US20220004843A1

US20220004843A1 - Convolutional neural network (cnn)-based anomaly detection

Info

Publication number: US20220004843A1
Application number: US17/373,600
Authority: US
Inventors: Chang Lu; Lingtao ZHANG
Original assignee: Salesforce com Inc
Current assignee: Salesforce Inc
Priority date: 2017-10-05
Filing date: 2021-07-12
Publication date: 2022-01-06
Also published as: US11093816B2; US20190108432A1

Abstract

The technology disclosed determines which field values in a set of unique field values for a particular field in a fielded dataset are anomalous using six similarity measures. A factor vector is generated per similarity measure and combined to form an input matrix. A convolutional neural network processes the input matrix to generate evaluation vectors. A fully-connected network evaluates the evaluation vectors to generate an anomaly scalar for a particular unique field value. Thresholding is applied to anomaly scalar to determine whether the particular unique field value is anomalous.

Description

RELATED APPLICATIONS

This application is a continuation of and claims priority under 35 U.S.C. 120 to co-pending and commonly-owned U.S. nonprovisional application Ser. No. 15/726,267, filed Oct. 5, 2017, which is hereby expressly incorporated herein by reference in its entirety.
This application is related to U.S. application Ser. No. 15/726,268, filed Oct. 5, 2017. The related application is incorporated by reference herein.

FIELD OF THE TECHNOLOGY DISCLOSED

The technology disclosed relates generally to data cleaning apparatus and corresponding methods for the detection of anomalous data stored in a fielded database or as computer files, and in particular relates to implementing a convolutional neural network that takes identifies the anomalous field values and suggests correct field values to replace anomalous field values.

BACKGROUND

The subject matter discussed in this section should not be assumed to be prior art merely as a result of its mention in this section. Similarly, a problem mentioned in this section or associated with the subject matter provided as background should not be assumed to have been previously recognized in the prior art. The subject matter in this section merely represents different approaches, which in and of themselves can also correspond to implementations of the claimed technology.
A large amount of data is being generated by today's business systems. Organizations use this data as input to business intelligence (BI) systems. These systems require high quality input data. Current data cleaning techniques require significant human intervention to clean data. Moreover, typically only one criterion or a limited number of criteria can be applied at any given input field of a fielded dataset to identify anomalous field values. Therefore, existing data cleaning techniques are not scalable and efficient. An opportunity arises to develop a data cleaning technique that does not require significant human intervention and is scalable. Effective and efficient data cleaning may result.

APPENDICES

The following are attached hereto as part of a single invention:
Appendix A is a presentation showing examples of data structures, algorithms, neural network architectures, and experimental results at a high-level.
Appendix B is a report showing examples of data structures, algorithms, neural network architectures, and experimental results in greater detail.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings, like reference characters generally refer to like parts throughout the different views. Also, the drawings are not necessarily to scale, with an emphasis instead generally being placed upon illustrating the principles of the technology disclosed. In the following description, various implementations of the technology disclosed are described with reference to the following drawings, in which:

FIG. 1 shows aspects of a system in which a machine learning system detects anomalous field values and suggests correct field values to replace anomalous field values.

FIG. 2A depicts one implementation of an input generator for anomaly detection network of FIG. 1 using six similarity calculators.

FIG. 2B shows calculations for determining factor vectors using two example similarity measures to generate an input matrix.

FIG. 3 shows processing of the input matrix of FIG. 2B by anomaly detection network of FIG. 1 to identify anomalous field values.

FIG. 4A shows examples of main components of a one-layer anomaly detection network.

FIG. 4B shows examples of main components of a two-layer anomaly detection network.

FIG. 5A is an example of an input generator for suggestion network of FIG. 1 using six similarity calculators.

FIG. 5B shows calculations for determining factor vectors using two example similarity measures to generate an input matrix.

FIG. 6 shows processing of the input matrix of FIG. 5B by suggestion network of FIG. 1 to suggest correct field value for the anomalous field value.

FIG. 7 shows examples of main components of a one-layer suggestion network of FIG. 1.

FIG. 8 is a simplified block diagram of a computer system that can be used to implement the machine learning system of FIG. 1.

DETAILED DESCRIPTION

The following discussion is presented to enable any person skilled in the art to make and use the technology disclosed, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed implementations will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other implementations and applications without departing from the spirit and scope of the technology disclosed. Thus, the technology disclosed is not intended to be limited to the implementations shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

INTRODUCTION

More and more companies are using data to help drive their business decisions. Data is collected from a variety of sources including sales processes, accounting systems, call centers, etc. Business intelligence (BI) systems analyze data from a variety of sources. Before data is consumed by BI systems, it needs to be cleaned to make sure any conclusion based on the data is reliable. Data Scientists typically spend more than 70% of the time cleaning the data before doing any data analysis. Large amounts of data generated by today's business systems make manual data cleaning process very expensive. A convolutional neural network (CNN) is trained to identify anomalous field values in a fielded dataset. The CNN speeds up the data cleaning process by reducing the effort required to clean the data by automatically detecting anomalous field values.
The CNN uses hints based on six similarity measures, which cover both semantic and syntactic aspects of fielded data, to identify anomalous field values in a particular input field. The six similarity measures are semantic similarity, syntactical similarity, soundex similarity, length similarity, frequency of occurrence similarity and format similarity. A key element of the technology disclosed is extraction of hints from the fielded data for the six similarity measures and organizing these hints in the form of vectors that can be processed by the CNN.
The training data for the CNN is generated artificially. Separate datasets are generated for five of the similarity measures listed above except the frequency of occurrence similarity measure. Each dataset contains separate collection of similar and dissimilar unique field values. A training dataset is generated by randomly picking field values from similar and dissimilar field values. To generate frequency similarity data, each of the unique field values in the field is multiplied with a randomly generated positive integer. For production, real world testing data is used from public data sources. The higher the quality of input data for training, the higher the accuracy of the CNN in production.
Data cleaning of a data field is composed of two processes: anomaly detection and anomaly suggestion. A separate CNN is used for each of these two processes: an anomaly detection network and a suggestion network. The respective CNNs are trained separately. Anomaly detection CNN can reach 97% detection for anomaly and 88% detection for non-anomaly on training set, and 60%, 83% detections respectively on testing set. Suggestion CNN can reach 60% accuracy on training set and 70% on testing set.
There are two ways to apply the anomaly detection and anomaly suggestion networks to identify anomalous data and clean it. The first option is automatic detection-suggestion flow. In the first option, the anomalous field values identified by the anomaly detection network are automatically passed to the suggestion network. The suggestion network identifies a correct field value for each anomalous field value and replaces the anomalous field value with correct field value. The second option to combine the anomaly detection and suggestion networks is to get expert feedback after the detection of anomalous field values. This is to avoid the passing false positives to the suggestion network. This helps the user to understand the results and provide feedback. The second option to combine the anomaly detection and suggestion networks requires more interaction from an expert, but generally gains higher accuracy.

