Cl. G06F 21/64 (2013.01)
CPC G06F 21/64 (2013.01) 20 Claims
OG exemplary drawing
 
1. A system for generating security rules based on timeseries anomalies, the system comprising:
one or more processors; and
a non-transitory computer-readable storage medium storing instructions, which when executed by the one or more processors cause the one or more processors to perform operations comprising:
receiving a dataset comprising a plurality of features and a plurality of entries;
retrieving a hierarchy for segmenting the dataset, wherein the hierarchy comprises a plurality of levels and wherein each level of the hierarchy is associated with a corresponding number of features;
generating a first plurality of timeseries dataset segments based on a first level of the hierarchy and an aggregation time interval, wherein the first level of the hierarchy corresponds to a first number of features, and wherein each timeseries dataset segment of the first plurality of timeseries dataset segments is generated based on values within one or more features of the dataset;
inputting each timeseries dataset segment of the first plurality of timeseries dataset segments into an anomaly detection machine learning model to obtain a first number of anomalies for the first plurality of timeseries dataset segments;
determining that the first number of anomalies does not meet a threshold;
based on determining that the first number of anomalies does not meet the threshold, generating a second plurality of timeseries dataset segments based on a second level of the hierarchy and the aggregation time interval, wherein the second level of the hierarchy corresponds to a second number of features larger than the first number of features;
inputting each timeseries dataset segment of the second plurality of timeseries dataset segments into the anomaly detection machine learning model to obtain a second number of anomalies for the second plurality of timeseries dataset segments;
determining that the second number of anomalies meets the threshold; and
generating a corresponding security rule based on each anomaly within the second plurality of timeseries dataset segments.