Abstract: A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.

Abstract: Data is received that comprises a data set characterizing a plurality of insurance claims. Thereafter, a density function of the data set is estimated using kernel density estimation. At least one claim having at least one outlier variable is then identified using the density function. Data is then provided (e.g., displayed, stored, loaded into memory, transmitted to a remote computing system, etc.) that characterizes the at least one identified claim as likely being fraudulent or erroneous. Related apparatus, systems, techniques and articles are also described.

Abstract: A system and method for detecting anomalies in the measurement and distribution of utilities is disclosed. Utility metering data obtained at a utility meter is received through a communications network. A utility consumption associated with an entity is then measured based on the utility metering data. The utility consumption can then be monitored for anomalies based on entity profile characteristics associated with the entity. The utility analytics system and method can be applied to the electrical utility industry, but also applicable to gas and water distribution, and other utilities.

Abstract: A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.

Abstract: Data is received that characterizes a score model. Thereafter, the score model is normalized by transforming it into a directed acyclic graph. The directed acyclic graph is then transformed into a structured rules language program. The structured rules language program is then transformed into a program using a concurrent, class-based, object-oriented computer programming language (e.g., JAVA, C, COBOL, etc.). Related apparatus, systems, techniques and articles are also described.

Abstract: Data is received that include values that correspond to a plurality of variables. A score is then generated based on the received data and using a boosted ensemble of segmented scorecard models. The boosted ensemble of segmented scorecard models includes two or more segmented scorecard models. Subsequently, data including the score can be provided (e.g., displayed, transmitted, loaded, stored, etc.). Related apparatus, systems, techniques and articles are also described.

Abstract: A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.

Abstract: A customer profile is generated for a customer performing one or more transactions using temporal behavior maps in order to determine a score that can be used by an entity to determine offers for the customer. The temporal behavior maps can characterize a purchase behavior of the customer. Related apparatus, systems, techniques and articles are also described.

Abstract: As part of neural network sensitivity analysis, base outputs of hidden layer nodes of a neural network model for non-perturbed variables can be reused when perturbing the variables. Such an arrangement greatly reduces complexity of the calculations required to generate outputs of the model. Related apparatus, systems, techniques and articles are also described.

Abstract: A tree structure of plurality of information records arranged is recursively grown by splitting at least a portion of the records and by generating at least one predictive model. Related apparatus, systems, methods and computer program products are also described.

Abstract: Data is received that characterizes at least one of credit, financial, and demographic data for a consumer. Thereafter, estimated income is determined for the user. Using the estimated income and the data, a second income level for the consumer is determined also using a confidence interval model and a pre-defined confidence threshold Ci. The second income level for the consumer is less than the determined estimated income and is determined such that actual income for the consumer is Ci % likely to exceed the second income level. Data can then be provided that characterizes the second income level. Related apparatus, systems, techniques and articles are also described.

Abstract: Artificial neural network models trained using historical lead data are used to identify leads that are likely to be fraudulent or inaccurate and to additionally identify lead sources that provide leads likely to be fraudulent or inaccurate. Related apparatus, systems, techniques and articles are also described.

Abstract: A method, system and computer program product for reduced fraud customer impact through purchase propensity is disclosed. A probability estimate of spending by a consumer in a merchant transaction category is computed based on historical transaction data and consumer profile data, and a propensity score for the merchant transaction is generated. The propensity score represents a propensity for the consumer to conduct the merchant transaction. The propensity score is combined in a fraud model operating in a real-time transaction stream. The fraud score can be adjusted in accordance with the propensity score.

Abstract: A network assurance analytics (NAA) system and method is disclosed. The NAA can be part of a risk analytic for telecom (RAFT) program. The NAA system is configured to monitor telecommunications networks, detect errors or fraud in those telecommunications networks, and provide solutions to resolve the errors or reduce the fraud. Traffic of a telecommunications network is electronically monitored for at least one pattern that is indicative of a telecommunications anomaly. Based on a set of a set of telecommunications profiles stored in a database, a model score representing a value of the telecommunications anomaly is generated. A solution for the telecommunications network to reduce the model score associated with the telecommunications anomaly is then generated for execution on the telecommunications network.

Abstract: A computer-implemented method of tagging a transaction that includes tagging a transaction with one of a first tag value or a second tag value, forming a set of clusters associated with the tagged transactions having a first value, and forming a second set of clusters associated with the tagged transactions having a second value. The computer implemented method also includes determining a fuzzy tag value based on a relationship between the transaction and one of the centroids of the clusters having a first tag value, and one of the centroids of the clusters having second value. The method also includes replacing the first tag value or the second tag value with the fuzzy tag value.

Abstract: A method for selecting a next action includes reading transaction data, determining insights and relationships between a first entity and a second entity from the collected transaction data. Once these relationships and insights have been determined, the possibility of a future event occurring in one of a number of selected time periods can be determined using a predictive time-to-event component. A system for selecting a next action includes a memory for storing transaction data, an insight/relationship determination module, and a predictive time-to-event module. The memory, the insight/relationship determination module and the predictive time-to-event module carry out the above method. A programmable media having an instruction set can also cause a machine to carry out the above method.

Abstract: The present invention is directed to a method and method which analyzes large amounts of information on a real-time basis with no previous static data set. Attributes of the data, which can be thought of as data concepts, that are present in the data stream are detected and isolated. These concepts are referred to as clusters and are used to ultimately determine the semantics of the data stream. The streaming clusters have no “current membership” in the existing state of the clustering and thus the cluster sets, and their relationship to each other, must be generated and updated as the data is being received.

Abstract: A product space browser (PSB), which comprises a graphical user interface (GUI) that facilitates insight discovery through exploration and analysis of product space graphs generated by applying a product affinity engine to retailer's transaction data in a market basket context, is disclosed.

Abstract: Data is received that characterizes a transaction and includes a plurality of values corresponding to variables. Thereafter, a score is determined for the transaction based on the received data and using a scoring model. The scoring model only uses variables pairs having a divergence residual above a pre-defined threshold. Thereafter, data is provided that characterizes the determined score. Related apparatus, systems, techniques and computer program products are also described.

Abstract: The current subject matter describes scoring of transactions associated with a profiling entity so as to determine risk associated with the transactions. Data characterizing at least one new transaction can be received. A latent dirichlet allocation (LDA) model trained on historical data can be obtained. Based on new words in the received data, the LDA model can update a topic probability mixture vector. Based on the updated topic probability mixture vector, numerical values of one or more predictive features can be calculated. Based on the numerical values of the one or more predicted features, the at least one transaction in the received data can be scored. Related apparatus, systems, techniques and articles are also described.