System, Method, and Computer Program Product for Multi-Domain Ensemble Learning Based on Multivariate Time Sequence Data

    公开(公告)号:US20240062120A1

    公开(公告)日:2024-02-22

    申请号:US18268465

    申请日:2022-10-20

    IPC分类号: G06N20/20

    CPC分类号: G06N20/20

    摘要: Systems, methods, and computer program products for multi-domain ensemble learning based on multivariate time sequence data are provided. A method may include receiving multivariate sequence data. At least a portion of the multivariate sequence data may be inputted into a plurality of anomaly detection models to generate a plurality of scores. The multivariate sequence data may be combined with the plurality of scores to generate combined intermediate data. The combined intermediate data may be inputted into a combined ensemble model to generate an output score. In response to determining that the output score satisfies a threshold, at least one of an alert may be communicated to a user device, the multivariate sequence data may be inputted into the feature-domain ensemble model to generate a feature importance vector, or at least one of a model-domain, a time-domain, a feature-domain, or the combined ensemble model may be updated.

    Using an enrolled biometric dataset to detect adversarial examples in biometrics-based authentication system

    公开(公告)号:US11496466B2

    公开(公告)日:2022-11-08

    申请号:US16685203

    申请日:2019-11-15

    摘要: A computer-implemented method for improving security of a biometrics-based authentication system comprises receiving, by one or more servers, enrolled biometric samples of an enrolled user during an enrollment stage of the biometrics-based authentication system. Augmented biometric samples are created by adding learned perturbations to the enrolled biometric samples of the enrolled user. During a request for authentication, submitted biometric samples are received from a second user. The submitted biometric samples of the second user are compared to the enrolled biometric samples and to the augmented biometric samples of the enrolled user based on predefined metrics. Based on the comparison it is determined whether the submitted biometric samples of the second user have been modified to impersonate the enrolled user.

    Methods and systems for peer grouping in insider threat detection

    公开(公告)号:US11481485B2

    公开(公告)日:2022-10-25

    申请号:US16737367

    申请日:2020-01-08

    摘要: Methods for detecting insider threats are disclosed. A method includes collecting server access data and application access data, based on the server access data and the application access data, determining nearest neighbors of an employee, and based on the nearest neighbors of the employee, determining a peer group of the employee, determining an average rank distance (ARD) of the nearest neighbors based on a ranking of the nearest neighbors in a plurality of time periods, identifying ARD gaps between the nearest neighbors, and generating scores corresponding to the ARD gaps between the nearest neighbors. One or more employees are identified that represent an internal threat to an organization based on the scores corresponding to the ARD gaps.

    System, Method, and Computer Program Product for User Network Activity Anomaly Detection

    公开(公告)号:US20230308464A1

    公开(公告)日:2023-09-28

    申请号:US18202405

    申请日:2023-05-26

    IPC分类号: H04L9/40

    摘要: Disclosed are a system, method, and computer program product for user network activity anomaly detection. The method includes generating a multilayer graph from network resource data, and generating an adjacency matrix associated with each layer of the multilayer graph to produce a plurality of adjacency matrices. The method further includes assigning a weight to each adjacency matrix to produce a plurality of weights, and generating a merged single layer graph by merging the plurality of layers based on a weighted sum of the plurality of adjacency matrices using the plurality of weights. The method further includes generating a set of anomaly scores by generating, for each node in the merged single layer graph, an anomaly score. The method further includes determining a set of anomalous users based on the set of anomaly scores, detecting fraudulent network activity based on the set of anomalous users, and executing a fraud mitigation process.

    HIERARCHICAL PERIODICITY DETECTION ON DYNAMIC GRAPHS SYSTEM AND METHOD

    公开(公告)号:US20240289355A1

    公开(公告)日:2024-08-29

    申请号:US18568778

    申请日:2022-06-10

    IPC分类号: G06F16/28

    CPC分类号: G06F16/285

    摘要: A computer obtains node embeddings, node periodicity classifications, edge embeddings, and edge periodicity classifications for each time of a time period. The computer determines subgraph embeddings based on a subgraph of the graph, times in the time period, the node embeddings for nodes in the subgraph, the edge embeddings for edges in the subgraph, the node periodicity classifications for the nodes in the subgraph, and the edge periodicity classifications for the edges in the subgraph. The computer translates each subgraph embedding of the subgraph embeddings for each time of the time period into projected subgraph embeddings. For the subgraph, the computer aggregates the plurality of projected subgraph embeddings into an aggregated subgraph embedding. The computer determines if the subgraph is periodic based upon at least the aggregated subgraph embedding.

