Abstract: Systems, methods, and other embodiments associated with reinforcement learning agent-based metrics for describing monitoring system strength are described. In one embodiment, a method to test effectiveness of a transaction monitoring system includes executing a reinforcement learning agent to perform a sequence of test transactions that cumulatively transfer an amount without detection by a scenario. The set of test transactions is recorded along with responses made by the transaction monitoring system in response to each test transaction being performed. A metric that represents the effectiveness of the transaction monitoring system for resisting suspicious activity is generated based on the sequence of test transactions and the responses. A visualization of the metric to represent the effectiveness of the transaction monitoring system for resisting suspicious activity is generated for display in a graphical user interface.

Abstract: Systems, methods, and other embodiments associated with automatic scenario threshold tuning are described herein. In one embodiment, a method includes recording transactions performed by a reinforcement learning agent during attempts to evade a scenario while the scenario is configured with a current configuration of scenario thresholds. The transactions are also performed while the scenario is configured with an alternative configuration of the scenario thresholds. The alternative configuration of scenario thresholds is then determined to more fully satisfy a condition than the current configuration of scenario thresholds based on a change in alerts triggered. The scenario thresholds are then tuned to the alternative configuration.

Abstract: Systems, methods, and other embodiments associated with automatic transaction constraint modification are described herein. In one embodiment, a method includes recording transactions by a reinforcement learning agent during attempts to evade one or more scenarios of a monitoring system. A usage frequency is determined for a product in a subset of the attempts to evade the one or more scenarios that are successful. The usage frequency is then compared to an expected usage frequency for the product. A transaction constraint on the product is then automatically modified to cause the usage frequency to be at or below the expected usage frequency.

Abstract: Systems, methods, and other embodiments associated with reinforcement learning agent simulation for measurement of monitoring system strength are described. In one embodiment, a method includes training a reinforcement learning agent to learn a policy that evades one or more scenarios of a monitoring system while completing a task. The policy is then sampled to simulate an episode of steps taken by the reinforcement learning agent. The steps taken in the episode are then analyzed to measure a strength of monitoring in the monitoring system. The strength of monitoring is then presented in a user interface.

Abstract: Systems, methods, and other embodiments associated with redundant scenario decommissioning are described. In one embodiment, a method includes recording alerts triggered for two or more scenarios of a monitored system by a reinforcement learning agent that is attempting to evade the scenarios. An extent of overlap between first alerts of a first scenario of the monitored system and second alerts of a second scenario of the monitored system is determined. The first scenario is determined to be redundant based on the extent of overlap. The first scenario is then decommissioned in the monitored system.

Abstract: Systems, methods, and other embodiments associated with a reinforcement learning agent for evaluation of monitoring system strength are described. In one embodiment, a method includes configuring an environment to simulate a monitored system for a reinforcement learning agent; training the reinforcement learning agent over one or more training episodes to learn a policy that evades scenarios of the simulated monitored system while completing a task; recording an episode of steps taken by the reinforcement learning agent, result states, and triggered alerts; determining strength of monitoring of the simulated monitored system based on the recorded episodes; and automatically modifying the scenarios in the monitored system in response to the determined strength.