Abstract: Methods, computer systems and computer program product are provided for retrieving contextually relevant documents in near real time. When text data it's received from an application, the text data is processed through a text segmentation model to generate a set of documents. Each document corresponds to a segment of the text data. A first vector representation is generated for a first document of the set of documents. A machine learning process compares the first vector representation and a set of vector representations for a set of documents within a data repository to determine a subset of the documents. A composite rank is generated for each respective document of the subset. The subset of documents is then presented through an interface, sorted according to the respective composite ranks.

Abstract: A processor may receive clear text data. The processor may represent at least a portion of the clear text data as at least one array encoding a description of at least one feature of the clear text data. The processor may process the at least one array using a clustering algorithm to determine whether the at least one array is grouped with a benign cluster or a sensitive cluster of a model. In response to determining that the at least one array is grouped with the sensitive cluster, the processor may generate an alert indicating that the clear text data includes sensitive information.

Abstract: A computer-implemented method is provided to preforming re-categorization of financial transactions. The re-categorization is implemented by a server computing device which receives the financial transactions associated with a merchant and a first category. The server computing device receives user inputs that are each associated with re-categorizing a financial transaction from the first category to one or more other categories. Based at least in part on a count of the first category and counts of the one or more other categories, the server computing device determines a set of normalized ratios for the first category and the one or more other categories with respect to a total number of respective financial transactions received. The server computing device determines a second category corresponding to a minimum value in the set of the normalized ratios for each financial transaction associated with the merchant.

Abstract: A computer-implemented method is provided to preforming re-categorization of financial transactions. The re-categorization is implemented by a server computing device which receives the financial transactions associated with a merchant and a first category. The server computing device receives user inputs that are each associated with re-categorizing a financial transaction from the first category to one or more other categories. Based at least in part on a count of the first category and counts of the one or more other categories, the server computing device determines a set of normalized ratios for the first category and the one or more other categories with respect to a total number of respective financial transactions received. The server computing device determines a second category corresponding to a minimum value in the set of the normalized ratios for each financial transaction associated with the merchant.

Abstract: A method for privacy preserving synthetic string generation using recurrent neural networks includes receiving input data that includes a plurality of strings with private information. A neural network model is trained using the plurality of strings. The neural network model includes a recurrent neural network (RNN). An anonymous string is generated with the neural network model after training the neural network model with the plurality of strings from the input data. The anonymous string is validated to preclude the private information from the anonymous string. Anonymous data is transmitted that includes the anonymous string and precludes the private information in response to a request for the anonymous data.

Abstract: Certain aspects of the present disclosure provide techniques for detecting personally identifiable information, including: receiving a plurality of text strings, each text string of the plurality of text strings associated with a user support session; providing the plurality of text strings to one or more bidirectional long short-term memory (BiLSTM) neural network models; receiving output from the one or more BiLSTM neural network models, the output indicating one or more text data elements in the plurality of text strings comprising predicted personally identifiable information; redacting the one or more text data elements comprising the predicted personally identifiable information from the plurality of text strings to form redacted text strings; and providing, to a data repository, the redacted text strings.

Abstract: A method is disclosed. The method includes: obtaining, from a management application, a login history including timestamps and internet protocol (IP) addresses corresponding to logins by a user; obtaining coordinates for the IP addresses; determining clusters for the coordinates based on distances between the coordinates; and determining primary locations for the user based on the clusters and the timestamps.

Abstract: Certain aspects of the present disclosure provide techniques for improving a prediction of whether a non-sufficient funds fee will be incurred by a user utilizing machine learning techniques. For example, a predictive model may be trained using machine learning techniques based on historical data and derived data for a plurality of users. The predictive model may then be used to predict a probability of a particular user incurring an insufficient funds fee. The probability of the particular user may be used to generate an alert and suggestion to be presented to the particular user to avoid incurring the insufficient funds fee.

Abstract: A method including establishing, using electronic transactions of a user, a geo-temporal trajectory of the user. The method also includes forming a first data structure by sub-dividing the geo-temporal trajectory into segments including subsets of the electronic transactions along the geo-temporal trajectory. Sub-dividing is performed with respect to a selected feature. The method also includes gathering, for a subset of the segments, a corresponding labeled dataset of transactions within the electronic transactions to generate a second data structure. The method also includes applying, as input, the second data structure to a machine learning classifier. The method also includes receiving, from the machine learning classifier, an assignment of disambiguated labels to the electronic transactions. The method also includes storing, automatically in a financial management application, the disambiguated labels as assigned to the electronic transactions.

