Abstract: A process for handling interleaved sequences using RNNs includes receiving data of a first transaction, retrieving a first state (e.g., a default or a saved RNN state for an entity associated with the first transaction), and determining a new second state and a prediction result using the first state and an input data based on the first transaction. The process includes updating the saved RNN state for the entity to be the second state. The process includes receiving data of a second transaction, where the second transaction is associated with the same entity as the first transaction. The process unloops an RNN associated with the saved RNN state including by: retrieving the second state, determining a new third state and a prediction result using the second state and an input data based the second transaction, and updating the saved RNN state for the entity to be the third state.

Abstract: In various embodiments, a process for providing a self-supervised framework for graph representation learning includes receiving entity data for a plurality of entities and receiving transaction data for transactions between corresponding entities included in the plurality of entities. The process includes generating a heterogeneous graph representation. Nodes of the heterogeneous graph representation includes a first type of node representing an entity of the plurality of entities and a second type of node representing the transactions. The process includes performing a self-supervised training of a graph neural network including by sampling the heterogeneous graph representation for positive samples and negative samples to learn embedding representations for the nodes of the heterogeneous graph representation, and utilizing the learned embedding representations for the nodes of the heterogeneous graph representation for automatic transaction analysis.

Abstract: In various embodiments, a process for alert review using machine learning and interactive visualizations includes receiving transaction data for transactions, using a machine learning model to determine embedding representations of the transaction data, and using one or more automated rules to identify of a subset of the transactions. The process includes using at least a portion of the embedding representations to automatically cluster the identified subset of the transactions into a plurality of different cluster groups, and providing an interactive visual representation of the plurality of different cluster groups.

Abstract: A computer-implemented method for obtaining a datasource schema comprising column-specific data-types and/or semantic-types from received tabular data records with values arranged in rows and columns, said method including: extracting a feature vector record comprising data-type recognition features for each of one or more columns of the received input tabular records; feeding the extracted feature vector records to a pretrained type classification discriminative machine learning model; using said model for classifying each extracted feature vector record of a corresponding column of received input tabular records into an estimated data-type and/or semantic-type, respectively, of the corresponding column. It is further disclosed a computer program product, a computer system and a method for training a machine learning model for obtaining the datasource schema.

Abstract: In various embodiments, a process for obtaining a generated dataset with a predetermined bias for evaluating algorithmic fairness of a machine learning model includes receiving an input dataset and generating an anonymized reconstructed dataset based at least on the input dataset. The process includes introducing a predetermined bias into the generated dataset, forming an evaluation dataset based at least on the generated dataset with the predetermined bias, and outputting the evaluation dataset. In various embodiments, a process for training a generative model includes configuring a generative model and receiving training data, where the training data includes a tabular dataset. The process includes using computer processor(s) and the received training data to train the generative model, where the generative model is sampled to generate a dataset with a predetermined bias.

Abstract: In an embodiment, a process for automatic model monitoring for data streams includes receiving an input dataset, using a machine learning model to determine a model score for each data record of at least a portion of the input dataset, and determining monitoring values. Each monitoring value is associated with a measure of similarity between model scores for those data records of the input dataset within a corresponding moving reference window and model scores for those data records of the input dataset within a corresponding moving target window. The process includes outputting the determined monitoring values.

Abstract: In various embodiment, a process for triaging alerts using machine learning includes receiving data associated with transactions and using computer processor(s) to analyze the received data using rule(s) to automatically identify potentially suspicious activities. The process includes scoring each of the identified potentially suspicious activities using a machine learning model and based at least in part on analysis results of the rule(s) associated with the identified potentially suspicious activities, and triaging the identified potentially suspicious activities including by determining an action to take with respect to at least a portion of the identified potentially suspicious activities based at least in part on the scoring. In various embodiments, a process for training a machine learning model to triage alerts includes configuring the machine learning model, and receiving training data.

Abstract: In various embodiments, a process for providing a distributed streaming system supporting real-time sliding windows includes receiving a stream of events at a plurality of distributed nodes and routing the events into topic groupings. The process includes using one or more events in at least one of the topic groupings to determine one or more metrics of events with at least one window and an event reservoir including by: tracking, in a volatile memory of the event reservoir, beginning and ending events within the at least one window; and tracking, in a persistent storage of the event reservoir, events associated with tasks assigned to a respective node. The process includes updating the one or more metrics based on one or more previous values of the one or more metrics as a new event is added or an existing event is expired from the at least one window.

Abstract: In various embodiments, a process includes receiving input records including tabular data, where the input records are unlabeled for a concept-explainability task. The process includes obtaining primitives for at least a subset of the input records, where the obtained primitives are based at least on at least one annotation including a plurality of user-defined concept labels. The process includes training, using hardware processor(s), a plurality of candidate models using the obtained primitives. For each of the plurality of user-defined concept labels, at least one corresponding model from the plurality of candidate models is used to determine a corresponding concept labeling model. The process includes using the determined corresponding concept labeling models to label the input records with which to train a concept-explainability machine learning model using the labeled input records.

Abstract: In an embodiment, a process for graph decomposition includes initializing nodes and edges of a data graph for analysis using a computer, and performing message passing between at least a portion of the nodes of the data graph to determine a corresponding measure of interest for each node of at least a portion of the data graph. The process further includes receiving an identification of one or more nodes of interest in the data graph, performing message passing between at least a portion of the nodes of the data graph using at least the determined measures of interest to identify a corresponding subgraph of interest for each of the one or more nodes of interest in the data graph, and performing an analysis action using the one or more identified subgraphs of interest.

