Abstract: A method of detecting anomalies in data, includes receiving a dataset with a plurality of multidimensional data points (MDDPs) wherein a portion of the plurality of MDDPs are labeled and wherein other MDDPs of the plurality of MDDPs are unlabeled; based on a neighborhood size k of the plurality of MDDPs, computing a neighborhood radius ox for each MDDP in a reference dataset computed for the plurality of MDDPs; and generating a locally adaptive similarity (LAS) kernel of a newly arrived MDDP (NAMDDP) based on the neighborhood radius ox. The method additionally includes applying a random walk model to the LAS kernel to determine a probability of the NAMDDP being an anomaly; and if the NAMDDP is an anomaly, outputting data associated with an alarm or notification responsive to the detection of the anomaly.

Abstract: Methods that rate (i.e., ranks) the parameters (features) that cause a specific abnormal behavior to occur. It is assumed that the anomalies have already been detected by other anomaly detection methods. A method uses an algorithm based on the underlying potential of the diffusion process that is used in Diffusion Maps to reduce the dimensionality of the data. The gradient of this potential indicates the direction from an anomaly to a cluster that represents a normal behavior. This direction is used to rate the parameters that cause an abnormal behavior to occur.

Abstract: Methods for anomaly detection using dictionary based projection (DBP), and system for implementing such methods. In an embodiment, a method comprises receiving input data including a plurality n of multidimensional data points (MDDPs) with dimension m, applying DBP iteratively to the input data to construct a dictionary D, receiving a newly arrived MDDP (NAMDDP), calculating a score S associated with the NAMDDP as a distance of the NAMDDP from dictionary D, and classifying the NAMDDP as normal or as an anomaly based on score S, wherein classification of the NAMDDP as an anomaly is indicative of detection of an unknown undesirable event.

Abstract: Detection systems, methods and computer program products comprising a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method for anomaly detection, a detected anomaly being indicative of an undesirable event. A detection system comprises a computer and an anomaly detection engine executable by the computer, the anomaly detection engine configured to perform a method comprising receiving data comprising a plurality m of multidimensional data points (MDDPs), each data point having n features, constructing a dictionary D based on the received data, embedding dictionary D into a lower dimension embedded space and classifying, based in the lower dimension embedded space, a MDDP as an anomaly or as normal.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features; constructing a dictionary D based on the received data; embedding dictionary D into a lower dimension embedded space; and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising: a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features; constructing a dictionary D based on the received data; embedding dictionary D into a lower dimension embedded space; and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: A system for detecting an unknown undesirable event comprises an input device configured to receive a dataset comprising a plurality n of multidimensional datapoints (MDDPs), a processor configured to embed the MDDPs in an lower dimension embedded space to obtain embedded MDDPs, and a detection engine configured to calculate distributions of distances Dnni, i=1, . . . , n of each embedded MDDP from a plurality of nearest-neighbors (nn) to compute a threshold Dnnt and to classify a particular MDDP of the dataset or a newly arrived MDDP (NAMDDP) as an abnormal MDDP based on comparison with threshold Dnnt, wherein the classification is automatic and unsupervised without relying on a signature, rules or domain expertise and wherein the particular MDDP classified as abnormal is indicative of the unknown undesirable event.

Abstract: Detection systems, methods and computer program products comprising a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method for anomaly detection, a detected anomaly being indicative of an undesirable event. A detection system comprises a computer and an anomaly detection engine executable by the computer, the anomaly detection engine configured to perform a method comprising receiving data comprising a plurality m of multidimensional data points (MDDPs), each data point having n features, constructing a dictionary D based on the received data, embedding dictionary D into a lower dimension embedded space and classifying, based in the lower dimension embedded space, a MDDP as an anomaly or as normal.

Abstract: Detection of abnormalities in HDBD is performed by processing it to obtain a dictionary from a training data. This is done by computing a low rank randomized LU decomposition which enables constant online updating of the training data and thus gets constant updating of the normal profile in the background.