System Overview

We describe a system for detecting anomalous field values for a particular field in a fielded dataset. The system and processes are described with reference to FIG. 1 showing an architectural level schematic of a system in accordance with an implementation. Because FIG. 1 is an architectural diagram, certain details are intentionally omitted to improve the clarity of the description.
The discussion of FIG. 1 is organized as follows. First, the elements of the figure are described, followed by their interconnections. Then, the use of the elements in the system is described in greater detail.
FIG. 1 includes the system 100. The system 100 includes a machine learning system 110, a network 120, a training database 142, a testing database 144 and an administrator interface 132. The machine learning system 110 includes an input generator 112, an anomaly detection network 114 and a suggestion network 116. At a high level, the input generator 112 generates input data for the anomaly detection network 114 and the suggestion network 116. The data that is consumed by the input generator 112 is provided by the training database 142 during training and by the testing database 144 during production.
The anomaly detection network 114 determines which field values in a set of field values for a particular field in a fielded dataset are anomalous. The suggestion network 116 determines that one or more field values in a set of field values are similar to an input value for a particular field in a fielded dataset. Both anomaly detection network 114 and suggestion network 116 can run on a variety of hardware processors such as graphic processor units (GPUs). Neural network-based models involve computationally intensive methods, such as convolutions and matrix-based operations. GPUs are well suited for these types of computations. Recently, specialized hardware is being developed to efficiently train neural network models.
During training of the anomaly detection network 114 and the suggestion network 116, the input generator 112 receives data from the training database 142 and processes it to generate input for the anomaly detection network 114 and the suggestion network 116. During production, the input generator 112 receives data from the testing database 144 and processes it to produce input for the anomaly detection network 114 and the suggestion network 116.
The administrative interface 132 can be used during training or production to provide input data to the input generator 112 from respective databases. The administrative interface 132 can also be used during training to control model parameters of the anomaly detection network 114 and the suggestion network 116. The machine learning system 110, the training database 142, the testing database 144 and the administrative interface 132 are in communication with each other via the network(s) 120. After presenting a high level description of the system 100, the discussion now turns to detailed description of various components of the system 100.

