Abstract: Methods, systems, and computer program products for applying multi-level clustering at scale to unlabeled data for anomaly detection and security are disclosed. A computer-implemented method may include receiving transactional data associated with a plurality of user accounts, analyzing the transactional data of the accounts in view of a clustering model, associating each of the accounts with one of multiple peer groups from the clustering model, detecting anomalous account behavior in a peer group in view of a scatteredness score computed for each account in the peer group where each scatteredness score is computed based on a neighborhood of accounts in the peer group determined for each respective account of the peer group, and creating a report comprising account and scatteredness score information for one or more of the accounts in the peer group associated with detected anomalous account behavior.

Abstract: Various systems, mediums, and methods may perform operations, such as collecting various types of data from one or more data sources. Further, the operations may include learning user behaviors based on iterations of the collected historical data with a recurrent neural network (RNN) with long short term memory (LSTM). Yet further, the operations may include determining one or more feature vectors that represents the learned user behaviors. In addition, the operations may include generating one or more models associated with the learned user behaviors based on the one or more determined vectors.

Abstract: Various systems, mediums, and methods for providing services may involve data engines configured to generate scores associated with one or more entities and then to classify the entities based on the scores. The data engine may collect data and based on the collected data may generate a first behavior model in a first time span, and a second and third behavior models in a second time span. The data engine may generate a first score based on the first behavior model, a second score based on the second behavior model, and a third score based on the third behavior model. The data engine may generate a final score based on the first, second, and third scores. The data engine can classify the entity based on the final score. The data engine can then automatically adjust one of the services provided to the entity based on the final score.

Abstract: Methods, systems, and computer program products for applying multi-level clustering at scale to unlabeled data for anomaly detection and security are disclosed. A computer-implemented method may include receiving transactional data associated with a plurality of user accounts, analyzing the transactional data of the accounts in view of a clustering model, associating each of the accounts with one of multiple peer groups from the clustering model, detecting anomalous account behavior in a peer group in view of a scatteredness score computed for each account in the peer group where each scatteredness score is computed based on a neighborhood of accounts in the peer group determined for each respective account of the peer group, and creating a report comprising account and scatteredness score information for one or more of the accounts in the peer group associated with detected anomalous account behavior.

Abstract: A system, a medium, and a method are provided to exchange data packets over a communications network and perform machine learning operations. A network server device receives account data from client devices that correspond to account profiles. An account engine of the network server device segments the account profiles into profile groups based on a respective balance associated with each account profile. The account engine determines target accounts from profile groups based on behavioral data. Further, data processing components of the network server device determine a method of contact for each target account. The data processing components determine a respective time to communicate with a respective device for each target account. Further, communication components of the network server device initiate communications to the respective devices at the respective times for each target account.