Disclosed in some examples are technical solutions to the existing technical problems in computer-implemented identification of anomalous events for distributed unstructured data existing in current supervised and unsupervised approaches. The anomaly detection system may use one or more unsupervised approaches that factor in small data sets using a volume-based time-invariant model. In some examples, in addition, a cross-category proportionality based model may also be utilized.
展开▼