Abstract: A computerized system and method may process and detect anomalies in input data using of machine learning models and techniques. A computerized system comprising one or more processors, a memory, and a communication interface to communicate via a communication network with remote computing devices, may be used for assembling a signal based on event data items; calculating an anomaly score for the signal, which may describe a change or difference between the signal and past signals; generating an alert based on the calculated score; presenting the alert on an output computer display; and allowing or reversing data transfers performed over a communication network between physically separate computer systems based on the anomaly score. Some embodiments of the invention may include performing peer anomaly detection context anomaly detection as two separate and distinct anomaly detection procedures, using separate and distinct machine learning models and algorithms.

Abstract: A system and method may detect rogue trading by detecting a subset of trades among a plurality of trades, where each trade in the subset does not meet a trade surveillance system threshold, and does meet a trade surveillance system threshold within a tolerance, and each trade falls within the same time period. A ratio of the subset of trades to the plurality of trades may be determined. If the ratio is above a threshold, it may be determined that the subset of trades corresponds to undesirable trading. Undesirable trading may be determined using an additional factor, based on a weighted average of, for each of a trade surveillance system threshold, the number of trades in the subset meeting the trade surveillance system threshold within a tolerance and not meeting a trade surveillance threshold, times a weight based on the position of the threshold in the trade surveillance system.

Abstract: A risk-prediction-preparation module to generate a risk-prediction-model, is provided herein. The risk-prediction-preparation module includes accessing a data-storage of transactions to operate a group-by operation on transactions related to data-points, according to a logical-entity into entities. Then, clustering entities of a clean-financial dataset into clusters. Selecting data-points of: (a) entities from the clusters to a first dataset and (b) a preconfigured amount of entities randomly to a second dataset. Selecting all entities that have at least one ‘fraudulent’ data-points in at least one related data-point to add all the entities to the first dataset and the second dataset. Using vectorized and scaled extracted features for training a first machine-learning-model of fraud detection on the first dataset and training a second machine-learning-model of fraud detection on the second dataset to collect results.

Abstract: An artificial intelligence system configured to detect anomalies in transaction data sets. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform modeling operations which include receiving a first data set for training a first machine learning model to detect anomalies in the transaction data sets using a machine learning technique, accessing at least one micro-model trained using at least one second data set separate from the first data set, determining risk scores from the first data set using the at least one micro-model, enriching the first data set with the risk scores, and determining the first machine learning model for the enriched first data set using the machine learning technique.

Abstract: A system is provided for estimating quantile values for fraud assessments. The system includes a processor and a computer readable medium operably coupled thereto, to perform operations which include capturing one or more first data values for a quantile value profile associated with an entity, wherein the quantile value profile includes one of real values or a first plurality of quantile marker values calculated from the real values, accessing the quantile value profile for the entity, determining a first number of the one or more first data values, and based on the first number of the one or more first data values and the one of the real values or the first plurality of quantile marker values in the quantile value profile, performing one of a first merge operation, a second merge operation, or a third merge operation.

Abstract: A processor is adapted to automatically generate and validate rules for monitoring suspicious activity by: For a first period of time, collecting a first group of transactions, automatically identifying and storing key indicators from the transactions, and automatically storing which of the transactions are pre-identified as fraudulent. Based on the key indicators and the pre-identified fraudulent transactions, training a learning algorithm and, with the learning algorithm, generating a decision tree of logical predicates including the key indicators. Based on the decision tree, generating a plurality of rules, each of which incorporates only one logical predicate from each layer of the decision tree. For a second period of time: collecting a second group of transactions, and generating a quality metric for each rule, by automatically testing the rules against the second group of transactions, and identifying a subset of rules for which the quality metric exceeds a threshold.

Abstract: A computerized-method for generating a dataset for a Machine Learning (ML) model for an increased accurate financial crime detection from an initiation stage of the ML model implementation. The computerized-method includes retrieval of financial transaction records from a database of financial transaction records to arrange a dataset of financial transaction records, according to preconfigured techniques. Then, processing the records in the dataset; Then, operating feature engineering on preselected anomalous related features to yield probabilistic categorical features and to yield probabilistic numerical features, and then combining the probabilistic categorical features with the probabilistic numerical features to generate a complex features dataset, and providing the probabilistic categorical features, the probabilistic numerical features and the complex features dataset to an ML model, thus, increasing accuracy of detection that is performed right from an initiation stage of the ML model implementation.