Anomaly Detection Network

FIG. 2A illustrates operation of the input generator 112 to generate input data for the anomaly detection network 114 during training. The input generator 112 takes a dataset 202 as input. During training, the dataset 202 is generated from the training database 142 and during production, the dataset 202 is generated from the testing database 144. The dataset 202 is composed of field values. In the more common use case, these field values are word tokens. In other implementations, field values can be character tokens or phrase tokens. An example of a word token is “John” and an example of a phrase token is “J. P. Morgan”. The dataset 202 is a fielded dataset which means it can have fields such as “First Name”, “Last Name”, “Company Name”, “Country” etc., and data is organized as field values in the fields.
The input generator 112, generates factor vectors 230 for a plurality of similarity measures (also referred to as linguistic similarity measures). In one implementation, six similarity measures are used. The six similarity measures are semantic similarity, syntactical similarity, soundex similarity, length similarity, frequency of occurrence similarity and format similarity. In other implementations fewer than six or more than six similarity measures can be used. A factor vector calculator 210 contains similarity measure calculators for each similarity measure. FIG. 2A shows six similarity measure calculators corresponding to six similarity measures listed above. A semantic similarity calculator 212 calculates semantic similarity measure, a syntactical similarity calculator 214 calculates syntactical similarity measure, a soundex similarity calculator 216 calculates soundex similarity measure, a length similarity calculator 218 calculates length similarity measure, a frequency of occurrence similarity calculator 220 calculates frequency similarity measure and a format similarity calculator 222 calculates format similarity measure.
Semantic similarity between two field values of a particular input field of the fielded dataset is calculated using either Word2Vec, WordNet or GloVe model. Two given input field values of the input field are semantically similar to each other if their meaning are similar in the vocabulary. For example, consider a field listing fruit names, a first field value “apple” is semantically similar to a second field value “orange”. In the same field, the first field value “apple” is not semantically similar to a third field value “airplane”. Every field value of the particular field is compared with every other field value in the same field to determine semantic similarity measure between them. For this purpose, two field values are passed to one of the selected models listed above. The model represents each field value as a word vector in a low dimensional embedding space (typically between 100 to 1000 dimensions). An inner product or dot product of two multidimensional vector representations of the field values is calculated by the selected model. The results of the calculations are used to fill the n×n similarity matrix for semantic similarity measure, where “n” is the number of unique field values (also referred to as words, word phrases or tokens) in the field.
Syntactic similarity between two field values of a particular field of the fielded dataset is calculated using a so called “bag of letters” algorithm. The syntactic similarity between two input field values indicates how similar they are in terms of the arrangement of the characters in the field values. For example, a first field value “gardenia” is syntactically similar to a second field value “grandniece” in a particular input field. The first input value “gardenia” is not syntactically similar to a third input value “hoff” in the same input field. The syntactic similarity is calculated between every two field values of a given field. For this purpose, two field values are given as input to the “bag of letters” algorithm. In a first step of the algorithm, all upper case letters in the two field values are converted to respective lower case letters. The characters in both field values are then converted to equivalent American Standard Code for Information Interchange (ASCII) codes. In the next step, the algorithm represents each input field value as a multidimensional vector in a character embedding space. The dimensionality of the embedding space is equal to number of codes in ASCII. Multiple occurrences of the same character are represented as magnitude on that character's respective dimension. Finally, the “bag of letters” algorithm, calculates an inner product or dot product of the multidimensional vector representations of the two input field values. The results of the calculations are used to fill the n×n similarity matrix for syntactic similarity measure where “n” is the number of unique field values in the particular field.
Soundex similarity between two field values of a particular field indicates how similar they are in terms of their respective pronunciations in the English language. For example, a first field value “abel” is soundex similar to a second field value “flail” in a particular field. The first field value “abel” is not soundex similar to a third input field value “rowe” in the same field of the fielded dataset. In one implementation, a custom algorithm is used to determine the soundex similarity between two input field values by determining corresponding positions of similar sounding English alphabets in respective field values. In other implementations, soundex algorithms such as Metaphone or Double Metaphone can be used to determine soundex similarity between two input field values. A soundex similarity score of each field value is calculated with every other field value in a particular input field of the fielded dataset. The results of the calculations are used to fill the n×n similarity matrix for soundex similarity measure where “n” is the number of unique words or tokens in the input field.
Format similarity between two input field values indicates how similar they are in terms of their formats. For example, a first field value “0x12345” is similar in format to a second field value “0x32749” in a particular field. The first field value “0x12345” is not format similar to a third field value “1234567” in the same input field of the fielded dataset. In one implementation, a custom format matching algorithm is given two field values of a particular field as input. The format matching algorithm calculates a format similarity score for the two field values by comparing characters at corresponding positions in the two field values. A format similarity score for each field value is calculated with every other field value in a particular input field of the fielded dataset. The results of the calculations are used to fill the n×n similarity matrix for format similarity measure where “n” is the number of unique field values in the particular field.
Length similarity measure is used to identify field values that are longer or shorter than average length of field values in a particular field. For example, consider field values “firm”, “lamb”, “coon”, “key”, “septuagenarian”, “x” in a particular input field. The length similarity measure will identify the field values “septuagenarian”, and “x” as anomalous because their respective lengths are too long or too short than average length of field values in the particular input field. In one implementation, the algorithm to calculate the length similarity measure first generates the length of each field value. Following this, the algorithm determines a Z-score (also referred to as standard score) using mean and standard deviation. The Z-score is statistical measure of a score's relationship to the mean in a group of scores. The values of Z-scores are normalized using the largest Z-score value. The normalized values of Z-scores range between “0” and “1” inclusive. A normalized Z-score of zero means the score is the same as the mean which means the corresponding input field value lies at the mean. A higher normalized Z-score value implies the score is farther away from the mean. The corresponding field value is either too short in length or too long in length compared to other field values in the particular field. A normalized Z-score of “1” means the corresponding input field value is farthest from the mean and consequently had the highest inverse similarity measure. Finally, the field values with highest inverse similarity measure values are recommended as anomalous.
Frequency similarity measure identifies anomalous field values using frequency counts of the unique field values in a particular field of the fielded dataset. Typically, in a field of a fielded dataset, unique values occur multiple times. If a particular field value occurs only once or a very few times, then most likely it is an anomaly. For example, if field values and their corresponding frequency of occurrences in a particular input field are: “J.P. Morgan” (135), “Goldman Sachs” (183), “Citi” (216), “Morgan Stanley” (126), “City” (1). The anomalous field value is “City”, which is the least frequent value with a frequency of occurrence of “1”.
Turning to the example factor vector calculator 210 shown in FIG. 2A, the six similarity calculators generate six factor vectors 230 corresponding to the six similarity measures. The six factor vectors are denoted by the variables “y”, “p”, “q”, “s”, “t”, and “z” respectively. Each factor comprises as many elements as unique field values in a field of the fielded dataset. As shown in the example dataset 202, there are “n” unique field values: x₁to x_nin a field. Each field value is also referred to as a word, word phrase or a token. Each of the six factor vectors 230 consists of “n” values or elements. For example, the first factor vector consists of the values y₁to y_n, the second factor vector consists of the values p₁to p_n, the third factor vector consists of the values q₁to q_n, the fourth factor vector consists of the values s₁to s_n, the fifth factor vector consists of the values t₁to t_nand the sixth factor vector consists of the values z₁to z_n. When arranged column-wise, the six example factor vectors 230 shown in FIG. 2A form an input matrix which is shown in FIG. 2B referred to by a numeral 232. The input matrix 232 is given as input to the anomaly detection network 114 by the input generator 112.
