Patent attributes
A computer-implemented method for identifying a use anomaly potentially exposing sensitive data is disclosed. The method comprises receiving data comprising logs of a communication involving a computing device, where the logs comprise distinct logs of at least three communication abstraction levels. At least three anomaly classifiers are operated for logs from each of the at least three communication abstraction levels. An ensemble model is used to identify an anomaly in the communication, by processing output from each of the at least three anomaly classifiers. The various logs from a moment in time when the anomaly occurred are collated, and a graphical user interface is generated for reviewing the identified anomaly and collated logs. A human reviewer is then alerted that an anomaly has been identified.