Abstract: A computerized-method for scaling automatic deployment of a machine-learning detection model in a cloud-based managed analytics service by knowledge sharing to overcome an imbalanced dataset learning problem. The computerized-method includes: sending the received data to machine-learning models to synthesize patterns of the received data to yield a differential privacy data; maintaining in the database the differential privacy data of one or more on-prem cloud-based managed analytics services to generate a consortium shared synthetic data lake; operating phases of machine-learning detection model based on the received data and data in the database to create a packaged model. The data in the database is aggregated and used during the operating phases of the machine-learning detection model to create a packaged model for other on-prem cloud-based managed analytics services, thus overcoming imbalanced dataset learning thereof, and after the packaged model is created it is automatically deployed on-prem.

Abstract: A computerized-method for predicting a probability of fraudulent financial-account access, is provided herein. The computerized-method includes a. building a Machine Learning (ML) sequence model; b. implementing a forward-propagation-routine in an encapsulated environment that runs applications to mimic a process of the ML sequence model. The forward-propagation-routine is mimicking processing of a chronical-sequence of a preconfigured number of non-financial activities sequence vector, layer by layer to generate a fraud probability score and using weights and biases which were extracted from each layer of the trained ML sequence model; and c.

Abstract: A system includes collecting serial numbers over a period of time, and constructing a matrix indicating which digits have been used at which positions. For a second period of time, the system collects a second group of serial numbers and, for each of these serial numbers, identifies a feature of the serial number by comparing it against the matrix, and automatically updates the matrix with the digits and digit positions of the serial number. The features are received into an artificial intelligence model as training data. Further, the system collects a third group of serial numbers and, for each serial number of the third group, identifies a feature of the serial number by comparing it against the matrix. These features are then received into the artificial intelligence model, which determines a risk score. The matrix is then updated with the digits and digit positions of the serial number.

Abstract: A computerized-method for real-time detection of anomalous data, by processing high-speed streaming data. In a computerized-system receiving a data-stream comprised of unlabeled data points, and operating an Anomalous Data Detection (ADD) module. The ADD module receives at least one of: (i) k number of data point neighbors for each data point; (ii) X number of data points in a predetermined period of time; (iii) d number of dimensions of each data point, threshold; and (iv) n number of data points that said ADD module is operating on, in a predefined time unit. Then, the ADD module prepares a dataset having n data points from the received X data points; and then identifies one or more data points, from the received data stream, as outliers to send an alert with details related to the identified outliers, thus, dynamically evaluating local outliers in the received data stream.

Abstract: A system and method is provided for automatically creating machine learned fraud detection models. Data received from a plurality of devices can be used to train a model for each of the plurality of entities. Each of the models can be trained using recursive model stacking and each model can output a corresponding score. A second model can be trained for each of the plurality of entities based on the first model and a corresponding output score of the first model. The second model can also be trained using recursive model stacking.

Abstract: A computerized method for providing a sentiment score by evaluating expressions of participants during a video meeting is provided herein. The computerized method comprising: a Sentiment Analysis (SA) module. The SA module is: (i) retrieving one or more recordings of a video meeting from the database of video meeting recordings of each participant in the video meeting and associating the one or more recordings with a participant; (ii) dividing each retrieved recording into segments; (iii) processing the segments in a Facial Expression Recognition (FER) system to associate each segment with a timestamped sequence of expressions for each participant in the video meeting; and (iv) processing each segment in an Artificial Neural Network (ANN) having a dense layer, by applying a prebuilt and pretrained deep learning model, to yield a sentiment score for each statement for each participant.

Abstract: A system is provided for a data investigation system that is adapted to provide optimized data viewing for investigations using a network topology of relations between entities. The system includes a processor and a computer readable medium operably coupled thereto, to perform operations which include receiving, from a computing device, an investigation of a first entity having a first set of attributes, determining, based on the first set of attributes, a plurality of related entities associated with a plurality of events, determining whether each of the plurality of events meets or exceeds a risk threshold for the investigation of the first entity, generating a first relations graph of the first entity to one or more of the plurality of related entities based on one or more of the plurality of events meeting or exceeding the risk threshold, and displaying, on the computing device, the first relations graph.

