Multimodal modelling for systems using distance metric learning

    公开(公告)号:US12107883B2

    公开(公告)日:2024-10-01

    申请号:US17188601

    申请日:2021-03-01

    IPC分类号: H04L9/40 G06N20/00 H04L67/14

    摘要: Described embodiments provide systems and methods for managing session accessed by a client device. The systems and methods can include one or more processors configured to receive data in a plurality of modalities corresponding to a plurality of features of a session for an entity accessed by a client device. The one or more processors can determine based on the data of the session and a distance model trained with historical data of the entity, a distance between a representation of the data of the session and a predetermined representation for the entity established based on the historical data of the entity. The one or more processors can compare the distance with a threshold established for the entity. The one or more processors can generate, based on the comparison between the distance with the threshold, an action to manage access by the client device to the session for the entity.

    SYSTEM AND METHOD FOR COMBINING CYBER-SECURITY THREAT DETECTIONS AND ADMINISTRATOR FEEDBACK

    公开(公告)号:US20240004995A1

    公开(公告)日:2024-01-04

    申请号:US18049909

    申请日:2022-10-26

    IPC分类号: G06F21/55 G06N7/00

    摘要: A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to detect triggering of one or more threat detectors and activate a subset of nodes associated with the triggered threat detectors from a plurality of nodes in a Bayesian network in response to the detection. The at least one processor is further configured to determine that feedback associated with the triggered threat detectors is available and, if so, accumulate the feedback to a feedback node of the network, the feedback node associated with the triggered threat detectors. The at least one processor is further configured to calculate a probability of malicious action using the network to combine probabilities associated with the activated subset of nodes and the feedback node, determine that the probability exceeds a threshold value, and perform a security action in response to the determination.

    Active learning via a surrogate machine learning model using knowledge distillation

    公开(公告)号:US12118437B2

    公开(公告)日:2024-10-15

    申请号:US17188167

    申请日:2021-03-01

    IPC分类号: G10L15/06 G06N5/043 G06N20/00

    摘要: Systems and methods of training a model is provided. The system can identify an unlabeled data set with phrases received by a virtual assistant that interfaces with one or more virtual applications to execute one or more functions. The system can query the unlabeled data set to select a first set of phrases based at least on one or more confidence scores output by a surrogate model that corresponds to a third-party model maintained by a third-party system. The system can receive, via a user interface, indications of functions to be executed by the one or more virtual applications responsive to the selected first set of phrases. The system can provide, to the third-party system, the indications of functions for the selected first set of phrases to train the third-party model and configure the virtual assistant to execute a function responsive to a phrase in the first set of phrases.

    ROOT CAUSE ANALYSIS IN MULTIVARIATE UNSUPERVISED ANOMALY DETECTION

    公开(公告)号:US20210136098A1

    公开(公告)日:2021-05-06

    申请号:US16733324

    申请日:2020-01-03

    摘要: Described embodiments provide systems and methods for anomaly detection and root cause analysis. A root cause analyzer receives a plurality of data samples input to an anomaly detection engine, and a corresponding plurality of anomaly labels output from the anomaly detection engine. The root cause analyzer trains a classification model using the plurality of data samples and the corresponding plurality of anomaly labels. The root cause analyzer determines, using the trained classification model and the plurality of data samples, relative contributions of anomalous features in a data sample of the plurality of data samples, to a prediction that the data sample is anomalous. The root cause analyzer provides the relative contributions of anomalous features to a device, to determine an action in response to the prediction that the data sample is anomalous.

    Local model processing and remote verification

    公开(公告)号:US12093356B2

    公开(公告)日:2024-09-17

    申请号:US17171243

    申请日:2021-02-09

    摘要: A method may include receiving, by a computing system and from a first device, first data. The first data may be based at least in part on a first output from a first instance of a model processed by the first device. The method may further include receiving, by the computing system and from the first device, second data that was processed by the first instance of the model to produce the first output. The method may also include processing, by the computing system, the second data with at least a portion of a second instance of the model to produce a second output. The method may additionally include determining, by the computing system, third data based at least in part on the second output. Further, the method may include determining, by the computing system, that the third data is consistent with the first data.