FIG. 2B shows further details of how factor vectors are calculated for similarity measures listed above. In FIG. 2B factor vector calculations of two similarity measures are shown as an example. A person skilled in the art will appreciate that other factor vectors may be calculated similarly, either using matrix multiplications or scalar interactions. The examples shown in FIG. 2B rely on matrix multiplications.
The first similarity matrix 212 b is for semantic similarity measure. It is a n×n matrix where n is the number of unique field values in a field of the fielded dataset. An inner product (also referred to as a dot product) is calculated between word embedding vector of each unique field value in the field with word embedding vector of every other unique field value in the same field of the fielded dataset. These embedding vectors are generated by either Word2Vec word embedding space, GloVe word embedding space, WordNet or any other low dimensional embedding space. The inner product between the word embedding vectors of two unique field values produces scalar values which are represented by variable O_abwhere “a” is the row index and “b” is the column index of the semantic similarity matrix 212 b. The elements of the factor vector are row averages of corresponding rows of the similarity matrix. For example, value of the element y₁of a factor vector FV1 is calculated by taking average of all the values in the first row of the semantic similarity matrix 212 b i.e., O₁₁to O_1n. The factor vector FV₁is composed of elements y₁to y_neach of which is calculated by performing similar row average operations on corresponding rows of the similarity matrix.
Accordingly, similarity matrices are calculated for other similarity measures. FIG. 2B shows calculation of factor vector FV₆using format similarity matrix 218 b. For some similarity measures such as semantic and syntactical similarity, dot products or inner products of vector representations of unique field values of each field in the fielded dataset are calculated with every other unique field value in the same field of the fielded dataset to generate scalars. Row averages or weighted row averages of scalars are used to calculate values of the elements of the factor vectors. For other similarity measures such as soundex and format similarity measures, scalar values are generated by comparing every unique field value in a field with every other unique field value in the same field of the fielded dataset using various underlying algorithms. The scalar values are arranged in n×n matrices. The factor vector values are calculated in the same manner as above by taking row averages or weighted row averages of the scalars in corresponding rows of the similarity matrix. For some other similarity measures, n×n matrices are not generated, rather Z-score for each unique field value in a particular field is calculated and used as elements in the respective factor vector. Examples of such similarity measures include length and frequency of occurrence similarity measures as explained above.
The factor vectors for all similarity measures are arranged column-wise to generate an input matrix 232. The input matrix 232 in FIG. 2B has six factor vectors FV₁to FV₆corresponding to six similarity measures described above. Each row of the input matrix 232 corresponds to a unique field value in a particular field of the fielded dataset 202. Intuitively, an element of a factor vector for a given similarity measure specifies a likelihood that a corresponding unique field value in a field of the fielded dataset is anomalous in a context of the given similarity measure and conditioned on respective similarity measure values of other unique field values in the particular field of the fielded dataset for the given similarity measure.
A row of the input matrix 232 represents a vector that encodes a likelihood that a corresponding unique field value in a particular field of the fielded dataset is anomalous in a context of the plurality of similarity measures and conditionable on respective similarity measure values of other unique field values of the particular of the fielded dataset for the plurality of linguistic similarity measures.
FIG. 3 illustrates processing of the input matrix 232 by convolutional neural network (CNN) of the anomaly detection network 114. The CNN can be a one-layer network or a two-layer network depending on the implementation. In a one-layer CNN, one set of filters are applied to the input matrix 232. In a two-layer CNN, two sets of filters are applied to the input matrix 232. A person skilled in the art will appreciate that additional layers can be added to the CNN. In the first step, 64 filters are row-wise convolved over the input matrix 232. A row-wise convolution of a filter on the input matrix 232 results in an evaluation vector (also referred to as a feature map). Note that the size of the filter is 1×k where k is the number of similarity measures.
For example, filter 1 312 in FIG. 3 is convolved over the first row (y₁, p₁, q₁, s₁, t₁, z₁) of the input matrix 232 to generate a scalar “a₀” at index position “0” of the evaluation vector EV1 322. Convolving the filter 1, 312 over second row (y₂, p₂, q₂, s₂, t₂, z₂) of the input matrix 232 generates a scalar “a₁” at index position “1” of the evaluation vector EV1 322. The same process is followed to generate scalars up to “a_n” in evaluation vector EV1 322 corresponding to “n” rows in the input matrix 232. A second evaluation vector EV2 324 is generated by row-wise convolving a filter 2 314 over the input matrix 232. The result of this convolution are scalars “b₀” to “b_n” in evaluation vector EV2 324. Sixty four (64) evaluation vectors (or feature maps) EV1 322 to EV64 326 are generated by convolving sixty four filters, filter 1 312 to filter 64 316 over the input matrix 232. The evaluation vectors EV1 322 to EV64 326 are provided as input to a fully connected (FC) neural network 332 to accumulate element-wise weighted sums of the evaluation vectors (feature maps) in an output vector 342. For example, the first element FC[0] of the output vector 342 is calculated as weighted sums of corresponding elements in all of the evaluation vectors (feature maps) i.e. W1.EV1[0]+W2.EV2[0]+ . . . +W64.EV64[0]. The output vector 342 has “n” elements corresponding to the “n” rows of the input matrix 232.
A nonlinearity function 352 is applied to the output vector 342 to produce a normalized output vector 362. Examples of nonlinearity functions include sigmoid, hyperbolic tangent (tanh), rectified linear unit (ReLU) and leaky ReLU. A threshold 372 is applied to the normalized output vector 362 to determine anomalous data values. In the anomaly detection network 114, the elements of the output vector 382 represent inverse similarity of corresponding field values in a given field of the fielded dataset. The higher the value of an element of the output vector 382, the higher the likelihood that corresponding field value in the particular field is anomalous. For example, as shown in FIG. 3, the second element O[1] 392 in the output vector 382 is above the threshold 372. Therefore, the second field value (x₂) of the particular field in the dataset 202 is identified as anomalous by the anomaly detection network 114.
Having described the operation of the anomaly detection network 114 in FIG. 3, we now describe the training of the FC neural network 332. In FIG. 3, a forward pass of the anomaly detection network 114 is illustrated. During training, the results of the output vector 382 are compared with ground truth. For example, the anomalous field value x₂(corresponding to O[1] 392) is compared with the correct field value to determine whether the anomaly detection network correctly identified the anomalous word token in the field. In anomaly detection network, two cost functions are used to update the weights in the fully connected neural network FC 332. The reason for using two cost functions is to avoid the anomaly detection network 114 from moving towards a everything-non-anomaly solution since anomalies are a small portion of a typical field of the fielded dataset. An additional benefit of using two cost functions is to use different learning rates to achieve a balance between anomaly and non-anomaly detection. This results in more accurate detection of anomalous field values as anomalous as well as more accurate detection of non-anomalous field values as non-anomalous.
The training data for the anomaly detection network 114 is automatically generated by constructing positive and negative examples for inclusion in the training database 142. For each linguistic similarity measure a first set of field values are identified from a vocabulary which are similar to each other. A second set of field values are identified from the vocabulary that are dissimilar to each of the field values in the first set and the field values selected so far in the second set. The training dataset for the given linguistic similarity measure is generated by randomly selecting some field values from the first and second sets as positive and negative examples respectively. This process is repeated for the five linguistic similarity measures described above: semantic similarity, syntactical similarity, soundex similarity, length similarity and format similarity. For frequency similarity, the system randomly multiplies each of the unique input field value to increase its frequency of occurrence in the particular field of the fielded dataset.
FIG. 4A shows a high level view of an anomaly detection network 114 with one convolution layer while FIG. 4B shows the same with two convolution layers.

