Abstract: A method for generating a combined Isolation Forest model for detecting anomalies in data is provided. The method includes receiving a first Isolation Forest model for detecting anomalies in data from a first electronic device. The first Isolation Forest model is trained at the first electronic device. Further, the method includes receiving a second Isolation Forest model for detecting anomalies in data from a second electronic device. The second Isolation Forest model is trained at the second electronic device. The method additionally includes combining the first Isolation Forest model and the second Isolation Forest model to obtain the combined Isolation Forest model.

Abstract: Training a machine learning model includes selecting a subset of training transactions from a plurality of training transactions to be used for classifying transactions as either fraudulent or genuine, and classifying transactions as either fraudulent or genuine. Additionally, selecting the subset of training transactions includes clustering the plurality of training transactions into a plurality of clusters based on a similarity measure. Each training transaction includes an indication whether the training transaction is fraudulent or genuine. Further, selecting the subset of training transactions includes selecting a first proportion of the training transactions of a cluster of training transactions for the subset of training transactions if the cluster comprises at least one fraudulent training transaction, and selecting a second proportion of the training transactions of a cluster of training transactions for the subset of training transactions if the cluster is free of fraudulent training transactions.

Abstract: A method for defending a predetermined area from an autonomously moving Unmanned Aerial Vehicle (UAV) is provided. The method includes generating one or more adversarial example adapted to disrupt a machine-learning based vision system of the UAV. Additionally, the method includes determining, based on geographical information about at least one of the predetermined area and a surrounding area of the predetermined area, a respective position for the one or more adversarial example in at least one of the predetermined area and the surrounding area of the predetermined area.

Abstract: A computer-implemented method for generating higher-level features based on one or more lower-level features of a data set includes generating a higher-level feature using a predefined augmentation of one or more lower-level features, wherein the predefined augmentation comprises a predefined transformation of a lower-level feature and/or a predefined combination of a plurality of lower-level features. The method further includes computing a bivariate similarity metric indicative of a similarity between the generated higher-level feature and the one or more lower-level features. Furthermore, the method comprises adding the higher-level feature to a feature graph, if the metric is less than a predefined threshold. Further, the method comprises outputting a result indicative of the feature graph comprising the lower-level features and the higher-level features.

Abstract: A method for detecting a cyberattack on an electronic device is provided. The method is performed by the electronic device itself. The method includes collecting data at the electronic device. Further, the method includes classifying the collected data as regular data or malicious data using a supervised machine-learning model for the cyberattack. The method additionally includes determining whether the electronic device is under the cyberattack based on the classification of the collected data.

Abstract: The disclosure relates to a method (100) for assessing user authorization, the method comprising: receiving (110), via a data communication network (330), a request from a user device (300) for an access; generating (120), based on data associated with the request, a risk score indicating a risk that the request was sent by a non-authorized user, wherein the risk score indicates a high risk, a medium risk, or a low risk that the user (400) is a non-authorized user; and signaling (130), via the data communication network (330), the user device (300) a need for further information to enable a decision about the authorization of the user (400), if the risk score indicates medium risk. A further aspect relates to a method (200) for user authorization and to an electronic device (300).

Abstract: A method for processing a user request is provided. The method includes receiving the user request. Further, the method includes selecting one of a plurality of different machine-learning models. Each of the plurality of machine-learning models is trained for performing the same processing task. The method additionally includes processing the user request using the selected one of the plurality of machine-learning models.

Abstract: A method for generating a combined Isolation Forest model for detecting anomalies in data is provided. The method includes receiving a first Isolation Forest model for detecting anomalies in data from a first electronic device. The first Isolation Forest model is trained at the first electronic device. Further, the method includes receiving a second Isolation Forest model for detecting anomalies in data from a second electronic device. The second Isolation Forest model is trained at the second electronic device. The method additionally includes combining the first Isolation Forest model and the second Isolation Forest model to obtain the combined Isolation Forest model.

Abstract: The disclosure relates to a method (100) for assessing user authorization, the method comprising: receiving (110), via a data communication network (330), a request from a user device (300) for an access; generating (120), based on data associated with the request, a risk score indicating a risk that the request was sent by a non-authorized user, wherein the risk score indicates a high risk, a medium risk, or a low risk that the user (400) is a non-authorized user; and signaling (130), via the data communication network (330), the user device (300) a need for further information to enable a decision about the authorization of the user (400), if the risk score indicates medium risk. A further aspect relates to a method (200) for user authorization and to an electronic device (300).

Abstract: Embodiments of the present disclosure relate to a method, an apparatus and a computer program for selecting a subset of training transactions from a plurality of training transactions for training a machine-learning model to be used for classifying trans-actions as either fraudulent or genuine, and to a method for classifying transactions as either fraudulent or genuine. The method for selecting a subset of training transactions from a plurality of training transactions for training a machine-learning model to be used for classifying trans-actions as either fraudulent or genuine comprises clustering the plurality of training transactions into a plurality of clusters based on a similarity measure. Each training transaction comprises an indication whether the training transaction is fraudulent or genuine.

Abstract: Embodiments of the present disclosure relate to a method, an apparatus and a computer program for providing a machine-learning system to be used for classifying transactions as either fraudulent or genuine, and a method, an apparatus and a computer program for classifying transactions as either fraudulent or genuine. The method for generating a machine-learning system for classifying transactions as either fraudulent or genuine based on a plurality of training transactions, each training transaction being associated with labelling information that indicates whether the training transaction is either genuine or fraudulent, comprises clustering the plurality of training transactions into a plurality of clusters based on a similarity measure. The method comprises determining, for each of the plurality of clusters, whether the cluster is homogeneous or heterogeneous. A heterogeneous cluster includes both fraudulent and genuine training transactions.