Abstract: Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.

Abstract: Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.

Abstract: In various embodiments, a process for providing automatic security message interaction includes receiving an indication of a suspicious message, and using one or more threat analysis machine learning models to analyze the suspicious message to determine a threat analysis result of the suspicious message. The process includes automatically generating a prompt for a machine learning large-language model to generate a responsive message communicating about the suspicious message, wherein the prompt is based at least in part on a result of the threat analysis result, security policies of an entity, and a communication preference of the entity. The process includes providing the generated responsive message to a recipient of the suspicious message.

Abstract: In various embodiments, a process for security threat detection using independent abnormality analysis and risk analysis includes receiving a plurality of events from a plurality of different digital service platforms. The process includes, for a specific event included in the plurality of events: determining an abnormality score using an abnormality detection machine learning model and determining a risk score using a risk detection machine learning model, wherein the risk score is different from the abnormality score. The process determines whether to perform a secondary analysis of the specific event to detect a security threat based on at least the abnormality score and the risk score.

Abstract: Indications of login events of a computer account, including a plurality of attributes of the login events, are received. Correlations between the plurality of attributes of the login events are tracked. A new indication of a new login event is received. Based at least in part on the tracked correlations and attributes of the new login event, a machine learning model is used to determine a result associated with whether the new login event is anomalous. A computer security action based on the result of the machine learning model is performed.

Abstract: A concept bridge employable with a search engine, method of operating the same and computer information system employing the concept bridge and method. In one embodiment, the concept bridge includes an extractor configured to derive concept terms by extracting significant terms from search text and inferring relevant terms therefrom. The concept bridge also includes a query generator configured to generate a query consistent with an index of a search engine as a function of the concept terms.