Abstract: Method and system for detecting an unknown undesirable event, such as (but not limited to) a cyber-threat, a cyber-intrusion, a financial fraud event or a monitored process malfunction of breakdown. An exemplary method embodiment comprises obtaining a dataset comprising a plurality n of multidimensional data points with a dimension m?2 wherein each data point is a vector of m features, processing the MDPs using measure-based diffusion maps to embed the MDPs into a lower dimension embedded space, and detecting in the embedded space an abnormal MDP without relying on a signature of a threat, the abnormal MDP being indicative of the unknown undesirable event.

Abstract: Detection of abnormalities in multi-dimensional data is performed by processing the multi-dimensional data to obtain a reduced dimension embedding matrix, using the reduced dimension embedding matrix to form a lower dimension (of at least 2D) embedded space, applying an out-of-sample extension procedure in the embedded space to compute coordinates of a newly arrived data point and using the computed coordinates of the newly arrived data point and Euclidean distances to determine whether the newly arrived data point is normal or abnormal.

Abstract: A system for detecting an unknown undesirable event comprises an input device configured to receive a dataset comprising a plurality n of multidimensional datapoints (MDDPs), a processor configured to embed the MDDPs in an lower dimension embedded space to obtain embedded MDDPs, and a detection engine configured to calculate distributions of distances Dnni, i=1, . . . , n of each embedded MDDP from a plurality of nearest-neighbors (nn) to compute a threshold Dnnt and to classify a particular MDDP of the dataset or a newly arrived MDDP (NAMDDP) as an abnormal MDDP based on comparison with threshold Dnnt, wherein the classification is automatic and unsupervised without relying on a signature, rules or domain expertise and wherein the particular MDDP classified as abnormal is indicative of the unknown undesirable event.

Abstract: Detection of abnormalities in multi-dimensional data is performed by processing the multi-dimensional data to obtain a reduced dimension embedding matrix, using the reduced dimension embedding matrix to form a lower dimension (of at least 2D) embedded space, applying an out-of-sample extension procedure in the embedded space to compute coordinates of a newly arrived data point and using the computed coordinates of the newly arrived data point and Euclidean distances to determine whether the newly arrived data point is normal or abnormal.

Abstract: A computer program product for performing anomaly detection, a detected anomaly being indicative of an undesirable event, the computer program product comprising a non-transitory tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising receiving data comprising a plurality m of multidimensional datapoints (MDDPs), each data point having n features, constructing a dictionary D based on the received data, embedding dictionary D into a lower dimension embedded space and classifying, based in the lower dimension embedded space, an MDDP as an anomaly or as normal.

Abstract: Method and system for detecting an unknown undesirable event, such as (but not limited to) a cyber-threat, a cyber-intrusion, a financial fraud event or a monitored process malfunction of breakdown. An exemplary method embodiments comprises obtaining a dataset comprising a plurality n of multidimensional data points with a dimension m?2 wherein each data point is a vector of m features, processing the MDPs using measure-based diffusion maps to embed the MDPs into a lower dimension embedded space, and detecting in the embedded space an abnormal MDP without relying on a signature of a threat, the abnormal MDP being indicative of the unknown undesirable event.

Abstract: Detection of abnormalities in multi-dimensional data is performed by processing the multi-dimensional data to obtain a reduced dimension embedding matrix, using the reduced dimension embedding matrix to form a lower dimension (of at least 2D) embedded space, applying an out-of-sample extension procedure in the embedded space to compute coordinates of a newly arrived data point and using the computed coordinates of the newly arrived data point and Euclidean distances to determine whether the newly arrived data point is normal or abnormal.

Abstract: A method for classification of a newly arrived multidimensional data point (MDP) in a dynamic data uses multi-scale extension (MSE). The multi-scale out-of-sample extension (OOSE) uses a coarse-to-fine hierarchy of the multi-scale decomposition of a Gaussian kernel that established the distances between MDPs in a training set to find the coordinates of newly arrived MDPs in an embedded space. A well-conditioned basis is first generated in a source matrix of MDPs. A single-scale out-of-sample extension (OOSE) is applied to the newly arrived MDP on the well-conditioned basis to provide coordinates of an approximate location of the newly arrived MDP in an embedded space. A multi-scale OOSE is then applied to the newly arrived MDP to provide improved coordinates of the newly arrived MDP location in the embedded space.