Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for providing consistent processing in a machine learning system are disclosed. A real-time processing request may be received and processed by both a preferred machine learning model and a fallback machine learning model. Processing for the preferred machine learning model may include obtaining additional information. A determination may be made regarding whether the processing of the real-time request by the preferred machine learning model has completed as of an expiration of an acceptable latency period. If the preferred model has not completed as of the expiration of an acceptable latency period, the response to the real-time request may be generated from the fallback model output. If the preferred model has completed prior to or by the expiration of the acceptable latency period, the response to the request may be generated from the preferred model output.

Abstract: System and methods for determining network threats are disclosed. For each entity operating in a network being monitored for network security, an example method obtains an observed metric value for each metric that characterizes actions performed by the entity. Each observed metric value may be input into a machine learning model that is specific to the metric in order to determine an anomaly score for the observed metric value that represents how anomalous the observed metric value is relative to an expected metric value for the metric. A threat score may then be determined for each entity from the anomaly scores for each metric. A security threat presentation that identifies one or more high-scoring entities according to the threat scores may be generated and provided for display on a user device.

Abstract: System and methods for determining network threats are disclosed. For each entity operating in a network being monitored for network security, an example method obtains an observed metric value for each metric that characterizes actions performed by the entity. Each observed metric value may be input into a machine learning model that is specific to the metric in order to determine an anomaly score for the observed metric value that represents how anomalous the observed metric value is relative to an expected metric value for the metric. A threat score may then be determined for each entity from the anomaly scores for each metric. A security threat presentation that identifies one or more high-scoring entities according to the threat scores may be generated and provided for display on a user device.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for providing consistent processing in a machine learning system are disclosed. A real-time processing request may be received and processed by both a preferred machine learning model and a fallback machine learning model. Processing for the preferred machine learning model may include obtaining additional information. A determination may be made regarding whether the processing of the real-time request by the preferred machine learning model has completed as of an expiration of an acceptable latency period. If the preferred model has not completed as of the expiration of an acceptable latency period, the response to the real-time request may be generated from the fallback model output. If the preferred model has completed prior to or by the expiration of the acceptable latency period, the response to the request may be generated from the preferred model output.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for training a machine learning model. One of the methods includes receiving a complete set of training data; receiving instructions to train a predictive model having a plurality of parameters on an initial subset of the complete set of training data; training the predictive model on the initial subset; storing data representing a first state of the predictive model after training the predictive model on the initial subset; receiving updated parameter values and instructions to train the predictive model on a new subset of the complete set of training data; and training the predictive model on the new subset.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for training a machine learning model. One of the methods includes performing experiments to select a training strategy for use in training the model on a particular data set. The selected training strategy includes a binning strategy for binning the raw feature vectors before the raw feature vectors are provided to the predictive model.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for training machine learning models. The models can include models for predicting a next transaction price or a next transaction price direction for one or more financial products, for classifying particular debit or credit card transactions as likely being anomalous or fraudulent or not, or for classifying particular financial claims processing transactions, e.g., insurance, health care, or employee expense claims transactions, as likely being anomalous or fraudulent or not.