Suggestion Network

FIG. 5A illustrates operation of the input generator 112 to generate input data for suggestion network 116. The input generator 112 takes a dataset 502 as input. During training the dataset 502 is generated from the training database 142 and during production, the dataset 502 is generated from the testing database 144. The dataset 502 is composed of field values. In the more common use case, these values are word tokens. In other implementations, these can be character tokens or phrase tokens. An example of a word token is “John” and an example of a phrase token is “J. P. Morgan”. The dataset 202 is a fielded dataset which means it can have fields such as “First Name”, “Last Name”, “Company Name”, “Country” etc., and data is organized as field values in the fields.
As opposed to the input dataset 202 for the anomaly detection network 114, the input dataset 502 contains field values x₁to x_nthat are non-anomalous. In one implementation, the input dataset 502 contain the field values that have been processed by the anomaly detection network 114. The anomalous values have been identified and removed from the input dataset 502. In addition to the “n” non-anomalous field values x₁to x_nin a field, the input dataset 502 also contains an input value also referred to as a target label (TL). The suggestion network 116 suggests one or more unique field values from the “n” non-anomalous field values to replace the target label (TL).
As described above for the anomaly detection network 114, the input generator 112, generates factor vectors 530 for a plurality of similarity measures (also referred to as linguistic similarity measures) for the suggestion network 116. Suggestion network 116 uses the same six similarity measures as anomaly detection network 114: semantic similarity, syntactic similarity, soundex similarity, format similarity, length similarity, and frequency similarity. A factor vector calculator 210 contains similarity measure calculators for each of the similarity measures. FIG. 2A shows six similarity measure calculators corresponding to six similarity measure listed above. The calculations of similarity measures is the same as explained above in the anomaly detection network 114. The semantic similarity calculator 212 calculates semantic similarity measure, the syntactical similarity calculator 214 calculates syntactical similarity measure, the soundex similarity calculator 216 calculates soundex similarity measure, the length similarity calculator 218 calculates length similarity measure, the frequency of occurrence similarity calculator 220 calculates frequency similarity measure and the format similarity measure calculator 222 calculates format similarity measure.
In case of anomaly detection network 114, similarity measures are calculated for every unique field value with every other unique field value in a particular field of the fielded dataset. In suggestion network 116, similarity measures are calculated for each unique input field value with the target label (TL). In anomaly detection network 114, the most dissimilar input field value is recommended as anomalous. In suggestion network 116, the most similar input field value (to the target label) is recommended to replace the target label. In another implementation, more than one similar input field values are recommended as replacement values for the target label. Further evaluation of the recommended input field values is performed by an expert to select one unique field value to replace the target label.
Turning to the example factor vector calculator 210 shown in FIG. 5A, the six similarity calculators generate six factor vectors 530 corresponding to the six similarity measures. The six factor vectors are denoted by the variables “y”, “p”, “q”, “s”, “t”, and “z”. Each factor comprises as many elements as words in a field of the fielded dataset. As shown in the example dataset 502, there are “n” words x₁to x_nin a field. Each word is also referred to as a field value. Each of the six factor vectors 530 consists of “n” values. For example, the first factor vector consists of the values y₁to y_nthe second factor vector consists of the values p₁to p_n, the third factor vector consists of the values q₁to q_n, the fourth factor vector consists of the values s₁to s_n, the fifth factor vector consists of the values t₁to t_nand the sixth factor vector consists of the values z₁to z_n. When arranged column-wise, the six example factor vectors 530 shown in FIG. 5A form an input matrix which is shown in FIG. 5B referred to by a numeral 532. The input matrix 532 is given as input to the suggestion network 116 by the input generator 112.
FIG. 5B shows further details of how factor vectors are calculated for similarity measures listed above. In FIG. 5B, factor vector calculations of two similarity measures are shown as an example. As opposed to the anomaly detection network 114, for the suggestion network 116, the semantic similarity matrix 542 and format similarity matrix 548 compare only the target label (TL) with the input field values x₁to x_n. A person skilled in the art will appreciate that other factor vectors may be calculated similarly either using matrix multiplications or scalar interactions. The examples shown in FIG. 5B rely on matrix multiplications.
The first similarity matrix 542 is for calculation of semantic similarity measure. It is an n×1 matrix where n is the number of unique field values in a field in the fielded dataset. An inner product (also referred to as a dot product) is calculated between word embedding vector of each unique field value in the field with word embedding vector of target label. These embedding vectors are provided by either Word2Vec word embedding space, GloVe word embedding space, WordNet or any other low dimensional embedding space. The inner product between the word embedding vectors of two unique field values produces scalar values which are represented by variable O_awhere “a” is the row index of the semantic similarity matrix 542. The elements of the factor vector correspond to the rows of the similarity matrix. For example, value of the element y₁of a factor vector FV1 is equal to O₁. The factor vector FV1 is composed of elements y₁to y_neach of which is calculated by performing similar row operations on corresponding rows of the similarity matrix.
Accordingly, similarity matrices are calculated for other similarity measures. For some similarity measures such as semantic and syntactical similarity, dot products or inner products of vector representations of field values of each field in the fielded dataset are calculated with target label to generate scalars. Factor vectors are generated using the row values in similarity matrices. For other similarity measures such as soundex and format similarity measures, scalar values are generated by comparing every field value in a field with the target label using various underlying algorithms. The scalar values are arranged in n×1 matrices. The factor vector values are calculated in the same manner as above by using values of the scalars in corresponding rows of the similarity matrix. For some other similarity measures, n×1 matrices are not generated, rather Z-score for each field value in a field is calculated and used as elements in the corresponding factor vector. Examples of such similarity measures include length and frequency of occurrence similarity measures.
The factor vectors for all similarity measures are arranged column-wise to generate an input matrix 532. The input matrix 532 in FIG. 5B has six factor vectors FV₁to FV₆corresponding to six similarity measures described above. Each row of the input matrix 532 corresponds to a field value in a field of the fielded dataset 202. Intuitively, an element of the factor vector for the given similarity measure specifies a likelihood that a corresponding unique field value in the dataset is similar to the target label in a context of the given similarity measure and conditioned on respective similarity measure values of other unique field values in the dataset for the given similarity measure.
A row of the input matrix represents a vector that encodes a likelihood that a corresponding unique field value in the dataset is similar to the target label in a context of the plurality of linguistic similarity measures and conditionable on respective similarity measure values of other unique field values in the dataset for the plurality of linguistic similarity measures.
FIG. 6 illustrates processing of the input matrix 532 by convolutional neural network (CNN) of the suggestion network 116. The CNN is a one-layer network. In a one-layer CNN, one set of filters are applied to the input matrix 532. A person skilled in the art will appreciate that additional layers can be added to the CNN. In the first step, 64 filters are row-wise convolved over the input matrix 532. A row-wise convolution of a filter on the input matrix 532 results in an evaluation vector (also referred to as a feature map).
For example, filter 1 612 in FIG. 6 is convolved over the first row (y₁, p₁, q₁, s₁, t₁, z₁) of the input matrix 532 to generate a scalar “a₀” at index position “0” of the evaluation vector EV1 622. Convolving the filter 1, 612 over second row (y₂, p₂, q₂, s₂, t₂, z₂) of the input matrix 532 generates a scalar “a₁” at index position “1” of the evaluation vector EV1. The same process is followed to generate scalars up to “a_n” in evaluation vector EV1 corresponding to “n” rows in the input matrix 532. A second evaluation vector EV2 624 is generated by row-wise convolving a filter 2 614 over the input matrix 532. The result of this convolution are scalars “b₀” to “b_n” in evaluation vector EV2 624. Sixty four (64) evaluation vectors (or feature maps) EV1 622 to EV64 626 are generated by convolving sixty four filters, filter 1 612 to filter 64 616 over the input matrix 532. The evaluation vectors EV1 622 to EV64 626 are provided as input to a fully connected (FC) neural network 632 to accumulate element-wise weighted sums of the evaluation vectors (feature maps) in an output vector 642. For example, the first element FC[0] of the output vector 642 is calculated as weighted sums of corresponding elements in all of the evaluation vectors (feature maps) i.e. W1.EV1[0]+W2.EV2[0]+ . . . +W64.EV64[0]. The output vector 642 has “n” elements corresponding to the “n” rows of the input matrix 532.
A nonlinearity function 652 is applied to the output vector 642 to produce a normalized output vector 662. Examples of nonlinearity functions include sigmoid, hyperbolic tangent (tanh), rectified linear unit (ReLU) and leaky ReLU. A threshold 672 is applied to the normalized output vector 662 to determine similar data values. In suggestion network 116, the elements of the output vector 682 represent similarity of corresponding field values in a given input field of the fielded dataset to the target label. The higher the value of an element of the output vector 682, the higher the likelihood that corresponding field values in the input field is similar to the target label. For example, as shown in FIG. 6, the first element in the output vector is above the threshold 672. Therefore, this element (x₁) of the input field in the dataset 502 is recommended by the suggestion network as a replacement for target label. In another implementation multiple input field values can be recommended by the suggestion network 116. An expert can select one input field value from the suggested values to replace the target label.
Having described the operation of the suggestion network 116 in FIG. 6, we now describe the training of the FC neural network 632. In FIG. 6, a forward pass of the suggestion network 116 is described. During training, the results of the output vector 682 are compared with ground truth. For example, the suggested field value 682 is compared with the correct value to determine whether the suggestion network correctly identified the replacement field value in the field. In suggestion network 116, one cost function is used to update the weights in the fully connected neural network FC 632. For example, as shown in FIG. 6, the first element O[0] 692 in the output vector 682 is above the threshold 372. Therefore, the first field value (x₁) of the particular field in the dataset 502 is used to replace the anomalous input field or the target label (TL) by the suggestion network 116.
The training data for the suggestion network 116 is automatically generated by constructing positive and negative examples for inclusion in the training dataset. For each linguistic similarity measure a first set of field values are identified from a vocabulary which are similar to each other. A second set of field values are also identified from the vocabulary that are dissimilar to each of the field values in the first set and the field values selected so far in the second set. The training dataset for the given linguistic similarity measure is generated by randomly selecting some field values from the first and second sets as positive and negative examples respectively. This process is repeated for the five linguistic similarity measures described above: semantic similarity, syntactical similarity, soundex similarity, length similarity and format similarity. For frequency similarity, the system randomly multiplies each of the unique field value to increase its frequency of occurrence in the particular field of the fielded dataset. A target label is randomly selected from a set of anomalous data values.
FIG. 7 shows a high level view of a suggestion network 116 with one convolution layer.

