Abstract: A process for handling interleaved sequences using RNNs includes receiving data of a first transaction, retrieving a first state (e.g., a default or a saved RNN state for an entity associated with the first transaction), and determining a new second state and a prediction result using the first state and an input data based on the first transaction. The process includes updating the saved RNN state for the entity to be the second state. The process includes receiving data of a second transaction, where the second transaction is associated with the same entity as the first transaction. The process unloops an RNN associated with the saved RNN state including by: retrieving the second state, determining a new third state and a prediction result using the second state and an input data based the second transaction, and updating the saved RNN state for the entity to be the third state.

Abstract: A method and system for securing an online client-server session between a client device and a server device by application of at least a countermeasure, comprising the server device collecting client behavior pattern during the online session, the server device marking the online session as an affected session according to a pre-agreed client-server protocol, independently of any server-client contact, the client device requesting a client-initiated countermeasure according to the pre-agreed client-server protocol, the server device responding with an indication of a particular countermeasure to be carried out by the client device, the client device carrying out the indicated particular countermeasure and sending to the server device a reaction to the countermeasure, and the server device verifying the client reaction to the countermeasure, and if verified, marking the online session as non-affected.

Abstract: A computer-implemented method for obtaining a datasource schema comprising column-specific data-types and/or semantic-types from received tabular data records with values arranged in rows and columns, said method including: extracting a feature vector record comprising data-type recognition features for each of one or more columns of the received input tabular records; feeding the extracted feature vector records to a pretrained type classification discriminative machine learning model; using said model for classifying each extracted feature vector record of a corresponding column of received input tabular records into an estimated data-type and/or semantic-type, respectively, of the corresponding column. It is further disclosed a computer program product, a computer system and a method for training a machine learning model for obtaining the datasource schema.

Abstract: In various embodiment, a process for triaging alerts using machine learning includes receiving data associated with transactions and using computer processor(s) to analyze the received data using rule(s) to automatically identify potentially suspicious activities. The process includes scoring each of the identified potentially suspicious activities using a machine learning model and based at least in part on analysis results of the rule(s) associated with the identified potentially suspicious activities, and triaging the identified potentially suspicious activities including by determining an action to take with respect to at least a portion of the identified potentially suspicious activities based at least in part on the scoring. In various embodiments, a process for training a machine learning model to triage alerts includes configuring the machine learning model, and receiving training data.

Abstract: In an embodiment, a process for graph decomposition includes initializing nodes and edges of a data graph for analysis using a computer, and performing message passing between at least a portion of the nodes of the data graph to determine a corresponding measure of interest for each node of at least a portion of the data graph. The process further includes receiving an identification of one or more nodes of interest in the data graph, performing message passing between at least a portion of the nodes of the data graph using at least the determined measures of interest to identify a corresponding subgraph of interest for each of the one or more nodes of interest in the data graph, and performing an analysis action using the one or more identified subgraphs of interest.

Abstract: In various embodiments, a process for assessing transactional graphs based on generator-discriminator networks includes using a generator network to generate a first set of transaction graph samples that are of a generated type, wherein the generator network is trained to optimize a predetermined objective function. The process includes sampling, from a collected dataset, a second set of transaction graph samples that are of a non-generated type; and providing the first set of transaction graph samples and the second set of transaction graph samples to a discriminator network, wherein the discriminator network is trained to classify a provided transaction graph sample as the generated type or the non-generated type. The process includes discriminating, by the discriminator network, each of at least a portion of the first set of transaction graph samples and the second set of transaction graph samples as the generated type or the non-generated type.

Abstract: In various embodiments, a process for automatic profile extraction in data streams using recurrent neural networks includes receiving input sequence data associated with a stream of events and using a plurality of trained recurrent neural network machine learning models at least in part in parallel to determine different embedding output sets that represent at least a portion of the input sequence data in a plurality of different embedding spaces. The process includes providing the different embedding output sets to one or more classifier machine learning models to determine one or more classifier results, and using the one or more classifier results to provide a prediction output.

Abstract: In an embodiment, a process for automated rules management system includes receiving a specification of past predicted results of evaluation rules and corresponding observed outcomes. The process includes determining one or more sets of alternative activations or priorities of at least a portion of the evaluation rules, assessing the one or more sets of alternative activations or priorities of at least a portion of the evaluation rules, and optimizing result activations or priorities of at least a portion of the evaluation rules based at least in part on the assessment of the one or more sets of alternative activations or priorities.

