Abstract: Provided is a system for detecting an anomaly in a multivariate time series that includes at least one processor programmed or configured to receive a dataset of a plurality of data instances, wherein each data instance comprises a time series of data points, determine a set of target data instances based on the dataset, determine a set of historical data instances based on the dataset, generate, based on the set of target data instances, a true value matrix, a true frequency matrix, and a true correlation matrix, generate a forecast value matrix, a forecast frequency matrix, and a forecast correlation matrix based on the set of target data instances and the set of historical data instances, determine an amount of forecasting error, and determine whether the amount of forecasting error corresponds to an anomalous event associated with the dataset of data instances. Methods and computer program products are also provided.

Abstract: A method and an apparatus for displaying an information flow on a terminal device, an electronic device, a computer-readable storage medium, and a computer program product are provided. An implementation is: in response to detecting an activation operation on an application for displaying the information flow, reproducing, on the terminal device, a first page displayed on the terminal device when the application is last switched to running in the background or closed; and in response to determining that a time interval between the activation operation and the application being last switched to running in the background or closed does not exceed a first threshold, displaying a second page as a continuation of a content entry displayed in the first page, where the second page includes at least one first content entry cached in the terminal device before the activation operation but not displayed in the first page.

Abstract: A heat-assisted magnetic recording head comprises a near-field transducer (NFT). The NFT comprises a near-field emitter configured to heat a surface of a magnetic disk, and a hybrid plasmonic disk. The hybrid plasmonic disk comprises a plasmonic region and a thermal region. The plasmonic region comprises a first material or alloy that is a plasmonic material or alloy. The thermal region comprises a second material or alloy that is different than the first material or alloy.

Abstract: Systems, methods, and computer program products for multi-domain ensemble learning based on multivariate time sequence data are provided. A method may include receiving multivariate sequence data. At least a portion of the multivariate sequence data may be inputted into a plurality of anomaly detection models to generate a plurality of scores. The multivariate sequence data may be combined with the plurality of scores to generate combined intermediate data. The combined intermediate data may be inputted into a combined ensemble model to generate an output score. In response to determining that the output score satisfies a threshold, at least one of an alert may be communicated to a user device, the multivariate sequence data may be inputted into the feature-domain ensemble model to generate a feature importance vector, or at least one of a model-domain, a time-domain, a feature-domain, or the combined ensemble model may be updated.

Abstract: Provided are methods that include determining a set of transaction related actions for an agent, selecting a first transaction related action from the set of transaction related actions for the agent based on a plurality of features associated with the agent, generating transaction data associated with a fraudulent transaction based on the first transaction related action, generating a feature vector, the feature vector including transaction data associated with the fraudulent transaction, providing the feature vector as an input to a fraud detection machine learning model. Methods may also include determining an output of the fraud detection machine learning model based on the feature vector as the input, and generating a fraudulent reward parameter for the first transaction related action based on the output of the fraud detection machine learning model. Systems and computer program products are also provided.

Abstract: Techniques are disclosed for performing adversarial object detection. In one example, a system obtains a feature vector upon receiving an object to be classified. The system then generates a graph using the feature vector for the object and other feature vectors that are respectively obtained from a reference set of objects, whereby the feature vector corresponds to a center node of the graph. The system uses a distance metric to select neighbor nodes from among the reference set of objects for inclusion into the graph, and then determines edge weights between nodes of the graph based on a distance between respective feature vectors between nodes. The system then applies a graph discriminator to the graph to classify the object as adversarial or benign, the graph discriminator being trained using (I) the feature vectors associated with nodes of the graph and (II) the edge weights between the nodes of the graph.

Abstract: A method includes extracting, by an analysis computer, a dataset including initial vector representations for each of a plurality of user nodes and for each of a plurality of resource provider nodes. The analysis computer can then generate updated vector representations as new interaction data arrives over time, and use them to perform predictions of future interactions.

Abstract: Disclosed are a system, method, and computer program product for user network activity anomaly detection. The method includes generating a multilayer graph from network resource data, and generating an adjacency matrix associated with each layer of the multilayer graph to produce a plurality of adjacency matrices. The method further includes assigning a weight to each adjacency matrix to produce a plurality of weights, and generating a merged single layer graph by merging the plurality of layers based on a weighted sum of the plurality of adjacency matrices using the plurality of weights. The method further includes generating a set of anomaly scores by generating, for each node in the merged single layer graph, an anomaly score. The method further includes determining a set of anomalous users based on the set of anomaly scores, detecting fraudulent network activity based on the set of anomalous users, and executing a fraud mitigation process.

Abstract: Provided are methods that include determining a set of transaction related actions for an agent, selecting a first transaction related action from the set of transaction related actions for the agent based on a plurality of features associated with the agent, generating transaction data associated with a fraudulent transaction based on the first transaction related action, generating a feature vector, the feature vector including transaction data associated with the fraudulent transaction, providing the feature vector as an input to a fraud detection machine learning model. Methods may also include determining an output of the fraud detection machine learning model based on the feature vector as the input, and generating a fraudulent reward parameter for the first transaction related action based on the output of the fraud detection machine learning model. Systems and computer program products are also provided.