Computer System

FIG. 8 is a simplified block diagram 800 of a computer system 810 that can be used to implement the machine learning system 110. Computer system 810 typically includes at least one processor 814 that communicates with a number of peripheral devices via bus subsystem 812. These peripheral devices can include a storage subsystem 824 including, for example, memory devices and a file storage subsystem, user interface input devices 822, user interface output devices 820, and a network interface subsystem 816. The input and output devices allow user interaction with computer system 810. Network interface subsystem 816 provides an interface to outside networks, including an interface to corresponding interface devices in other computer systems.
User interface input devices 822 can include a keyboard; pointing devices such as a mouse, trackball, touchpad, or graphics tablet; a scanner; a touch screen incorporated into the display; audio input devices such as voice recognition systems and microphones; and other types of input devices. In general, use of the term “input device” is intended to include all possible types of devices and ways to input information into computer system 810.
User interface output devices 820 can include a display subsystem, a printer, a fax machine, or non-visual displays such as audio output devices. The display subsystem can include a cathode ray tube (CRT), a flat-panel device such as a liquid crystal display (LCD), a projection device, or some other mechanism for creating a visible image. The display subsystem can also provide a non-visual display such as audio output devices. In general, use of the term “output device” is intended to include all possible types of devices and ways to output information from computer system 810 to the user or to another machine or computer system.
Storage subsystem 824 stores programming and data constructs that provide the functionality of some or all of the modules and methods described herein. These software modules are generally executed by processor 814 alone or in combination with other processors.
Memory subsystem 826 used in the storage subsystem can include a number of memories including a main random access memory (RAM) 830 for storage of instructions and data during program execution and a read only memory (ROM) 832 in which fixed instructions are stored. A file storage subsystem 828 can provide persistent storage for program and data files, and can include a hard disk drive, a floppy disk drive along with associated removable media, a CD-ROM drive, an optical drive, or removable media cartridges. The modules implementing the functionality of certain implementations can be stored by file storage subsystem 828 in the storage subsystem 824, or in other machines accessible by the processor.
Bus subsystem 812 provides a mechanism for letting the various components and subsystems of computer system 810 communicate with each other as intended. Although bus subsystem 812 is shown schematically as a single bus, alternative implementations of the bus subsystem can use multiple busses.
Computer system 810 can be of varying types including a workstation, server, computing cluster, blade server, server farm, or any other data processing system or computing device. Due to the ever-changing nature of computers and networks, the description of computer system 810 depicted in FIG. 8 is intended only as one example. Many other configurations of computer system 810 are possible having more or fewer components than the computer system depicted in FIG. 8.

Particular Implementations

Anomaly Detection Network
The technology disclosed relates to detection of anomalous field values for a particular field in a fielded dataset.
The technology disclosed can be practiced as a system, method, or article of manufacture. One or more features of an implementation can be combined with the base implementation. Implementations that are not mutually exclusive are taught to be combinable. One or more features of an implementation can be combined with other implementations. This disclosure periodically reminds the user of these options. Omission from some implementations of recitations that repeat these options should not be taken as limiting the combinations taught in the preceding sections—these recitations are hereby incorporated forward by reference into each of the following implementations.
A first system implementation of the technology disclosed includes one or more processors coupled to the memory. The memory is loaded with computer instructions to detect an anomalous field value. The system determines which field values for a particular field in a fielded dataset are anomalous. The system compares a particular unique field value to the other unique field values for the particular field by applying a plurality of similarity measures and generates a factor vector that has one scalar for each of the unique field values. The system then compares the factor vector using convolution filters in a convolutional neural network (abbreviated CNN) to generate evaluation vectors (also referred to as feature maps). The system further evaluates the evaluation vectors using a fully connected (abbreviated FC) neural network to produce an anomaly scalar for the particular unique field value. A threshold is applied to the anomaly scalar to determine whether the particular unique field value is anomalous.
This system implementation and other systems disclosed optionally include one or more of the following features. System can also include features described in connection with methods disclosed. In the interest of conciseness, alternative combinations of system features are not individually enumerated. Features applicable to systems, methods, and articles of manufacture are not repeated for each statutory class set of base features. The reader will understand how features identified in this section can readily be combined with base features in other statutory classes.
The system uses a plurality of similarity measures including semantic similarity, syntactic similarity, soundex similarity, character-by-character format similarity, field length similarity, and dataset frequency similarity.
The system further includes determining that one or more field values in the fielded dataset are similar to an input value (also referred to as a target label) for a particular field. The system compares a particular input value to the unique field values for the particular input field by applying a plurality of similarity measures. This results in generation of a factor vector that has one scalar for each of the unique field values. The system evaluates the factor vector using the convolution filters in the CNN to generate evaluation vectors (also referred to as feature maps) for similarity to the unique field values. The system uses the suggestion scalars to determine one or more suggestion candidates for the particular input value.
The system includes calculating factor vectors for some of the similarity measures by calculating an inner product between respective similarity measure values of the unique field values in the dataset to form a similarity matrix. A row-wise average of the inner product results in the similarity matrix is calculated. A factor vector is formulated for the given similarity measure by arranging the row-wise averages as elements of the factor vector.
An element of the factor vector the given linguistic similarity measure specifies a likelihood that a corresponding unique field value in the dataset is anomalous in a context of the given linguistic similarity measure. Additionally, the element of the factor vector is also conditioned on respective similarity measure values of other unique values in the dataset for the given linguistic similarity measure.
The system generates an input for the convolutional neural network (abbreviated CNN) by column-wise arranging the factor vectors in an input matrix. In such an implementation, the convolution filters apply row-wise on the input matrix. Further, in such an implementation, a row in the input matrix represents a vector that encodes a likelihood that a corresponding unique field value in the dataset is anomalous in a context of the plurality of linguistic similarity measures and conditionable on respective similarity measure values of other unique field values in the dataset for the plurality of linguistic similarity measures.
The system automatically constructs positive and negative examples for inclusion in a training dataset. For a given linguistic similarity measure, the system constructs the training dataset by determining a first set of similar field values from a vocabulary and determines a second set of dissimilar field values from the vocabulary. The system then randomly selects some field values from the first set as positive examples and the second set as negative examples respectively. The system repeats the above process for each linguistic similarity measure to determine and select positive and negative training examples. The system stores the randomly selected field values for the plurality of similarity measures as the training dataset.
The system trains the convolutional neural network (CNN) and the fully connected (FC) neural network using the positive and negative examples in the training dataset.
The system uses at least two cost functions to evaluate performance of the CNN and the FC neural network during training. A first cost function evaluates classification of unique field values as anomalies and a second cost function evaluates classification of unique field values as non-anomalies. In such an implementation, the system calculates separate gradients for the two cost functions and backpropagates the gradients to the CNN and the FC neural network during training.
In one implementation of the system, the convolutional neural network (CNN) is a one-layer CNN. In another implementation of the system, the convolutional neural network is a two-layer CNN.
A second system implementation of the technology disclosed includes one or more processors coupled to the memory. The memory is loaded with computer instructions to detect linguistically anomalous field values in a dataset. The system calculates at least one factor vector for each of a plurality of linguistic similarity measures. For each linguistic similarity measure, the system calculates its factor vector by averaging product results and/or distribution values calculated from similarity measure values of unique field values in the dataset for the given linguistic similarity measure. The factor vectors are provided as input to a convolutional neural network (abbreviated CNN). The system applies convolution filters to the factor vectors to generate evaluation vectors (also referred to as feature maps). Following this, the system provides the evaluation vectors as input to a fully-connected (abbreviated FC) neural network to accumulate element-wise weighted sums of the evaluation vectors in an output vector. Following this, the system applies a nonlinearity function to the output vector to produce a normalized output vector. Finally, the system applies thresholding to the normalized output vector to identify anomalous and similar field values in the dataset.
Each of the features discussed in this particular implementation section for the first system implementation apply equally to the second system implementation. As indicated above, all the system features are not repeated here and should be considered repeated by reference.
Other implementations may include a non-transitory computer readable storage medium storing instructions executable by a processor to perform functions of the system described above. Yet another implementation may include a method performing the functions of the system described above.
A first method implementation of the technology disclosed includes detecting anomalous field values. The method includes, determining which field values for a particular field in a fielded dataset are anomalous. A particular unique field value is compared to other unique field values for the particular field by applying a plurality of similarity measures and generating a factor vector that has one scalar for each of the unique field values. The method then compares the factor vector using convolution filters in a convolutional neural network (abbreviated CNN) to generate evaluation vectors (also referred to as feature maps). The method further evaluates the evaluation vectors using a fully connected (abbreviated FC) neural network to produce an anomaly scalar for the particular unique field value. A threshold is applied to the anomaly scalar to determine whether the particular unique field value is anomalous.
Each of the features discussed in this particular implementation section for the first system implementation apply equally to this method implementation. As indicated above, all the system features are not repeated here and should be considered repeated by reference.
Other implementations may include a non-transitory computer readable storage medium storing instructions executable by a processor to perform the first method described above. Yet another implementation may include a system including memory and one or more processors operable to execute instructions, stored in the memory, to perform the first method described above.
Computer readable media (CRM) implementations of the technology disclosed include a non-transitory computer readable storage medium impressed with computer program instructions, when executed on a processor, implement the method described above.
Each of the features discussed in this particular implementation section for the first system implementation apply equally to the CRM implementation. As indicated above, all the system features are not repeated here and should be considered repeated by reference.
A second method implementation of the technology disclosed includes detecting linguistically anomalous field values in a dataset. The method includes calculating at least one factor vector for each of a plurality of linguistic similarity measures. For a given linguistic similarity measure, the method calculates its factor vector by averaging product results and/or distribution values calculated from similarity measure values of unique field values in the dataset for the given linguistic similarity measure. The method includes providing the factor vectors as input to a convolutional neural network (abbreviated CNN) and applying convolution filters to the factor vectors to generate evaluation vectors (also referred to as feature maps). Following this, the method includes providing the evaluation vectors as input to a fully-connected (abbreviated FC) neural network to accumulate element-wise weighted sums of the evaluation vectors in an output vector. Following this, the method includes applying a nonlinearity function to the output vector to produce a normalized output vector. Finally, the method includes thresholding the normalized output vector to identify anomalous and similar field values in the dataset.
Each of the features discussed in this particular implementation section for the first system implementation apply equally to this method implementation. As indicated above, all the system features are not repeated here and should be considered repeated by reference.
Other implementations may include a non-transitory computer readable storage medium storing instructions executable by a processor to perform the method described above. Yet another implementation may include a system including memory and one or more processors operable to execute instructions, stored in the memory, to perform the method described above.
Computer readable media (CRM) implementations of the technology disclosed include a non-transitory computer readable storage medium impressed with computer program instructions, when executed on a processor, implement the second method described above.
Each of the features discussed in this particular implementation section for the first system implementation apply equally to the CRM implementation. As indicated above, all the system features are not repeated here and should be considered repeated by reference.

