Abstract: One or more systems, devices, computer program products and/or computer implemented methods of use provided herein relate to a process of monitoring the effect of forcible actions over a normalized feature set. A system can comprise a memory that stores computer executable components, and a processor that executed the computer executable components stored in the memory, wherein the computer executable components can comprise an input component that can receive one or more forcible actions as input from a user that correspond to an identified anomaly instance of a cluster, an evaluation component that can evaluate an effect of the one or more forcible actions executed over time on the system, and a notification component that can notify the user that a true-positive detection threshold has been reached for a cluster such that true-positives are not detected in the cluster.

Abstract: A computer receives a list of reference topics from a topic database and a set of articles related to said reference topics. The computer generates article n-grams and compares them to the reference topics using NLP to determine a primary theme for each article that corresponds to one of reference topics. The computer collects articles with common primary themes into at least one article group and determining an article comparison value between articles in the article group. Responsive to determining that an article comparison value is below a predetermined similarity threshold, determining a distinguishing feature associated with one of the compared articles that contributed to the article comparison value. The computer assigns articles having the distinguishing feature into a secondary group based, at least in part, on the distinguishing feature.