Abstract: Described are a system, method, and computer program product for user network activity anomaly detection. The method includes receiving network resource data associated with network resource activity of a plurality of users and generating a plurality of layers of a multilayer graph from the network resource data. Each layer of the plurality of layers may include a plurality of nodes, which are associated with users, connected by a plurality of edges, which are representative of node interdependency. The method also includes generating a plurality of adjacency matrices from the plurality of layers and generating a merged single layer graph based on a weighted sum of the plurality of adjacency matrices. The method further includes generating anomaly scores for each node in the merged single layer graph and determining a set of anomalous users based on the anomaly scores.

Abstract: Embodiments of the invention are directed to systems, methods, and devices for testing the security of a facial recognition system (FRS). A target image depicting a target person enrolled in the FRS and a tester image depicting a tester may be obtained. A plurality of transformed images may be generated from an image of the target person or the tester image. A processed tester image (e.g., one that is likely to cause the FRS to misclassify) may be identified using the plurality of transformed images, the tester image, and the target image. Data representing a light pattern can be generated using the processed tester image and the light pattern can be projected onto a second person. Another image may be captured of the second person with the light pattern as projected. This image may be provided to the FRS and a remedial action may be performed based on the corresponding output.

Abstract: Training an adversarial perturbation detector comprises accessing a training set comprising an enrolled biometric sample xi and a public biometric sample x of an enrolled user, and submitted biometric samples x? of a second user, the submitted biometric samples x? comprising perturbed adversarial samples x?+?x?. A transformation function k(?) is provided having learnable a parameter ? and a classifier having a learnable parameter ?. The training set is used to learn the parameters ? and ? by inputting the training set to the transformation function k(?). The transformation function k(?) generates transformed enrolled samples k(xi), a transformed public biometric sample k(x), and a transformed adversarial sample k(x?+?x?). The classifier classifies the transformed adversarial sample k(x?+?x?) as a success or as a fail based on the transformed enrolled samples k(xi). Based on a result of the classification, the learnable parameters ? and ? are updated.

Abstract: Described are a system, method, and computer program product for user network activity anomaly detection. The method includes receiving network resource data associated with network resource activity of a plurality of users and generating a plurality of layers of a multilayer graph from the network resource data. Each layer of the plurality of layers may include a plurality of nodes, which are associated with users, connected by a plurality of edges, which are representative of node interdependency. The method also includes generating a plurality of adjacency matrices from the plurality of layers and generating a merged single layer graph based on a weighted sum of the plurality of adjacency matrices. The method further includes generating anomaly scores for each node in the merged single layer graph and determining a set of anomalous users based on the anomaly scores.

Abstract: Provided is a system for event forecasting using a graph-based machine-learning model that includes at least one processor programmed or configured to receive a dataset of data instances, where each data instance comprises a time series of data points, detect a plurality of motifs representing a plurality of events in the dataset of data instances using a matrix profile-based motif detection technique, generate a bipartite graph representation of the plurality of motifs in a time sequence, and generate a machine-learning model based on the bipartite graph representation of the plurality of motifs in the time sequence, where the machine-learning model is configured to provide an output and the output includes a prediction of whether an event will occur during a specified time interval. Methods and computer program products are also provided.

Abstract: A computer-implemented method for improving security of a biometrics-based authentication system comprises receiving, by one or more servers, enrolled biometric samples of an enrolled user during an enrollment stage of the biometrics-based authentication system. Augmented biometric samples are created by adding learned perturbations to the enrolled biometric samples of the enrolled user. During a request for authentication, submitted biometric samples are received from a second user. The submitted biometric samples of the second user are compared to the enrolled biometric samples and to the augmented biometric samples of the enrolled user based on predefined metrics. Based on the comparison it is determined whether the submitted biometric samples of the second user have been modified to impersonate the enrolled user.

Abstract: Methods for detecting insider threats are disclosed. A method includes collecting server access data and application access data, based on the server access data and the application access data, determining nearest neighbors of an employee, and based on the nearest neighbors of the employee, determining a peer group of the employee, determining an average rank distance (ARD) of the nearest neighbors based on a ranking of the nearest neighbors in a plurality of time periods, identifying ARD gaps between the nearest neighbors, and generating scores corresponding to the ARD gaps between the nearest neighbors. One or more employees are identified that represent an internal threat to an organization based on the scores corresponding to the ARD gaps.

Abstract: A computer-implemented method is disclosed for training neural networks of a group recommender to provide item recommendations for ephemeral groups having group interaction sparsity. A preference encoder and aggregator generate user and group preference embeddings from user-item interactions, wherein the preference embeddings form a latent user-group latent embedding space.

Abstract: Provided are methods that include determining a set of transaction related actions for an agent, selecting a first transaction related action from the set of transaction related actions for the agent based on a plurality of features associated with the agent, generating transaction data associated with a fraudulent transaction based on the first transaction related action, generating a feature vector, the feature vector including transaction data associated with the fraudulent transaction, providing the feature vector as an input to a fraud detection machine learning model. Methods may also include determining an output of the fraud detection machine learning model based on the feature vector as the input, and generating a fraudulent reward parameter for the first transaction related action based on the output of the fraud detection machine learning model. Systems and computer program products are also provided.