Suggestion Network

A third system implementation of the technology disclosed includes one or more processors coupled to the memory. The memory is loaded with computer instructions to suggest one or more candidates for a particular input value. The system determines that one or more field values in a set of field values are similar to an input value for a particular field in a fielded dataset. The system performs this determination by comparing a particular input value to unique field values for the particular field by applying a plurality of similarity measures and generating a factor vector that has one scalar for each of the unique field values. Following this, the system evaluates the factor vector using convolution filters in a convolutional neural network (CNN) to generate evaluation vectors (also referred to as feature maps) for similarity to the unique field values. The system further evaluates the evaluation vectors using a fully-connected (FC) neural network to produce suggestion scalars for similarity to the particular input value. Finally, the system uses the suggestion scalars to determine one or more suggestion candidates for the particular input value.
This system implementation and other systems disclosed optionally include one or more of the following features. System can also include features described in connection with methods disclosed. In the interest of conciseness, alternative combinations of system features are not individually enumerated. Features applicable to systems, methods, and articles of manufacture are not repeated for each statutory class set of base features. The reader will understand how features identified in this section can readily be combined with base features in other statutory classes.
The system uses a plurality of similarity measures including semantic similarity, syntactic similarity, soundex similarity, character-by-character format similarity, field length similarity, and dataset frequency similarity.
The system constructs an input to the CNN by column-wise arranging one or more factor vectors in an input matrix. In such an implementation, the convolution filters apply row-wise on the input matrix.
The system automatically constructs positive and negative examples for inclusion in a training dataset. For a given linguistic similarity measure, the system determines a first set of similar field values from a vocabulary and determines a second set of dissimilar field values from the vocabulary. Following this, the system randomly selects some field values from the first and second sets as positive and negative examples respectively. The system repeats the above process of determining the first set and the second set of field values for a plurality of similarity measures. Finally, the system stores the randomly selected field values for the plurality of similarity measures as the training dataset.
In such an implementation, the system further includes training the CNN and the FC neural network using the positive and negative examples in the training dataset.
The system uses at least one cost function to evaluate performance of the CNN and the FC neural network during training.
In one implementation of the system, the convolutional neural network (CNN) is a one-layer CNN. In another implementation of the system, the convolutional neural network (CNN) is a two-layer CNN.
Other implementations may include a non-transitory computer readable storage medium storing instructions executable by a processor to perform functions of the system described above. Yet another implementation may include a method performing the functions of the system described above.
In one implementation, the system includes, determining which field values for a particular field in the fielded dataset are anomalous. The system performs this determination by comparing a particular unique field value to other unique field values for the particular field by applying a plurality of similarity measures and generating a factor vector that has one scalar for each of the unique field values. Following this, the system evaluates the factor vector using the convolution filters in the CNN to generate evaluation vectors (also referred to as feature maps). The system further evaluates the evaluation vectors using the FC neural network to produce an anomaly scalar for the particular unique field value. Finally, the system applies thresholding to the anomaly scalar to determine whether the particular unique field value is anomalous.
A third method implementation of the technology disclosed includes suggesting one or more candidates for a particular input value. The method includes, determining that one or more field values in a set of field values are similar to an input value for a particular field in a fielded dataset. The method performs this determination by comparing a particular input value to unique field values for the particular field by applying a plurality of similarity measures and generating a factor vector that has one scalar for each of the unique field values. Following this, the method evaluates the factor vector using convolution filters in a convolutional neural network (CNN) to generate evaluation vectors (also referred to as feature maps) for similarity to the unique field values. The method further evaluates the evaluation vectors using a fully-connected (FC) neural network to produce suggestion scalars for similarity to the particular input value. Finally, the method uses the suggestion scalars to determine one or more suggestion candidates for the particular input value.
Each of the features discussed in this particular implementation section for the third system implementation apply equally to this method implementation. As indicated above, all the system features are not repeated here and should be considered repeated by reference.
Other implementations may include a non-transitory computer readable storage medium storing instructions executable by a processor to perform the third method described above. Yet another implementation may include a system including memory and one or more processors operable to execute instructions, stored in the memory, to perform the first method described above.
Computer readable media (CRM) implementations of the technology disclosed include a non-transitory computer readable storage medium impressed with computer program instructions, when executed on a processor, implement the method described above.
Each of the features discussed in this particular implementation section for the third system implementation apply equally to the CRM implementation. As indicated above, all the system features are not repeated here and should be considered repeated by reference.
The technology disclosed, and particularly the anomaly detection network 114 and the suggestion network 116, can be implemented in the context of any computer-implemented system including a database system, a multi-tenant environment, or a relational database implementation like an Oracle™ compatible database implementation, an IBM DB2 Enterprise Server™ compatible relational database implementation, a MySQL™ or PostgreSQL™ compatible relational database implementation or a Microsoft SQL Server™ compatible relational database implementation or a NoSQL™ non-relational database implementation such as a Vampire™ compatible non-relational database implementation, an Apache Cassandra™ compatible non-relational database implementation, a BigTable™ compatible non-relational database implementation, or an HBase™ or DynamoDB™ compatible non-relational database implementation. In addition, the technology disclosed can be implemented using different programming models like MapReduce™, bulk synchronous programming, MPI primitives, etc., or different scalable batch and stream management systems like Amazon Web Services (AWS)™, including Amazon Elasticsearch Service™ and Amazon Kinesis™, Apache Storm™ Apache Spark™, Apache Kafka™, Apache Flink™, Truviso™, IBM Info-Sphere™, Borealis™ and Yahoo! S4™.
Any data structures and code described or referenced above are stored according to many implementations on a computer-readable storage medium, which may be any device or medium that can store code and/or data for use by a computer system. This includes, but is not limited to, volatile memory, non-volatile memory, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), magnetic and optical storage devices such as disk drives, magnetic tape, CDs (compact discs), DVDs (digital versatile discs or digital video discs), or other media capable of storing computer-readable media now known or later developed.
The preceding description is presented to enable the making and use of the technology disclosed. Various modifications to the disclosed implementations will be apparent, and the general principles defined herein may be applied to other implementations and applications without departing from the spirit and scope of the technology disclosed. Thus, the technology disclosed is not intended to be limited to the implementations shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein. The scope of the technology disclosed is defined by the appended claims.

