Patent ID: 7792770

Claim:
A computer implemented method for identifying anomalous data points in a data set {X(i)}, each data point X(i) having a series of associated attributes {Xat(i)}, each associated attribute Xat(I) having a value, said method using a predetermined training data set {T(i)}, each member of said training data set having a series of associated attributes {Tat(i)}, each associated attribute having a value, where a first subset of said training data set has a prior determined classification as “normal” and a second subset of said training data set has a prior determined classification as “anomalous,” the method executing on a computer system having a processor, an input device and an output device, said method comprising the steps of: (a) inputting said training data set; (b) clustering said training data set into disjoint K-clusters using: (i) a predetermined metric and (ii) a first predetermined number of said attributes {Tat(i)} (the “Clustering Attributes”), for each said training data set K-cluster, calculating a K-cluster center and a classification as “normal” or “anomalous,” said K-cluster classification based upon the number data points in said K-cluster with a prior classification of anomalous or normal; (c) storing each training data set K-cluster cluster center and K-cluster characterization; (d) selecting a second predetermined number of said training set attributes (the “Decision Tree Attributes”), and inputting said Decision Tree Attributes into a prior selected ID3 algorithm, said ID3 algorithm organizing each training data set K-cluster into an associated K-Cluster ID3 decision tree having terminal nodes, non-terminal nodes and associated branches, said ID3 algorithm using said Decision Tree Attributes for each of said members in each said training data set K-cluster, so that each said non-terminal node in each respective K-Cluster ID3 decision tree represents one of said Decision Tree Attributes, and each said associated branch below each said non-terminal node represents one of said values of said Decision Tree Attributes, and each said terminal nodes of each respective K-Cluster ID3 decision tree represent a classification as “normal” or “anomalous”; (e) creating an association between each training data set K-cluster ID3 decision tree with the respective training data set K-cluster, and storing each said K-Cluster ID3 decision tree and said association; (f) inputting a data point X(j) of said data set {X(i)} and, using the Cluster Attributes of said data point X(j), selecting only one of said training data set K-clusters (the “Selected Cluster”); (g) recalling said stored associated ID3 K-cluster decision tree of said Selected Cluster, and characterizing said X(j) data point as “anomalous” or “normal” based on said Decision Tree Attributes values of said data point X(j); and (h) outputting said characterization.