Abstract: Mitigating bias in a machine learning-augmented threat disposition platform can include generating a group of alerts in response to determining a similarity among the alerts. The alerts are generated in real time by a threat monitoring tool in response to one or more potential threats to a networked computing system. One or more alert spikes can be determined by partitioning the group into one or more alert spike subgroups. Each alert spike subgroup corresponds to an alert spike and contains two or more similar alerts that were generated within a predetermined time interval of one another. Duplicate alerts in each alert spike can be eliminated and each non-discarded alert labeled. The labeled alerts are used for training a reduced-bias machine learning model.

Abstract: A computer assesses device log entries. The computer receives a training log entry and an input log entry from a log entry corpus. The computer determines for the training log entry, status indicators respective to the group of log entries, The indicators are based on processing the training log entry with a group of unsupervised Machine Learning models calibrated to identify outliers. The computer assigns an outlier status based on the processing to the training log entry. The computer trains a supervised ML learning model with a data pair of the training log entry and an associated data label representing the assigned outlier status value. The computer processes the input log entry with the supervised ML model to predict an input log classification, and the log classification indicates whether the input log is anomaly. The computer generates an input log entry assessment report including the input log entry classification.