ANOMALY, ASSOCIATION AND CLUSTERING DETECTION

摘要

Techniques are provided for anomaly, association and clustering detection. At least one code table is built for each attribute in a set of data. A first code table corresponding to a first attribute and a second code table corresponding to a second attribute are selected. The first code table and the second code table are merged into a merged code table, and a determination is made to accept or reject the merged code table. An anomaly is detected when a total compression cost for a data point is greater than a threshold compression cost inferred from one or more code tables. An association in a data table is detected by merging attribute groups, splitting data groups, and assigning data points to data groups. A cluster is inferred from a matrix of data and code words for each of the one or more code tables.

主权项

1. A method, comprising:
building at least one code table for each attribute in a set of data; selecting a first code table corresponding to a first attribute and a second code table corresponding to a second attribute; merging the first code table and the second code table into a merged code table; and determining whether to accept or reject the merged code table; wherein at least one of the building, selecting, merging and determining steps are performed by a processor device.