Elastica Inc. · Principal Data Scientist · Aug 2013 – Aug 2014
Shipped behavioral anomaly detection for a cloud security platform with zero labeled incidents to train on.
Problem
Elastica CloudSOC needed to flag anomalous user-session behavior for security review, but cloud security anomalies are rare — no labeled dataset of confirmed incidents existed, and waiting to accumulate one would have delayed the feature by quarters.
Approach
Built the anomaly-detection ML workflow end to end: feature extraction from session, geography, categorical, and work-habit logs; K-means outlier detection; rule-based detection via Drools for known policy violations; and exploratory clustering models (1-Class Classification, ORCLUS, DBSCAN, LOF) to validate the approach. Added sensitivity analysis for outlier features, bootstrapped synthetic data to stress-test it, and investigated SVM and deep-learning approaches as the dataset grew.
Unsupervised outlier detection over a trained classifier: Shipped anomaly detection immediately with zero labeled incidents, and let analyst triage become the mechanism that generated the labels a supervised model would eventually need.
Result: Higher false-positive rate than a trained classifier could eventually achieve, but detection shipped immediately — and security analysts triaging flagged sessions generated the labeled incident data a future supervised model would need.