    ACTIVE LEARNING VIA A SURROGATE MACHINE LEARNING MODEL USING KNOWLEDGE DISTILLATION

    公开(公告)号:US20220230095A1

    公开(公告)日:2022-07-21

    申请号:US17188167

    申请日:2021-03-01

    IPC分类号: G06N20/00 G06N5/04

    摘要: Systems and methods of training a model is provided. The system can identify an unlabeled data set with phrases received by a virtual assistant that interfaces with one or more virtual applications to execute one or more functions. The system can query the unlabeled data set to select a first set of phrases based at least on one or more confidence scores output by a surrogate model that corresponds to a third-party model maintained by a third-party system. The system can receive, via a user interface, indications of functions to be executed by the one or more virtual applications responsive to the selected first set of phrases. The system can provide, to the third-party system, the indications of functions for the selected first set of phrases to train the third-party model and configure the virtual assistant to execute a function responsive to a phrase in the first set of phrases.

    LOCAL MODEL PROCESSING AND REMOTE VERIFICATION

    公开(公告)号:US20220222326A1

    公开(公告)日:2022-07-14

    申请号:US17171243

    申请日:2021-02-09

    摘要: A method may include receiving, by a computing system and from a first device, first data. The first data may be based at least in part on a first output from a first instance of a model processed by the first device. The method may further include receiving, by the computing system and from the first device, second data that was processed by the first instance of the model to produce the first output. The method may also include processing, by the computing system, the second data with at least a portion of a second instance of the model to produce a second output. The method may additionally include determining, by the computing system, third data based at least in part on the second output. Further, the method may include determining, by the computing system, that the third data is consistent with the first data.

    MULTIMODAL MODELLING FOR SYSTEMS USING DISTANCE METRIC LEARNING

    公开(公告)号:US20220201008A1

    公开(公告)日:2022-06-23

    申请号:US17188601

    申请日:2021-03-01

    IPC分类号: H04L29/06 H04L29/08 G06N20/00

    摘要: Described embodiments provide systems and methods for managing session accessed by a client device. The systems and methods can include one or more processors configured to receive data in a plurality of modalities corresponding to a plurality of features of a session for an entity accessed by a client device. The one or more processors can determine based on the data of the session and a distance model trained with historical data of the entity, a distance between a representation of the data of the session and a predetermined representation for the entity established based on the historical data of the entity. The one or more processors can compare the distance with a threshold established for the entity. The one or more processors can generate, based on the comparison between the distance with the threshold, an action to manage access by the client device to the session for the entity.

    SYSTEM AND METHOD FOR COMBINING CYBER-SECURITY THREAT DETECTIONS

    公开(公告)号:US20240005001A1

    公开(公告)日:2024-01-04

    申请号:US17868378

    申请日:2022-07-19

    IPC分类号: G06F21/56 G06N7/00

    CPC分类号: G06F21/566 G06N7/005

    摘要: A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to detect triggering of one or more threat detectors. The at least one processor is further configured to activate a subset of nodes from a plurality of nodes in a Bayesian network in response to the detection, the activated subset of nodes associated with the triggered threat detectors. The at least one processor is further configured to calculate a probability of malicious action using the Bayesian network to combine probabilities associated with the activated subset of nodes. The at least one processor is further configured to determine that the probability exceeds a threshold value. The at least one processor is further configured to perform a security action in response to the determination.

    Root cause analysis in multivariate unsupervised anomaly detection

    公开(公告)号:US11595415B2

    公开(公告)日:2023-02-28

    申请号:US16733324

    申请日:2020-01-03

    摘要: Described embodiments provide systems and methods for anomaly detection and root cause analysis. A root cause analyzer receives a plurality of data samples input to an anomaly detection engine, and a corresponding plurality of anomaly labels output from the anomaly detection engine. The root cause analyzer trains a classification model using the plurality of data samples and the corresponding plurality of anomaly labels. The root cause analyzer determines, using the trained classification model and the plurality of data samples, relative contributions of anomalous features in a data sample of the plurality of data samples, to a prediction that the data sample is anomalous. The root cause analyzer provides the relative contributions of anomalous features to a device, to determine an action in response to the prediction that the data sample is anomalous.