Abstract: Systems and methods for providing insights about a machine learning model are provided. The method includes, using training data to train the machine learning model to learn patterns to determine whether data associated with an event provides an indication that the event belongs to a certain class from among a plurality of classes, evaluating one or more features of the machine learning model to produce a data set pairing observed scores S and a set of predictive input variables Vi, and constructing at least one data-driven estimator based on an explanatory statistic, the estimator being represented in a computationally efficient form and packaged with the machine learning model and utilized to provide a definition of explainability for a score generated by the machine learning model.

Abstract: Systems and methods for providing insights about a machine learning model are provided. The method includes, using training data to train the machine learning model to learn patterns to determine whether data associated with an event provides an indication that the event belongs to a certain class from among a plurality of classes, evaluating one or more features of the machine learning model to produce a data set pairing observed scores S and a set of predictive input variables Vi, and constructing at least one data-driven estimator based on an explanatory statistic, the estimator being represented in a computationally efficient form and packaged with the machine learning model and utilized to provide a definition of explainability for a score generated by the machine learning model.

Abstract: Systems and methods for training a machine learning model implemented over a network configured to represent the machine learning model are provided. At least one or more directed edges connect the one or more nodes an edge representing a connection between a first node and a second node, the second node computing an activation depending on the values of activations on first nodes and values associated with the connections, the connection being either conforming or non-conforming. The machine learning model may be trained by iteratively adjusting parameters w and b, respectively associated with weights and biases associated with edges connecting computational nodes. Connections between nodes may be sparsified by adjusting the parameter w to a first value for non-conforming connections during the training phase to reduce complexity of the connections among the plurality of nodes, or to ensure the input-output function of the network adheres to additional constraints.

Abstract: Systems and methods for providing insights about a machine learning model are provided. The method includes, using training data to train the machine learning model to learn patterns to determine whether data associated with an event provides an indication that the event belongs to a certain class from among a plurality of classes, evaluating one or more features of the machine learning model to produce a data set pairing observed scores S and a set of predictive input variables Vi, and constructing at least one data-driven estimator based on an explanatory statistic, the estimator being represented in a computationally efficient form and packaged with the machine learning model and utilized to provide a definition of explainability for a score generated by the machine learning model.

Abstract: A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.

Abstract: A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.

Abstract: The current subject matter describes scoring of transactions associated with a profiling entity so as to determine risk associated with the transactions. Data characterizing at least one new transaction can be received. A latent dirichlet allocation (LDA) model trained on historical data can be obtained. Based on new words in the received data, the LDA model can update a topic probability mixture vector. Based on the updated topic probability mixture vector, numerical values of one or more predictive features can be calculated. Based on the numerical values of the one or more predicted features, the at least one transaction in the received data can be scored. Related apparatus, systems, techniques and articles are also described.

Abstract: In one aspect, input data for a predictive model characterizing a level of risk for a data transaction is received that includes values for categorical variables and one or more of binary variables and continuous variables the predictive model. Thereafter, one or more of the categorical variables is associated with one of a plurality of keys. Each key having corresponding coefficients for at least a subset of the binary variables and the continuous variables and the coefficients being dependent on a value for the key. A composite value based on values for each of at least a subset of the binary variables and the continuous variables as calculated using the corresponding coefficients for each key can then be generated. Scoring of the data transaction using the binary variables, the continuous variables, and the composite variables can then be initiated by the predictive model. Related apparatus, systems, techniques and articles are also described.

Abstract: In one aspect, input data for a predictive model characterizing a level of risk for a data transaction is received that includes values for categorical variables and one or more of binary variables and continuous variables the predictive model. Thereafter, one or more of the categorical variables is associated with one of a plurality of keys. Each key having corresponding coefficients for at least a subset of the binary variables and the continuous variables and the coefficients being dependent on a value for the key. A composite value based on values for each of at least a subset of the binary variables and the continuous variables as calculated using the corresponding coefficients for each key can then be generated. Scoring of the data transaction using the binary variables, the continuous variables, and the composite variables can then be initiated by the predictive model. Related apparatus, systems, techniques and articles are also described.