Abstract: The present invention is a new method directed for detecting anomalies in monitored data having plurality of data-segments partitioned to context related initial-subspaces, the method comprising: training an association-map between the initial-subspaces and feature-clusters of the plurality of data-segments, the training is responsive to a fit-criterion; concatenating the initial-subspaces into cluster-subspaces, responsive to being associated to similar feature-clusters according to the association-map, to obtain a generalized-association-map; pinpointing at least one anomaly of at least one new data-segment of the data, responsive to deviation-criterion for deviation of the new data-segment from its association to one of the feature-clusters, according to the generalized-association-map; and triggering an automatic-act responsive to a trigger-criterion for the at least one anomaly.

Abstract: A computer-implemented method, apparatus and computer program product for projecting a machine learning model, the method comprising: obtaining a computerized multi-dimensional unsupervised anomaly detection model; obtaining a probability density function of the anomaly detection model; determining samples of the anomaly detection model, based on the probability density function; projecting the samples over at least one dimension set to obtain projected samples; processing the projected samples to obtain decision boundaries of the anomaly detection model over the at least one dimension set; and providing a visual display of the decision boundaries on a display device.

Abstract: The present invention is a new method directed for detecting anomalies in monitored data having plurality of data-segments partitioned to context related initial-subspaces, the method comprising: training an association-map between the initial-subspaces and feature-clusters of the plurality of data-segments, the training is responsive to a fit-criterion; concatenating the initial-subspaces into cluster-subspaces, responsive to being associated to similar feature-clusters according to the association-map, to obtain a generalized-association-map; pinpointing at least one anomaly of at least one new data-segment of the data, responsive to deviation-criterion for deviation of the new data-segment from its association to one of the feature-clusters, according to the generalized-association-map; and triggering an automatic-act responsive to a trigger-criterion for the at least one anomaly.