| 摘要 |
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting and localizing anomalies in large data sets. One of the methods includes identifying a user whose behavior is classified as anomalous during a particular time interval and determining observed community feature values for a community of users of which the user is a member. If observed user feature values are consistent with the observed community feature values, the behavior of the user is classified as not anomalous. If the observed user feature values are not consistent with the observed community feature values, the behavior of the user is classified as anomalous. |