Abstract: Certain aspects of the present disclosure provide techniques for automatic form detection and completion. When a form is first identified by systems and methods disclosed herein, an image of the form is acquired and the form is uniquely identified. The image of the form is presented to a user, who clicks on areas of the form image and provides data into the areas so chosen. The coordinates of the user input in the form image, data provided by the user, and attributes of that data, are stored. Once a sufficient number of users, determined by a confidence interval threshold, have used the form in this manner, the user data input is clustered around user defined input coordinates. From the user data, a data schema of the user input is determined, and the data schema is assigned to the related user defined input coordinates.

Abstract: Certain aspects of the present disclosure provide techniques for detecting personally identifiable information, including: receiving a plurality of text strings, each text string of the plurality of text strings associated with a user support session; providing the plurality of text strings to one or more bidirectional long short-term memory (BiLSTM) neural network models; receiving output from the one or more BiLSTM neural network models, the output indicating one or more text data elements in the plurality of text strings comprising predicted personally identifiable information; redacting the one or more text data elements comprising the predicted personally identifiable information from the plurality of text strings to form redacted text strings; and providing, to a data repository, the redacted text strings.

Abstract: A method that involves receiving a set of first log records. The set of first log records are duplicated using key operation pairs to generate a set of second log records from the set of first log records. The set of second log records are duplicated using a second set of intervals to generate a set of third log records from the set of second log records. The set of third log records are aggregated using the second set of intervals to generate a set of aggregated log records. The set of aggregated log records includes an aggregated log record comprising a number indicating a number of events from the set of first log records that have the key, that have the operation, and that occurred during an interval of the second set of intervals. The operation is identified by comparing the aggregated log record to a server log record.

Abstract: A computer-implemented method is provided to preforming re-categorization of financial transactions. The re-categorization is implemented by a server computing device which receives the financial transactions associated with a merchant and a first category. The server computing device receives user inputs that are each associated with re-categorizing a financial transaction from the first category to one or more other categories. Based at least in part on a count of the first category and counts of the one or more other categories, the server computing device determines a set of normalized ratios for the first category and the one or more other categories with respect to a total number of respective financial transactions received. The server computing device determines a second category corresponding to a minimum value in the set of the normalized ratios for each financial transaction associated with the merchant.

Abstract: A method for increasing computer network security. A first request to attach a first user account for a software program to an external secure account is received. The first request includes a first set of user credentials for accessing the external secure account and a first unverified email address, the external secure account controlled by a second external computer. After receiving the first request, features having metrics is received. The metrics describe at least creation of the first user account and include at least the first unverified email address. A machine learning model processing the features calculates a probability score that the first request is fraudulent. The probability score is compared to a threshold to form a comparison result. A security action is performed with respect to attaching the first user account to the external secure account in response to the comparison result.

Abstract: Known fraudulent invoice data, including defined and known fraudulent invoice feature data, is used to train a machine learning-based fraudulent invoice detection model to generate a fraudulent invoice score for invoices indicating a determined probability that a given invoice is fraudulent. The machine learning-based fraudulent invoice detection model is then used to generate a fraudulent invoice score for subsequent invoices before those invoices are paid by, and in some cases before the invoices are provided to, the parties being asked to pay the invoices. The fraudulent invoice score for the subsequent invoice is then used to determine if the subsequent invoice should be passed on to the parties being asked to pay the invoices for payment, or if one or more protective actions should be taken.

Abstract: A method for detecting an unauthorized activity on a computer system involves obtaining current time stamps for a first type of access event related to the computer system, determining a current count of the first type of access event using the current time stamps, and predicting an expected count of the first type of access event using a current count of time stamps and a predictive model. The method further involves obtaining an actual count of the first type of access event, executing a first comparison of the actual count with the expected count, determining, based on a test comprising the first comparison, that the unauthorized access to the computer system occurred, and issuing an alert indicating the unauthorized activity occurred.

Abstract: A method is disclosed. The method includes: obtaining, from a management application, a login history including timestamps and internet protocol (IP) addresses corresponding to logins by a user; obtaining coordinates for the IP addresses; determining clusters for the coordinates based on distances between the coordinates; and determining primary locations for the user based on the clusters and the timestamps.