Anomaly score adjustment across anomaly generators

Abstract

Techniques are disclosed for generating an anomaly score for a neuro-linguistic model of input data obtained from one or more sources. According to one embodiment, generating an anomaly score comprises receiving a score indicating how often a characteristic is observed in the input data. Upon receiving the score, comparing the score with an unusual score model to determine an unusualness score and comparing the unusualness score with an anomaly score model based on one or more unusual score models to generate the anomaly score indicating an overall unusualness for the input data.

1 . A method, comprising:
 generating an unusualness score based on a raw unusualness score and a plurality of historical unusualness scores, the raw unusualness score being generated using a neuro-linguistic model and based on a plurality of vectors representing an input data;   updating the neuro-linguistic model based on the unusualness score, to produce an updated neuro-linguistic model; and   causing transmission of a signal representing the updated neuro-linguistic model.   
     
     
         2 . The method of  claim 1 , wherein the input data includes data from at least one of a video data source, a supervisory control and data acquisition (SCADA) system, or a data network security system. 
     
     
         3 . The method of  claim 1 , wherein the generating the unusualness score includes comparing the raw unusualness score with at least one of: an unusual word model, an unusual syntax model, or an unusual map model. 
     
     
         4 . The method of  claim 1 , wherein generating the unusualness score includes:
 generating a value within a range of 0 to 1, where 0 represents a lowest unusualness and 1 represents a highest unusualness; and   associating the value with a percentile ranking representing a percentage of scores from a distribution of scores that the unusualness score is one of greater than or equal to, where 0 represents a 0 th  percentile and 1 represents a 100 th  percentile, thereby normalizing the unusualness score.   
     
     
         5 . The method of  claim 1 , further comprising:
 generating an alert based on the unusualness score; and   causing transmission of a signal representing the alert.   
     
     
         6 . The method of  claim 1 , wherein the raw unusualness score represents a frequency with which a characteristic is observed in the input data. 
     
     
         7 . The method of  claim 1 , wherein the unusualness score represents an unusualness of the raw unusualness score as compared with the plurality of historical raw unusualness scores. 
     
     
         8 . A non-transitory processor-readable medium storing code representing instructions to cause a processor to:
 generate an unusualness score based on a raw unusualness score and a plurality of historical unusualness scores, the raw unusualness score being generated using a neuro-linguistic model and based on a plurality of vectors representing an input data;   update the neuro-linguistic model based on the unusualness score, to produce an updated neuro-linguistic model; and   cause transmission of a signal representing the updated neuro-linguistic model.   
     
     
         9 . The non-transitory processor-readable medium of  claim 8 , wherein the input data includes data from at least one of a video data source, a supervisory control and data acquisition (SCADA) system, or a data network security system. 
     
     
         10 . The non-transitory processor-readable medium of  claim 8 , wherein the instructions to cause the processor to generate the unusualness score include instructions to compare the raw unusualness score with at least one of: an unusual word model, an unusual syntax model, or an unusual map model. 
     
     
         11 . The non-transitory processor-readable medium of  claim 8 , wherein the instructions to cause the processor to generate the unusualness score include instructions to:
 generate a value within a range of 0 to 1, where 0 represents a lowest unusualness and 1 represents a highest unusualness; and   associate the value with a percentile ranking representing a percentage of scores from a distribution of scores that the unusualness score is one of greater than or equal to, where 0 represents a 0 th  percentile and 1 represents a 100 th  percentile, thereby normalizing the unusualness score.   
     
     
         12 . The non-transitory processor-readable medium of  claim 8 , further storing code representing instructions to cause the processor to:
 generate an alert based on the unusualness score; and   cause transmission of a signal representing the alert.   
     
     
         13 . The non-transitory processor-readable medium of  claim 8 , wherein the raw unusualness score represents a frequency with which a characteristic is observed in the input data. 
     
     
         14 . The non-transitory processor-readable medium of  claim 8 , wherein the unusualness score represents an unusualness of the raw unusualness score as compared with the plurality of historical raw unusualness scores. 
     
     
         15 . A system, comprising:
 a memory; and,   a processor operatively coupled to the memory, the processor configured to:
 generate, using a neuro-linguistic module, an unusualness score based on a raw unusualness score and a plurality of historical unusualness scores, the raw unusualness score being generated using a neuro-linguistic model and based on a plurality of vectors representing an input data received from a sensor management module; 
 update the neuro-linguistic model based on the unusualness score, to produce an updated neuro-linguistic model; and 
 cause transmission of a signal representing the updated neuro-linguistic model. 
   
     
     
         16 . The system of  claim 15 , wherein the input data is data from at least one of a video data source, a supervisory control and data acquisition (SCADA) system, or a data network security system. 
     
     
         17 . The system of  claim 15 , wherein the processor is configured to generate the unusualness score by comparing the raw unusualness score with at least one of: an unusual word model, an unusual syntax model, or an unusual map model. 
     
     
         18 . The system of  claim 15 , wherein the processor is configured to generate the unusualness score by:
 generating a value within a range of 0 to 1, where 0 represents a lowest unusualness and 1 represents a highest unusualness; and   associating the value with a percentile ranking representing a percentage of scores from a distribution of scores that the unusualness score is one of greater than or equal to, where 0 represents a 0 th  percentile and 1 represents a 100 th  percentile, thereby normalizing the unusualness score.   
     
     
         19 . The system of  claim 15 , wherein the processor is further configured to:
 generate an alert based on the unusualness score; and   cause transmission of a signal representing the alert.   
     
     
         20 . The system of  claim 15 , wherein the raw unusualness score represents a frequency with which a characteristic is observed in the input data. 
     
     
         21 . The system of  claim 15 , wherein the unusualness score represents an unusualness of the raw unusualness score as compared with the plurality of historical raw unusualness scores.