Abstract: Feature randomization for securing machine learning models includes receiving an event, and altering, responsive to receiving the event, a threshold pseudo-randomly to generate an altered threshold value. Feature randomization further includes applying the altered threshold value to a threshold-dependent feature to generate an altered threshold-dependent feature value. The altered threshold-dependent feature value determined at least in part from the event. Feature randomization further includes executing a machine learning model, on the event and the altered threshold-dependent feature value, to generate a predicted event type for the event.

Abstract: A plurality of graph snapshots for a plurality of consecutive periodic time samples maps between connected components in consecutive graph snapshots and describes at least one feature of each connected component. A recursively-built tree tracks an evolution of one of the connected components through the plurality of graph snapshots, the tree including a root node representing the connected component at a final one of the consecutive periodic time samples and a plurality of leaf nodes branching from the root node. A plurality of paths is extracted from the tree by traversing the tree from the root node to respective ones of the plurality of leaf nodes. Each path contains data describing an evolution of a respective one of the connected components through time as indicated by evolution of the at least one feature of the respective one of the connected components.

Abstract: Certain aspects of the present disclosure provide techniques for detecting personally identifiable information, including: receiving a plurality of text strings, each text string of the plurality of text strings associated with a user support session; providing the plurality of text strings to one or more bidirectional long short-term memory (BiLSTM) neural network models; receiving output from the one or more BiLSTM neural network models, the output indicating one or more text data elements in the plurality of text strings comprising predicted personally identifiable information; redacting the one or more text data elements comprising the predicted personally identifiable information from the plurality of text strings to form redacted text strings; and providing, to a data repository, the redacted text strings.

Abstract: Methods, apparatus, and processor-readable storage media for user authentication with acoustic fingerprinting are provided herein. An example computer-implemented method includes generating, in response to an authentication request from a given device, an instruction for an acoustic output to be emitted and recorded by the given device; obtaining the recorded acoustic output from the given device; creating an acoustic fingerprint by applying one or more signal processing algorithms to the recorded acoustic output; processing the acoustic fingerprint and one or more items of information pertaining to the given device against historical authentication data; and resolving the authentication request in response to a determination that the acoustic fingerprint and the one or more items of information pertaining to the given device match at least a portion of the historical authentication data.

Abstract: A method includes generating a static model for classifying transactions of a designated type, the static model being trained using predefined input data corresponding to a first set of features generic to transactions of the designated type, and generating a dynamic model for classifying transactions of the designated type, the dynamic model being trained using dynamic input data corresponding to a second set of features specific to subsets of transactions of the designated type. The method also includes combining the static and dynamic models to generate a combined model, detecting transactions of the designated type between client devices and an enterprise system, and utilizing the combined model to classify a given detected transaction between a given client device and the enterprise system as potentially malicious or benign. The method further includes modifying processing of the given detected transaction responsive to classifying the given detected transaction as potentially malicious.

Abstract: Certain aspects of the present disclosure provide techniques for detecting personally identifiable information, including: receiving a plurality of text strings, each text string of the plurality of text strings associated with a user support session; providing the plurality of text strings to one or more bidirectional long short-term memory (BiLSTM) neural network models; receiving output from the one or more BiLSTM neural network models, the output indicating one or more text data elements in the plurality of text strings comprising predicted personally identifiable information; redacting the one or more text data elements comprising the predicted personally identifiable information from the plurality of text strings to form redacted text strings; and providing, to a data repository, the redacted text strings.

Abstract: Methods, apparatus, and processor-readable storage media for user authentication with acoustic fingerprinting are provided herein. An example computer-implemented method includes generating, in response to an authentication request from a given device, an instruction for an acoustic output to be emitted and recorded by the given device; obtaining the recorded acoustic output from the given device; creating an acoustic fingerprint by applying one or more signal processing algorithms to the recorded acoustic output; processing the acoustic fingerprint and one or more items of information pertaining to the given device against historical authentication data; and resolving the authentication request in response to a determination that the acoustic fingerprint and the one or more items of information pertaining to the given device match at least a portion of the historical authentication data.

Abstract: A method includes generating a static model for classifying transactions of a designated type, the static model being trained using predefined input data corresponding to a first set of features generic to transactions of the designated type, and generating a dynamic model for classifying transactions of the designated type, the dynamic model being trained using dynamic input data corresponding to a second set of features specific to subsets of transactions of the designated type. The method also includes combining the static and dynamic models to generate a combined model, detecting transactions of the designated type between client devices and an enterprise system, and utilizing the combined model to classify a given detected transaction between a given client device and the enterprise system as potentially malicious or benign. The method further includes modifying processing of the given detected transaction responsive to classifying the given detected transaction as potentially malicious.