Abstract: One method includes detecting a condition associated with an event stream of a first plurality of event streams associated with a first system; determining that the event stream is associated with a second system; identifying a second plurality of event streams associated with the second system; generating, based on the condition, an event data structure comprising a first set of events identified from the first plurality of event streams and a second set of events identified from the second plurality of event streams; converting the event data structure into at least two feature vectors corresponding to the first system and the second system for one or more machine-learning models; and executing the one or more machine-learning models using the at least two feature vectors as input and outputting a likelihood of fraud for the first system or the second system.