Idea
An interpretable regex-based anomaly detection platform for event-driven systems improving accuracy and efficiency for security teams.
Research Paper
Core Innovation
This paper introduces HyGLAD, which synthesizes regex filters guided by hypergraph structures to model event data behavior. Unlike deep learning, it produces interpretable patterns that directly explain anomalies. It achieves higher accuracy and efficiency on real-world datasets compared to existing unsupervised methods.
Market Size (TAM)
$2–10B TAM, $1–2B SAM; assumption: growing demand for cybersecurity and anomaly detection in enterprise IT environments.
Potential Customers & Pain Points
- Security Operations Centers Needing Faster Transparent Anomaly Detection
- Enterprises Monitoring Event Logs for Malicious Activity
- IT Teams Seeking Efficient Interpretable Event-Based Alerts
Business Model
SaaS subscription for anomaly detection platform with tiered pricing based on data volume and features; enterprise licensing and support.
Competitive Landscape
- DeepOD
- Splunk
- Elastic Security
Implementation Challenges
- Adoption resistance to regex-based methods versus deep learning
- Integration with diverse event logging systems
- Scaling to extremely high-volume event streams
Validation Strategy
- Pilot deployment with enterprise SOC teams
- Benchmark against existing anomaly detection tools on customer data
- Collect user feedback on interpretability and alert relevance
Research Paper Overview
Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detection
Summary
HyGLAD is an algorithm that automatically generates interpretable regex patterns to model event data and detect anomalies in stationary systems. It infers equivalence classes of entities with similar behaviors and builds regexes capturing their values, enabling interpretable anomaly detection. HyGLAD outperforms seven deep-learning unsupervised anomaly detection methods on five real-world datasets, improving precision by 1.2x and recall by 1.3x while being an order of magnitude more efficient on CPU.