Abstract: A machine learning (ML)-based technique for user behavior analysis that detects when users deviate from expected behavior. A ML model is trained using training data derived from activity data from a first set of users. The model is refined in a computationally-efficient manner by identifying a second set of users that constitute a “watch list.” At a given time, a differential data ingestion operation is then performed to incorporate data for the second set of users into the training data, while also pruning at least a portion of the data set corresponding to data associated with any user included in the first set but not in the second set. These operations update the training data used for the machine learning. The machine learning model is then refined based on the updated training data that incorporates the activity data ingested from the users identified in the watch list.

Abstract: A machine learning (ML)-based technique for user behavior analysis that detects when users deviate from expected behavior. A ML model is trained using training data derived from activity data from a first set of users. The model is refined in a computationally-efficient manner by identifying a second set of users that constitute a “watch list.” At a given time, a differential data ingestion operation is then performed to incorporate data for the second set of users into the training data, while also pruning at least a portion of the data set corresponding to data associated with any user included in the first set but not in the second set. These operations update the training data used for the machine learning. The machine learning model is then refined based on the updated training data that incorporates the activity data ingested from the users identified in the watch list.