Abstract: One or more events of a data stream are received. For each feature of a set of features, the one or more events are used to update a corresponding distribution of data from the data stream. For each feature of the set of features, the corresponding updated distribution and a corresponding reference distribution are used to determine a corresponding divergence value. For each feature of the set of features, the corresponding determined divergence value and a corresponding distribution of divergences are used to determine a corresponding statistical value. Using the statistical values each corresponding to a different feature of the set of features, a statistical analysis is performed to determine a result associated with a likelihood of data drift detection.

Abstract: A set of data elements is received. For each feature of a set of features, a corresponding reference distribution for the set of data elements is determined. For each feature of the set of features, one or more corresponding subset distributions for one or more subsets sampled from the set of data elements are determined. For each feature of the set of features, the corresponding reference distribution is compared with each of the one or more corresponding subset distributions to determine a corresponding distribution of divergences. At least the determined distributions of divergences for the set of features are provided for use in automated data analysis.

Abstract: A graph of nodes and edges is received. An identification of a starting node in the graph is received. Traversal walks on the graph from the starting node are automatically performed, wherein performing each of the traversal walks includes traversing to a randomly selected next node until any of one or more stopping criteria is met. One or more processors are used to determine one or more metrics based on the traversal walks. At least a portion of the one or more metrics is used to predict an illicit activity or entity.

Abstract: Input data is received. The received input data is provided to a trained discriminative machine learning model to determine an inference result. At least a portion of the received input data is used to determine a utility measure. A version of the determined inference result and the utility measure are used as inputs to a decision module optimizing one or more decision metrics to determine a decision result.

Abstract: In various embodiments, a process for providing an active learning annotation system that does not require historical data includes receiving a stream of unlabeled data, identifying a portion of the unlabeled data to label without access to label information, and receiving a labeled version of the identified portion of the unlabeled data and storing the labeled version as labeled data. The process includes analyzing the labeled version and at least a portion of the received unlabeled data that has not been labeled to identify an additional portion of the unlabeled data to label and store in the labeled data including by applying at least one warm up policy.

Abstract: A process for handling interleaved sequences using RNNs includes receiving data of a first transaction, retrieving a first state (e.g., a default or a saved RNN state for an entity associated with the first transaction), and determining a new second state and a prediction result using the first state and an input data based on the first transaction. The process includes updating the saved RNN state for the entity to be the second state. The process includes receiving data of a second transaction, where the second transaction is associated with the same entity as the first transaction. The process unloops an RNN associated with the saved RNN state including by: retrieving the second state, determining a new third state and a prediction result using the second state and an input data based the second transaction, and updating the saved RNN state for the entity to be the third state.

Abstract: In an embodiment, a process for automated rules management system includes receiving a specification of past predicted results of evaluation rules and corresponding observed outcomes. The process includes determining one or more sets of alternative activations or priorities of at least a portion of the evaluation rules, assessing the one or more sets of alternative activations or priorities of at least a portion of the evaluation rules, and optimizing result activations or priorities of at least a portion of the evaluation rules based at least in part on the assessment of the one or more sets of alternative activations or priorities.

Abstract: In an embodiment, a process for graph search and visualization includes receiving a query graph, and calculating one or more vectors for the query graph, where the one or more vectors each identifies a corresponding portion of the query graph. The process includes identifying one or more graphs similar to the query graph including by comparing the calculated one or more vectors for the query graph with one or more previously-calculated vectors for a different set of graphs and outputting the identified one or more similar graphs. The comparison with the previously-calculated vector(s) may be based on previously-calculated vector(s) processed by grouping the one or more vectors into at least one group of vectors, identifying a representative graph for each of the at least one group of vectors; and storing the at least one group of vectors and a respective identified representative graph.

Abstract: In an embodiment, a process for graph decomposition includes initializing nodes and edges of a data graph for analysis using a computer, and performing message passing between at least a portion of the nodes of the data graph to determine a corresponding measure of interest for each node of at least a portion of the data graph. The process further includes receiving an identification of one or more nodes of interest in the data graph, performing message passing between at least a portion of the nodes of the data graph using at least the determined measures of interest to identify a corresponding subgraph of interest for each of the one or more nodes of interest in the data graph, and performing an analysis action using the one or more identified subgraphs of interest.