Abstract: Computerized methods and systems evaluate threats in a cloud environment having a plurality of assets. For each pair of one or more pairs of the assets, one or more identified paths from a first asset of the pair to a second asset of the pair is obtained. A sequence of assets that includes the first and second assets defines each path of the one or more identified paths. For each path of the one or more identified paths, a likelihood that an attacker that is at the first asset will successfully reach the second asset via the path is determined. In certain embodiments, for each pair of the one or more pairs a risk score for the pair is determined based on the determined likelihoods for the one or more identified paths. The risk score is indicative of risk the attacker will reach the second asset from the first asset.

Abstract: A rule training system and methods are provided that are configured to automatically generate machine learning (ML) rules for intelligent decision-making by a policy manager platform. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform rule training operations which include accessing rule training data, iteratively generating a plurality of decision rules based on the rule training data and a plurality of ML model training techniques, testing each of the plurality of decision rules, filtering the plurality of decision rules by corresponding performances, selecting a set of the plurality of decision rules based on alert metrics, evaluating the set of the plurality of decision rules, and generating a decision ruleset for the ML task.

Abstract: Computerized methods and systems obtain threat data generated from activity data using unsupervised learning. The activity data is collected from enterprises and describes activities performed on the enterprises. The threat data indicates likelihood that sequences of activities performed on the enterprises are indicative of malicious intent. A supervised ML model that processes sequential data is trained by providing a training set of sequential data to the supervised ML model. The training set includes at least some of the obtained threat data, and data derived from activity data collected from at least some of the enterprises. The trained supervised ML receives new data that describes a sequence of activities performed on an enterprise, and processes the received new data to produce a prediction of whether the sequence of activities performed on the enterprise will lead to a malicious action on the enterprise. In some embodiments, multiple supervised ML models are used.

Abstract: Computerized methods and systems obtain a plurality of first data sets associated with a plurality enterprises. Each first data set is associated with a corresponding one of the enterprises and has data indicative of activity performed in association with the corresponding enterprise. The plurality of first data sets is processed using a first LLM to produce, from each first data set, a second data set that provides a summary of a sequence of events that occurred on the enterprise corresponding to first data set. At least some of the second data sets, which are associated with a proper subset of the enterprises, are processed using a second LLM to identify patterns. For an enterprise not in the proper subset, a current security posture of the enterprise is processed together with the identified patterns to produce a recommended security posture for the enterprise.

Abstract: An artificial intelligence system configured to detect anomalies in transaction data sets. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform modeling operations which include receiving a first data set for training a first machine learning model to detect anomalies in the transaction data sets using a machine learning technique, accessing at least one micro-model trained using at least one second data set separate from the first data set, determining risk scores from the first data set using the at least one micro-model, enriching the first data set with the risk scores, and determining the first machine learning model for the enriched first data set using the machine learning technique.

Abstract: A system is provided for estimating quantile values for fraud assessments. The system includes a processor and a computer readable medium operably coupled thereto, to perform operations which include capturing one or more first data values for a quantile value profile associated with an entity, wherein the quantile value profile includes one of real values or a first plurality of quantile marker values calculated from the real values, accessing the quantile value profile for the entity, determining a first number of the one or more first data values, and based on the first number of the one or more first data values and the one of the real values or the first plurality of quantile marker values in the quantile value profile, performing one of a first merge operation, a second merge operation, or a third merge operation.

Abstract: A computerized-method for testing a classification ML model of a tenant of a service provider, in a cloud-based environment. The computerized-method includes: (i) receiving an object of a classification ML model for testing from the tenant; (ii) executing an API with the received object of the classification ML model; (iii) identifying one or more tenants of the service provider based on an activity type and preconfigured characteristics by the executed API; (iv) performing an evaluation of the object of the classification ML model by operating the API on each retrieved dataset of the one or more tenants of the service provider to evaluate the object of the classification ML model and store score-results; and (v) calculating an average of the stored score-results to yield a performance-score of the classification ML model. When the performance-score is above a predefined performance-score deploying the classification ML model in a system of the tenant.

