Abstract: A method for halting malware includes: monitoring plural file system events with a system driver to detect an occurrence of a file system event having a predetermined file type and log event type; triggering a listening engine for file system event stream data of a file associated with the detection of the file system event, the file system event stream data indicating data manipulation associated with the file due to execution of a process; obtaining one or more feature values for each of plural different feature combinations of plural features of the file based on the file system event stream data; inputting one or more feature values into a data analytics model to predict a target label value based on the one or more feature values of the plural different feature combinations and agnostic to the process; and performing a predetermined operation based on the target label value.

Abstract: A method for automated assessment of a model includes: training a model to perform a prediction, diagnostic, or classification operation based on a training dataset; deploying the model in production to perform the operation on field data; monitoring signal data associated with the model automatically, the signal data including specific or derived signal data representing characteristics of an ecosystem in which the model is deployed and new observations in incoming field data; monitoring accuracy of the model by applying a statistical tool to a plurality of data points of the signal data; determining whether the signal data represents an unstable process by identifying outlier data points from among the plurality of data points of the signal data; generating an indication that a corrective action should be taken on the model based on a result of the determination; and displaying the indication on a display.