Abstract: A computerized-method for generating a dataset for a Machine Learning (ML) model for an increased accurate financial crime detection from an initiation stage of the ML model implementation. The computerized-method includes: retrieval of financial transaction records from a database of financial transaction records to arrange a dataset of financial transaction records, according to preconfigured techniques. Then, processing the records in the dataset; Then, operating feature engineering on preselected anomalous related features to yield probabilistic categorical features and to yield probabilistic numerical features, and then combining the probabilistic categorical features with the probabilistic numerical features to generate a complex features dataset, and providing the probabilistic categorical features, the probabilistic numerical features and the complex features dataset to an ML model, thus, increasing accuracy of detection that is performed right from an initiation stage of the ML model implementation.

Abstract: A computerized-method for real-time detection of real concept drift in predictive machine learning models, by processing high-speed streaming data. The computerized-method includes: receiving a real-time data stream having labeled and unlabeled instances. Obtaining a window of ‘n’ instances having a portion of the ‘n’ instances as reliable labels. Computing posterior distribution of the reliable labels; and operating a Drift-Detection (DD) module. The DD module is configured to: operate a kernel density estimation on the computed posterior distribution for sensitivity control of the DD module; operate an error rate function on the estimated kernel density to yield an error value; and train an incremental estimator module, according to the kernel density estimation. When the error value is not above a preconfigured drift threshold repeating operations (i) through (iii), else when the error value is above the preconfigured drift threshold, at least one concept drift related action takes place.

Abstract: A device, system, and method for training a machine learning model using incremental learning without forgetting. A sequence of training tasks may be respectively associated with training samples and corresponding labels. A subset of shared model parameters common to the training tasks and a subset of task-specific model parameters not common to the training tasks may be generated. The machine learning model may be trained in each of a plurality of sequential task training iteration by generating the task-specific parameters for the current training iteration by applying a propagator to the training samples associated with the current training task and constraining the training of the model for the current training task by the training samples associated with a previous training task in a previous training iteration, and classifying the samples for the current training task based on the current and previous training task samples.

Abstract: A computerized method for providing a sentiment score by evaluating expressions of participants during a video meeting is provided herein. The computerized method comprising: a Sentiment Analysis (SA) module. The SA module is: (i) retrieving one or more recordings of a video meeting from the database of video meeting recordings of each participant in the video meeting and associating the one or more recordings with a participant; (ii) dividing each retrieved recording into segments; (iii) processing the segments in a Facial Expression Recognition (FER) system to associate each segment with a timestamped sequence of expressions for each participant in the video meeting; and (iv) processing each segment in an Artificial Neural Network (ANN) having a dense layer, by applying a prebuilt and pretrained deep learning model, to yield a sentiment score for each statement for each participant.

Abstract: A computerized-system and method for generating a reduced-size superior labeled training-dataset for a high-accuracy machine-learning-classification model for extreme class imbalance by: (a) retrieving minority and majority class instances to mark them as related to an initial dataset; (b) retrieving a sample of majority instances; (c) selecting an instance to operate a clustering classification model on it and the instances marked as related to the initial dataset to yield clusters; (d) operating a learner model to: (i) measure each instance in the yielded clusters according to a differentiability and an indicativeness estimators; (ii) mark measured instances as related to an intermediate training dataset according to the differentiability and the indicativeness estimators; (e) repeating until a preconfigured condition is met; (f) applying a variation estimator on all marked instances as related to an intermediate training dataset to select most distant instances; and (g) marking the instances as related to

Abstract: A computerized-method for real-time detection of financial transactions suspicious for money-laundering, by processing high-speed streaming financial data. In a computerized-system receiving a financial data stream comprised of data points. Operating a Fused-Density (FD)-based clustering module that is configured to: (i) read the data points; (ii) maintain a grid system; (iii) maintain one or more provisional clusters (PROC)s; (iv) associate each data point with a grid or merge it to a PROC; (v) systemize the grid system and the PROCs; (vi) trim one or more grids and remove one or more PROCs; (vii) form one or more shape devise clusters based on the PROCs; and (viii) transmit the one or more shape devise clusters for analysis thereof, thus, enabling detection of financial transactions suspicious for money-laundering according to the one or more shape devise clusters which were formed out of the high-speed streaming financial data with money-laundering changing trends.