Abstract: A computerized-method for building ensemble of supervised and unsupervised Machine Learning (ML) models for fraud-predictions, for a client having an extremely-imbalanced-dataset, is provided herein.

Abstract: A computerized-method for maintaining ethical Artificial-Intelligence by generating a representative-training-sample-dataset for a fraud-detection Machine-Learning (ML) model, by: (i) operating a representative-dataset-preparation module to generate a representative-training-sample-dataset by operating balanced-sampling on randomly-selected preconfigured-number of financial-transactions. The balanced-sampling may be operated by applying a configurable-rule on at least two values of a parameter of non-sensitive PII parameters of each financial-transaction by a low-frequency value; (ii) training the fraud-detection ML model on the representative-training-sample-dataset; and (iii) deploying the trained fraud-detection ML model in a finance-system in test-environment, and operating the trained fraud-detection ML model on a stream-of-financial-transactions to predict a risk-score for each financial-transaction.

Abstract: A machine learning (ML) system configured to detect fraud in tenant data systems. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform ML modeling operations which include receiving a first data set, determining that the first data set meets or exceeds a low fraud tenant threshold, segmenting the first tenant data system based on the first data set, determining first features of a first ML model, determining a first explanation of a first feature importance of each of the first features, comparing the first tenant data system to a second tenant data system based on at least the first explanation and a second explanation, ranking at least the first features and the second features, and performing a feature selection.

Abstract: A system and method is provided for automatically creating machine learned fraud detection models. Data received from a plurality of devices can be used to train a model for each of the plurality of entities. Each of the models can be trained using recursive model stacking and each model can output a corresponding score. A second model can be trained for each of the plurality of entities based on the first model and a corresponding output score of the first model. The second model can also be trained using recursive model stacking.

Abstract: A system is provided for estimating quantile values for fraud assessments. The system includes a processor and a computer readable medium operably coupled thereto, to perform operations which include capturing one or more first data values for a quantile value profile associated with an entity, wherein the quantile value profile includes one of real values or a first plurality of quantile marker values calculated from the real values, accessing the quantile value profile for the entity, determining a first number of the one or more first data values, and based on the first number of the one or more first data values and the one of the real values or the first plurality of quantile marker values in the quantile value profile, performing one of a first merge operation, a second merge operation, or a third merge operation.

Abstract: A method and system for building and implementing a meta-machine learning (meta-ML) optimization engine for a neural network (NN) or a machine learning (ML) connective model. A computer processor may iteratively simulate a backpropagation algorithm by executing a sequence of optimization steps. At each optimization step a position of a loss function may be determined that may be closer than a previously determined position of the loss function to a local minimum. A computer processor may compute and store after each iteration a detachment of the loss function, learning rate, and optimal learning rate. A computer processor may train a machine learning connective model to model the optimal learning rates of the simulated backpropagation algorithm. The meta-ML optimization engine may be implemented for a NN or ML connective model by generating a modified backpropagation algorithm in which algorithmic features of gradient descent may be replaced by the meta-ML optimization engine.

Abstract: An artificial intelligence system configured to detect anomalies in transaction data sets. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform modeling operations which include receiving a first data set for training a first machine learning model to detect anomalies in the transaction data sets using a machine learning technique, accessing at least one micro-model trained using at least one second data set separate from the first data set, determining risk scores from the first data set using the at least one micro-model, enriching the first data set with the risk scores, and determining the first machine learning model for the enriched first data set using the machine learning technique.

Abstract: A method and system for generating content title recommendations for content titles associated with a content page is disclosed. The method and system collects user activity data representing user engagement levels relating to multiple content webpages, wherein each content page is associated with a content title. A title replacement candidate is identified in view of the collected user activity data, wherein the title replacement candidate includes a plurality of title components. The title replacement candidate is compared to one or more high user engagement value titles. Based on the comparison, one or more high user engagement title component recommendations are identified which correspond to one or more of the title components of the title replacement candidate.