Abstract: The disclosed embodiments provide a system for processing data. During operation, the system obtains a feature configuration for a feature. Next, the system obtains, from the feature configuration, an anchor containing metadata for accessing the feature in an environment. The system then uses one or more attributes of the anchor to retrieve one or more feature values of the feature from the environment. Finally, the system provides the one or more feature values for use with one or more machine-learning models.

Abstract: The disclosed embodiments provide a system for processing user actions with a service. During operation, the system uses a statistical model to obtain a first metric associated with a user action received by a service. Next, the system applies a set of static decisions to the metric and one or more attributes of the user action to determine a first response to the user action. The system then uses a set of dynamic rules to produce a first modification to the first response. Finally, the system generates output for applying the first response to the user action.

Abstract: The disclosed embodiments provide a system for processing data. During operation, the system obtains feature configurations for a set of features. Next, the system obtains, from the feature configurations, an anchor containing metadata for accessing a first feature in an environment and a feature derivation for generating a second feature from the first feature. The system then uses the anchor to retrieve feature values of the first feature from the environment and uses the feature derivation to generate additional feature values of the second feature from the feature values of the first feature. Finally, the system provides the additional feature values for use with one or more machine learning models.

Abstract: The disclosed embodiments provide a system for processing data. During operation, the system obtains a feature configuration for a feature. Next, the system obtains, from the feature configuration, an anchor containing metadata for accessing the feature in an environment. The system then uses one or more attributes of the anchor to retrieve one or more feature values of the feature from the environment. Finally, the system provides the one or more feature values for use with one or more machine-learning models.

Abstract: The disclosed embodiments provide a system for processing data. During operation, the system obtains feature configurations for a set of features and a command for inspecting a data set that is produced using the feature configurations. Next, the system obtains, from the feature configurations, one or more anchors containing metadata for accessing the set of features in an environment and a join configuration for joining a feature with one or more additional features. The system then uses the anchors to retrieve feature values of the features and zips the feature values according to the join configuration without matching entity keys associated with the feature values. Finally, the system outputs the zipped feature values in response to the command.

Abstract: Techniques are provided for automatically detecting organizational affiliation of host addresses based on analysis of records. In an embodiment, computers store membership records and access records. Each membership record has an organization identifier that identifies an organization and a member identifier that identifies a member. Each access record has a member identifier that identifies a member and an address that identifies a host. The computers identify a localized subset of access records that have a particular address. The computers identify an involved subset of membership records having a member identifier that matches a member identifier of an access record of the localized subset. The computers determine statistical information based on the localized subset of access records and the involved subset of membership records.

Abstract: The disclosed embodiments provide a system for processing actions with a service. During operation, the system obtains a first attribute associated with a first cluster of entities identified as malicious to a service. Next, the system matches the first attribute to a second attribute of an entity in the first cluster. The system then uses the second attribute to identify a second cluster of entities as malicious to the service. Finally, the system uses cluster scores for identifying the first and second clusters of entities as malicious to the service to output responses to actions associated with entities in the first and second clusters of entities.

Abstract: The disclosed embodiments provide a system for processing user actions with a service. During operation, the system uses a statistical model to obtain a first metric associated with a user action received by a service. Next, the system applies a set of static decisions to the metric and one or more attributes of the user action to determine a first response to the user action. The system then uses a set of dynamic rules to produce a first modification to the first response. Finally, the system generates output for applying the first response to the user action.