    System, Method, and Computer Program Product for Evaluating a Fraud Detection System

    公开(公告)号:US20230351394A1

    公开(公告)日:2023-11-02

    申请号:US18220912

    申请日:2023-07-12

    发明人: Yuhang Wu Hao Yang

    IPC分类号: G06N20/00 G06Q20/40

    摘要: Provided are methods that include determining a set of transaction related actions for an agent, selecting a first transaction related action from the set of transaction related actions for the agent based on a plurality of features associated with the agent, generating transaction data associated with a fraudulent transaction based on the first transaction related action, generating a feature vector, the feature vector including transaction data associated with the fraudulent transaction, providing the feature vector as an input to a fraud detection machine learning model. Methods may also include determining an output of the fraud detection machine learning model based on the feature vector as the input, and generating a fraudulent reward parameter for the first transaction related action based on the output of the fraud detection machine learning model. Systems and computer program products are also provided.

    DETECTING ADVERSARIAL EXAMPLES USING LATENT NEIGHBORHOOD GRAPHS

    公开(公告)号:US20230334332A1

    公开(公告)日:2023-10-19

    申请号:US18028845

    申请日:2021-09-30

    IPC分类号: G06N3/094

    CPC分类号: G06N3/094

    摘要: Techniques are disclosed for performing adversarial object detection. In one example, a system obtains a feature vector upon receiving an object to be classified. The system then generates a graph using the feature vector for the object and other feature vectors that are respectively obtained from a reference set of objects, whereby the feature vector corresponds to a center node of the graph. The system uses a distance metric to select neighbor nodes from among the reference set of objects for inclusion into the graph, and then determines edge weights between nodes of the graph based on a distance between respective feature vectors between nodes. The system then applies a graph discriminator to the graph to classify the object as adversarial or benign, the graph discriminator being trained using (I) the feature vectors associated with nodes of the graph and (II) the edge weights between the nodes of the graph.

    System, Method, and Computer Program Product for Determining Adversarial Examples

    公开(公告)号:US20210166122A1

    公开(公告)日:2021-06-03

    申请号:US17106619

    申请日:2020-11-30

    IPC分类号: G06N3/08 G06N3/04 G06K9/62

    摘要: Provided are systems for determining adversarial examples that include at least one processor to determine a first additional input from a plurality of additional inputs based on a proximity of the first additional input to an initial input, determine a second additional input from the plurality of additional inputs based on a proximity of the second additional input to the first additional input, generate a first vector embedding, a second vector embedding and a third vector embedding based on the second additional input, generate a first relational embedding, a second relational embedding, and a third relational embedding based on the third vector embedding and the first vector embedding, concatenate the first relational embedding, the second relational embedding, and the third relational embedding to provide a concatenated version, and determine whether the first input is an adversarial example based on the concatenated version. Methods and computer program products are also provided.

    Using an enrolled biometric dataset to detect adversarial examples in biometrics-based authentication system

    公开(公告)号:US12069047B2

    公开(公告)日:2024-08-20

    申请号:US17951864

    申请日:2022-09-23

    CPC分类号: H04L63/0861 G06N3/04 G06N3/08

    摘要: Training an adversarial perturbation detector comprises accessing a training set comprising an enrolled biometric sample xi and a public biometric sample x of an enrolled user, and submitted biometric samples x′ of a second user, the submitted biometric samples x′ comprising perturbed adversarial samples x′+Δx′. A transformation function k(⋅) is provided having learnable a parameter θ and a classifier having a learnable parameter σ. The training set is used to learn the parameters θ and σ by inputting the training set to the transformation function k(⋅). The transformation function k(⋅) generates transformed enrolled samples k(xi), a transformed public biometric sample k(x), and a transformed adversarial sample k(x′+Δx′). The classifier classifies the transformed adversarial sample k(x′+Δx′) as a success or as a fail based on the transformed enrolled samples k(xi). Based on a result of the classification, the learnable parameters θ and σ are updated.