Abstract: Methods for anomaly detection using dictionary based projection (DBP), and system for implementing such methods. In an embodiment, a method comprises receiving input data including a plurality n of multidimensional data points (MDDPs) with dimension m, applying DBP iteratively to the input data to construct a dictionary D, receiving a newly arrived MDDP (NAMDDP), calculating a score S associated with the NAMDDP as a distance of the NAMDDP from dictionary D, and classifying the NAMDDP as normal or as an anomaly based on score S, wherein classification of the NAMDDP as an anomaly is indicative of detection of an unknown undesirable event.

Abstract: Detection systems, methods and computer program products comprising a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method for anomaly detection, a detected anomaly being indicative of an undesirable event. A detection system comprises a computer and an anomaly detection engine executable by the computer, the anomaly detection engine configured to perform a method comprising receiving data comprising a plurality m of multidimensional data points (MDDPs), each data point having n features, constructing a dictionary D based on the received data, embedding dictionary D into a lower dimension embedded space and classifying, based in the lower dimension embedded space, a MDDP as an anomaly or as normal.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features; constructing a dictionary D based on the received data; embedding dictionary D into a lower dimension embedded space; and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features; constructing a dictionary D based on the received data; embedding dictionary D into a lower dimension embedded space; and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: A system for detecting an unknown undesirable event comprises an input device configured to receive a dataset comprising a plurality n of multidimensional datapoints (MDDPs), a processor configured to embed the MDDPs in an lower dimension embedded space to obtain embedded MDDPs, and a detection engine configured to calculate distributions of distances Dnni, i=1, . . . , n of each embedded MDDP from a plurality of nearest-neighbors (nn) to compute a threshold Dnnt and to classify a particular MDDP of the dataset or a newly arrived MDDP (NAMDDP) as an abnormal MDDP based on comparison with threshold Dnnt, wherein the classification is automatic and unsupervised without relying on a signature, rules or domain expertise and wherein the particular MDDP classified as abnormal is indicative of the unknown undesirable event.

Abstract: Detection systems, methods and computer program products comprising a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method for anomaly detection, a detected anomaly being indicative of an undesirable event. A detection system comprises a computer and an anomaly detection engine executable by the computer, the anomaly detection engine configured to perform a method comprising receiving data comprising a plurality m of multidimensional data points (MDDPs), each data point having n features, constructing a dictionary D based on the received data, embedding dictionary D into a lower dimension embedded space and classifying, based in the lower dimension embedded space, a MDDP as an anomaly or as normal.

Abstract: Detection of abnormalities in HDBD is performed by processing it to obtain a dictionary from a training data. This is done by computing a low rank randomized LU decomposition which enables constant online updating of the training data and thus gets constant updating of the normal profile in the background.

Abstract: Method and system for detecting an unknown undesirable event, such as (but not limited to) a cyber-threat, a cyber-intrusion, a financial fraud event or a monitored process malfunction of breakdown. An exemplary method embodiment comprises obtaining a dataset comprising a plurality n of multidimensional data points with a dimension m?2 wherein each data point is a vector of m features, processing the MDPs using measure-based diffusion maps to embed the MDPs into a lower dimension embedded space, and detecting in the embedded space an abnormal MDP without relying on a signature of a threat, the abnormal MDP being indicative of the unknown undesirable event.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features, constructing a dictionary D based on the received data, embedding dictionary D into a reduced dimension embedded space and classifying, based in the reduced dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: Detection of abnormalities in multi-dimensional data is performed by processing the multi-dimensional data to obtain a reduced dimension embedding matrix, using the reduced dimension embedding matrix to form a lower dimension (of at least 2D) embedded space, applying an out-of-sample extension procedure in the embedded space to compute coordinates of a newly arrived data point and using the computed coordinates of the newly arrived data point and Euclidean distances to determine whether the newly arrived data point is normal or abnormal.

Abstract: A system for detecting an unknown undesirable event comprises an input device configured to receive a dataset comprising a plurality n of multidimensional datapoints (MDDPs), a processor configured to embed the MDDPs in an lower dimension embedded space to obtain embedded MDDPs, and a detection engine configured to calculate distributions of distances Dnni, i=1, . . . , n of each embedded MDDP from a plurality of nearest-neighbors (nn) to compute a threshold Dnnt and to classify a particular MDDP of the dataset or a newly arrived MDDP (NAMDDP) as an abnormal MDDP based on comparison with threshold Dnnt, wherein the classification is automatic and unsupervised without relying on a signature, rules or domain expertise and wherein the particular MDDP classified as abnormal is indicative of the unknown undesirable event.

Abstract: Detection of abnormalities in multi-dimensional data is performed by processing the multi-dimensional data to obtain a reduced dimension embedding matrix, using the reduced dimension embedding matrix to form a lower dimension (of at least 2D) embedded space, applying an out-of-sample extension procedure in the embedded space to compute coordinates of a newly arrived data point and using the computed coordinates of the newly arrived data point and Euclidean distances to determine whether the newly arrived data point is normal or abnormal.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features, constructing a dictionary D based on the received data, embedding dictionary D into a lower dimension embedded space and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: Method and system for detecting an unknown undesirable event, such as (but not limited to) a cyber-threat, a cyber-intrusion, a financial fraud event or a monitored process malfunction of breakdown. An exemplary method embodiments comprises obtaining a dataset comprising a plurality n of multidimensional data points with a dimension m?2 wherein each data point is a vector of m features, processing the MDPs using measure-based diffusion maps to embed the MDPs into a lower dimension embedded space, and detecting in the embedded space an abnormal MDP without relying on a signature of a threat, the abnormal MDP being indicative of the unknown undesirable event.

Abstract: Detection of abnormalities in multi-dimensional data is performed by processing the multi-dimensional data to obtain a reduced dimension embedding matrix, using the reduced dimension embedding matrix to form a lower dimension (of at least 2D) embedded space, applying an out-of-sample extension procedure in the embedded space to compute coordinates of a newly arrived data point and using the computed coordinates of the newly arrived data point and Euclidean distances to determine whether the newly arrived data point is normal or abnormal.

Abstract: A method for classification of a newly arrived multidimensional data point (MDP) in a dynamic data uses multi-scale extension (MSE). The multi-scale out-of-sample extension (OOSE) uses a coarse-to-fine hierarchy of the multi-scale decomposition of a Gaussian kernel that established the distances between MDPs in a training set to find the coordinates of newly arrived MDPs in an embedded space. A well-conditioned basis is first generated in a source matrix of MDPs. A single-scale out-of-sample extension (OOSE) is applied to the newly arrived MDP on the well-conditioned basis to provide coordinates of an approximate location of the newly arrived MDP in an embedded space. A multi-scale OOSE is then applied to the newly arrived MDP to provide improved coordinates of the newly arrived MDP location in the embedded space.