Abstract: In various embodiments, a process for assessing transactional graphs based on generator-discriminator networks includes using a generator network to generate a first set of transaction graph samples that are of a generated type, wherein the generator network is trained to optimize a predetermined objective function. The process includes sampling, from a collected dataset, a second set of transaction graph samples that are of a non-generated type; and providing the first set of transaction graph samples and the second set of transaction graph samples to a discriminator network, wherein the discriminator network is trained to classify a provided transaction graph sample as the generated type or the non-generated type. The process includes discriminating, by the discriminator network, each of at least a portion of the first set of transaction graph samples and the second set of transaction graph samples as the generated type or the non-generated type.

Abstract: In various embodiments, a process for obtaining a generated dataset with a predetermined bias for evaluating algorithmic fairness of a machine learning model includes receiving an input dataset and generating an anonymized reconstructed dataset based at least on the input dataset. The process includes introducing a predetermined bias into the generated dataset, forming an evaluation dataset based at least on the generated dataset with the predetermined bias, and outputting the evaluation dataset. In various embodiments, a process for training a generative model includes configuring a generative model and receiving training data, where the training data includes a tabular dataset. The process includes using computer processor(s) and the received training data to train the generative model, where the generative model is sampled to generate a dataset with a predetermined bias.

Abstract: In various embodiments, a process for constrained optimization for sequential error-based additive machine learning models (e.g., gradient boosting machines) includes configuring a sequential error-based additive machine learning model, receiving training data, and using one or more hardware processors to train the sequential error-based additive machine learning model using the received training data. The training includes performing optimization iterations to minimize a loss function that includes a fairness constraint, where the fairness constraint is based at least in part on disparities between groups.

Abstract: In various embodiments, a process for providing a surrogate hierarchical multi-task machine learning model (“model”) includes configuring the model to perform (i) a knowledge distillation task associated with a pre-trained classifier (“black-box model”) and (ii) an explanation task to predict semantic concepts for explainability associated with the distillation task. The model includes a concept layer to perform the explanation task and a decision layer to perform the distillation task. The output of the concept layer is utilized as an input to the decision layer. The process includes receiving training data including input records and concept labels, and training the model by minimizing a joint loss function that combines a loss function associated with the distillation task and one associated with the explanation task. The loss function associated with the distillation task is determined by comparing an output of the decision layer and an output of the black-box model.

Abstract: A labeling function associated with generating one or more semantic concepts is received. The received labeling function is used to automatically annotate an existing dataset with the one or more semantic concepts to generate an annotated noisy dataset. A reference dataset annotated with the one or more semantic concepts is received. A training dataset is prepared including by combining at least a portion of the reference dataset with at least a portion of the annotated noisy dataset. The training dataset is used to train a multi-task machine learning model configured to perform both a decision task to predict a decision result and an explanation task to predict a plurality of semantic concepts for explainability associated with the decision task.

Abstract: In an embodiment, a process for automatic model monitoring for data streams includes receiving an input dataset, using a machine learning model to determine a model score for each data record of at least a portion of the input dataset, and determining monitoring values. Each monitoring value is associated with a measure of similarity between model scores for those data records of the input dataset within a corresponding moving reference window and model scores for those data records of the input dataset within a corresponding moving target window. The process includes outputting the determined monitoring values.

Abstract: In an embodiment, a process for adaptive threshold estimation for streaming data includes determining initial positions for a set of percentile bins, receiving a new data item in a stream of data, and identifying one of the set of percentile bins corresponding to the new data item. The process includes incrementing a count of items in the identified percentile bin, adjusting one or more counts of data items in one or more of the percentile bins including by applying a suppression factor based on a relative ordering of items, and redistributing positions for the set of percentile bins to equalize respective count numbers of items for each percentile bin of the set of percentile bins. The process includes utilizing the redistributed positions of the set of percentile bins to determine a percentile distribution of the data stream, and calculating a threshold based at least in part on the percentiles distribution.

Abstract: In an embodiment, a process for automatic model monitoring for data streams includes receiving an input dataset, using a machine learning model to determine a model score for each data record of at least a portion of the input dataset, and determining monitoring values. Each monitoring value is associated with a measure of similarity between model scores for those data records of the input dataset within a corresponding moving reference window and model scores for those data records of the input dataset within a corresponding moving target window. The process includes outputting the determined monitoring values.

Abstract: In various embodiments, a process for automatic profile extraction in data streams using recurrent neural networks includes receiving input sequence data associated with a stream of events and using a plurality of trained recurrent neural network machine learning models at least in part in parallel to determine different embedding output sets that represent at least a portion of the input sequence data in a plurality of different embedding spaces. The process includes providing the different embedding output sets to one or more classifier machine learning models to determine one or more classifier results, and using the one or more classifier results to provide a prediction output.

Abstract: In an embodiment, a process for automated rules management system includes receiving a specification of past predicted results of evaluation rules and corresponding observed outcomes. The process includes determining one or more sets of alternative activations or priorities of at least a portion of the evaluation rules, assessing the one or more sets of alternative activations or priorities of at least a portion of the evaluation rules, and optimizing result activations or priorities of at least a portion of the evaluation rules based at least in part on the assessment of the one or more sets of alternative activations or priorities.