Methods of unsupervised anomaly detection using a geometric framework

US9306966B2 · kind B2 · utility

Assignee

• The Trustees of Columbia University in the City of New York · US

Inventors

• Eleazar Eskin · Santa Monica, US
• Andrew Oliver Arnold · New York, US
• Michael J. Prerau · Somerville, US
• Leonid Portnoy · Brooklyn, US
• Salvatore J. Stolfo · Ridgewood, US

Key dates

• Filing date: Aug 20, 2013
• Grant date: Apr 5, 2016
• Expiry date: Jan 8, 2034

Classification

• Technology area (CPC G): Physics
• CPC primary: G06F16/84
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

A method for unsupervised anomaly detection, which are algorithms that are designed to process unlabeled data. Data elements are mapped to a feature space which is typically a vector space d. Anomalies are detected by determining which points lies in sparse regions of the feature space. Two feature maps are used for mapping data elements to a feature apace. A first map is a data-dependent normalization feature map which we apply to network connections. A second feature map is a spectrum kernel which we apply to system call traces.