Claims

What is claimed is:

1. A system of an anomaly detection network, including:

a communication interface receiving a set of input values in a format of an input matrix;

a memory storing the anomaly detection network comprising one or more convolution layers and a fully-connected layer connected to the one or more convolution layers;

one or more processors coupled to the memory to perform operations based on the anomaly detection network, comprising:

generating, by the one or more convolution layers, one or more evaluation vectors from the input matrix,

generating, by the fully-connected layer, accumulated element-wise weighted sums of the one or more evaluation vectors to form an output vector, and

determining an indication that suggests an anomaly in the set of input values based on the output vector.

2. The system of claim 1, wherein the set of input values are for a particular field in a fielded dataset.

3. The system of claim 1, wherein the one or more convolution layers includes at least one convolutional filter that convolve a first row of the input matrix to compute a first entry in a first evaluation vector in the one or more evaluation vectors.

4. The system of claim 1, wherein the memory further stores a factor vector calculator connected to the one or more convolution layers, and the factor vector calculator comprises a plurality of similarity measure calculators configured to apply a plurality of similarity measures to the set of input values, respectively, and

wherein the factor vector calculator is further configured to compute factor vectors based on the plurality of similarity measures to form the input matrix.

5. The system of claim 3, wherein the plurality of similarity measures include any combination of semantic similarity, syntactic similarity, soundex similarity, character-by-character format similarity, field length similarity, and dataset frequency similarity.

6. The system of claim 1, wherein the memory further stores a non-linear module connected to the fully-connected layer,

wherein the non-linear module is configured to normalize the output vector by any of a sigmoid function, a hyperbolic tangent (tanh) function, a rectified linear unit (ReLU) and a leaky ReLU.

7. The system of claim 1, wherein the operations further comprise:

determining whether the set of input values contains the anomaly by comparing each entry in the output vector with a pre-defined threshold.

8. The system of claim 1, wherein the operations further comprise:

determining one or more suggestion candidates to replace a particular input value in the set of input values based on a corresponding entry that corresponds to the particular input value in the output vector.

9. A method for anomaly detection in a set of fields values, the method comprising:

receiving, via a communication interface, a set of input values in a format of an input matrix;

generating, by one or more convolution layers, one or more evaluation vectors from the input matrix,

generating, by a fully-connected layer connected to the one or more convolution layers, accumulated element-wise weighted sums of the one or more evaluation vectors to form an output vector, and

10. The method of claim 9, wherein the one or more convolution layers includes at least one convolutional filter that convolve a first row of the input matrix to compute a first entry in a first evaluation vector in the one or more evaluation vectors.

11. The method of claim 9, further comprising:

applying, by a factor vector calculator connected to the one or more convolution layers, a plurality of similarity measures to the set of input values, respectively; and

computing factor vectors based on the plurality of similarity measures to form the input matrix.

12. The method of claim 11, wherein the plurality of similarity measures include any combination of semantic similarity, syntactic similarity, soundex similarity, character-by-character format similarity, field length similarity, and dataset frequency similarity.

13. The method of claim 9, further comprising:

normalizing, by a non-linear function module, the output vector by any of a sigmoid function, a hyperbolic tangent (tanh) function, a rectified linear unit (ReLU) and a leaky ReLU.

14. The method of claim 9, further comprising:

15. The method of claim 1, further comprising:

16. A non-transitory processor-executable storage medium storing a plurality of processor-executable instructions for anomaly detection in a set of fields values, the instructions being executed by a processor to perform operations comprising:

receiving a set of input values in a format of an input matrix;

17. The non-transitory processor-executable storage medium of claim 16, wherein the one or more convolution layers includes at least one convolutional filter that convolve a first row of the input matrix to compute a first entry in a first evaluation vector in the one or more evaluation vectors.

18. The non-transitory processor-executable storage medium of claim 16, wherein the operations further comprise:

19. The non-transitory processor-executable storage medium of claim 16, wherein the operations further comprise:

20. The non-transitory processor-executable storage medium of claim 16, wherein the operations further comprise: