Abstract: A computerized system and method may process and detect anomalies in input data using of machine learning models and techniques. A computerized system comprising one or more processors, a memory, and a communication interface to communicate via a communication network with remote computing devices, may be used for assembling a signal based on event data items; calculating an anomaly score for the signal, which may describe a change or difference between the signal and past signals; generating an alert based on the calculated score; presenting the alert on an output computer display; and allowing or reversing data transfers performed over a communication network between physically separate computer systems based on the anomaly score. Some embodiments of the invention may include performing peer anomaly detection context anomaly detection as two separate and distinct anomaly detection procedures, using separate and distinct machine learning models and algorithms.

Abstract: A system and method for analyzing data transfers using pattern mining, including: categorizing sequences of events into categories based on an order of the events in the sequences; identifying, for one or more sequences in a given category, subsequences of events in a dataset of event data using one or more data mining algorithms; and accepting or denying a data transfer based on applying logical rules to the data transfer, where the rules may be determined using the identified subsequences. In some embodiments, event sequence categories may include an order sensitive category and an order insensitive category, and identifying one or more subsequences of events may include applying a first data mining algorithm to order sensitive sequences, and applying a second data mining algorithm to order insensitive sequences; rules may be determined based on calculating metrics for identified subsequences, describing occurrences of the subsequences in the dataset of event data.

Abstract: A computerized-method for testing a classification ML model of a tenant of a service provider, in a cloud-based environment. The computerized-method includes: (i) receiving an object of a classification ML model for testing from the tenant; (ii) executing an API with the received object of the classification ML model; (iii) identifying one or more tenants of the service provider based on an activity type and preconfigured characteristics by the executed API; (iv) performing an evaluation of the object of the classification ML model by operating the API on each retrieved dataset of the one or more tenants of the service provider to evaluate the object of the classification ML model and store score-results; and (v) calculating an average of the stored score-results to yield a performance-score of the classification ML model. When the performance-score is above a predefined performance-score deploying the classification ML model in a system of the tenant.

Abstract: A system and method for analyzing data transfers using pattern mining, including: categorizing sequences of events into categories based on an order of the events in the sequences; identifying, for one or more sequences in a given category, subsequences of events in a dataset of event data using one or more data mining algorithms; and accepting or denying a data transfer based on applying logical rules to the data transfer, where the rules may be determined using the identified subsequences. In some embodiments, event sequence categories may include an order sensitive category and an order insensitive category, and identifying one or more subsequences of events may include applying a first data mining algorithm to order sensitive sequences, and applying a second data mining algorithm to order insensitive sequences; rules may be determined based on calculating metrics for identified subsequences, describing occurrences of the subsequences in the dataset of event data.

Abstract: A system and method for evaluating machine learning generated data items, including: generating, by a machine learning model, an output data item based on an input data item, where the output item represents or corresponds to the input item (e.g., the output item is a textual description of a non-textual input item); computing a similarity value between the output item and the input item; and performing an exchange of data between remotely connected computer systems (such as, e.g., sending or transmitting the output item, or a computerized command to update or retrain the machine learning model) based on a comparison of the computed similarity value to a benchmark similarity value.

Abstract: A computerized-method for building ensemble of supervised and unsupervised Machine Learning (ML) models for fraud-predictions, for a client having an extremely-imbalanced-dataset, is provided herein.

Abstract: An autonomous fraud/AML reporting system and methods are provided that are configured to automate validations of SAR narratives using a generative AI service by an automated SAR narrative system. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform narrative validation operations which include receiving a SAR narrative for a SAR, loading a prompt template associated with validating the SAR narrative by the generative AI service, injecting the narrative into the prompt templates, and generating and storing the validation based on the comparing.

Abstract: A system and method for identifying data connections may submit alert data items of one or more datasets to a machine learning model, wherein the alert data items of each dataset include: an alert rule that initiated an alert for the dataset including a first set of thresholds, one or more data values assessed by the first set of thresholds in the generation of the alert, and an alert categorization of the alert selected from a true positive categorization or a false positive categorization; assess, combinations of the alert categorization in relation to the one or more data values and the alert rule; generate a second set of thresholds for the one or more data values, wherein the second set of thresholds has a reduced false positive categorization of the alerts compared to the first set of thresholds; and update the alert rule to comprise the second set of thresholds.

Abstract: A system and method for automatically training a machine learning model may include a computing device; a memory; and a processor, the processor configured to: use of one or more subgroups of decision variables of a first machine learning model to train one or more candidate models; evaluate performance metric of one or more candidate models against the first machine learning model: when the performance metric of one or more candidate models is higher than the performance metric of the first machine learning model, update the first machine learning model to a second machine learning model selected from one or more candidate models.

Abstract: A system and method for determining trust indicators of legal entities may determine coefficients for a plurality of risk factors for a legal entity, wherein said risk factors indicate risks associated with one or more of: said legal entity taking part in a transaction and said legal entity's transaction type, and wherein said coefficients determine a relative impact of each of said plurality of risk factors in the calculation of a risk score for said legal entity; calculate said risk score from coefficients and risk factors; assess data incompleteness for values of said plurality of risk factors and calculate a data incompleteness score; and generate a trust indicator for said legal entity from said risk score and data incompleteness score.

Abstract: A system and method for prioritizing customer data may include a computing device; a memory; and a processor, the processor configured to: use of one or more datasets of tabular customer data to generate one or more analysis prompts; apply the one or more analysis prompts to a machine learning model to generate a vector; and generate a prioritization of the one or more customer datasets by comparing a prioritization value of the vector to threshold values.

Abstract: A device, system and method for machine-generated automatic fraud detection using a large language model to generate a human-readable summary to detect anomalies in a user's transaction history behavior. A prompt may be input into a large language model comprising a set of features of the user's current and past transactions and instructions to generate a summary explaining deviation in the user's behavior between the current and past transactions. The summary may be analyzed to detect if the deviation in the user's behavior is anomalous. When the analysis detects deviant behavior patterns between the user's current and past transactions, fraud may be suspected to automatically trigger a preventative anti-fraud action, e.g., to pre-emptive cancel, delay execution or escalate interrogation, of the current transaction.

Abstract: A system and method for identifying data connections may include a computing device; a memory; and a processor, the processor configured to: generate a connection analysis prompt from one or more data items of a first dataset for identifying one or more data items of a second dataset; and apply said connection analysis prompt to a machine learning model to produce an output from the machine learning model of whether said one or more data items of the first dataset are connected to said one or more data items of the second dataset; and when said one or more data items of the first dataset have one or more connections to said one or more data items of a second dataset, to produce an alert.

Abstract: A computerized-method for automatically generating a two-part readable Suspicious Activity Report (SAR) from high-dimensional data in tabular form is provided herein. The computerized-method may include receiving high-dimensional data in tabular form of evidence financial transactions to be reported under Anti Money Laundering (AML) regulations. Then, displaying the received data to a Subject Matter Expert (SME) for ordering each displayed transaction in a predefined construction; Then, training one or more Natural Language Generation (NLG) translation models, for each transaction type, according to a deep learning model. Then, operating the one or more NLG translation models on each transaction type to generate for each transaction type a narrative of SAR; Then, operating a prebuilt summary model on the generated narrative of SAR of each transaction type to generate a summary of the plurality of narratives of SAR; and combining the plurality of narratives of SAR and the summary to one SAR.

Abstract: A system and method for automatically evaluating computer generated content may include: calculating a plurality of metrics for an input text, where the plurality of metrics may include one or more perplexity scores describing a prediction of the input text by a large language model (LLM); determining, based on one or more of the calculated metrics, whether to accept or reject the input text; and performing an exchange of data between remotely connected computer devices based on the determining to accept or reject the text. In some embodiments, calculating of metrics and determining whether to accept or reject the input text may be performed without relying on any information received subsequent to the initial receiving of the input text. Some embodiments may perform automated computerized actions such as, e.g., deploy or discard an update to the LLM based on the determining whether to accept or reject the input text.

Abstract: A system and method may detect rogue trading by detecting a subset of trades among a plurality of trades, where each trade in the subset does not meet a trade surveillance system threshold, and does meet a trade surveillance system threshold within a tolerance, and each trade falls within the same time period. A ratio of the subset of trades to the plurality of trades may be determined. If the ratio is above a threshold, it may be determined that the subset of trades corresponds to undesirable trading. Undesirable trading may be determined using an additional factor, based on a weighted average of, for each of a trade surveillance system threshold, the number of trades in the subset meeting the trade surveillance system threshold within a tolerance and not meeting a trade surveillance threshold, times a weight based on the position of the threshold in the trade surveillance system.

Abstract: Systems and methods for selecting a prompt to input to a large language model (LLM), include: determining, by a predictive model and for a first set of data to be the subject of a prompt of a pre-defined set of prompts, a score for each prompt of the pre-defined set of prompts, wherein the score for each prompt is based on a predicted probability of receiving a defined feedback value on an output of the LLM generated based on that prompt and the first set of data; inputting to the LLM the prompt with the highest score and the first set of data; and outputting a result generated by the LLM based on the input prompt and the first set of data.

Abstract: A machine learning (ML) system and methods are provided that are configured to detect concept drift in ML models. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform drift detection operations which include receiving a first data set for use during online training of a first ML model, determining a change to an uncertainty bound metric associated with classifiers for features utilized by the first ML model, identifying that the first data set causes the concept drift with the online training of the first ML model, determining characterization information about a type of the concept drift, generating an ML update paradigm based on the concept drift and the characterization information, alerting an ML model updater of the ML update paradigm.

Abstract: Systems and methods for unsupervised feature selection for online machine learning are provided. Features can be selected from a plurality of online data sources having a plurality of respective online data streams, and an aggregated feature set and aggregated data can be formed therefrom. The aggregated feature set and the aggregated data can be used by machine learning models in real time to provide real time online machine learning.

Abstract: A computerized system and method may process and detect anomalies in input data using of machine learning models and techniques. A computerized system comprising one or more processors, a memory, and a communication interface to communicate via a communication network with remote computing devices, may be used for assembling a signal based on event data items; calculating an anomaly score for the signal, which may describe a change or difference between the signal and past signals; generating an alert based on the calculated score; presenting the alert on an output computer display; and allowing or reversing data transfers performed over a communication network between physically separate computer systems based on the anomaly score. Some embodiments of the invention may include performing peer anomaly detection context anomaly detection as two separate and distinct anomaly detection procedures, using separate and distinct machine learning models and algorithms.