Abstract: In an embodiment, a process for graph search and visualization includes receiving a query graph, and calculating one or more vectors for the query graph, where the one or more vectors each identifies a corresponding portion of the query graph. The process includes identifying one or more graphs similar to the query graph including by comparing the calculated one or more vectors for the query graph with one or more previously-calculated vectors for a different set of graphs and outputting the identified one or more similar graphs. The comparison with the previously-calculated vector(s) may be based on previously-calculated vector(s) processed by grouping the one or more vectors into at least one group of vectors, identifying a representative graph for each of the at least one group of vectors; and storing the at least one group of vectors and a respective identified representative graph.

Abstract: In an embodiment, a process for graph decomposition includes initializing nodes and edges of a data graph for analysis using a computer, and performing message passing between at least a portion of the nodes of the data graph to determine a corresponding measure of interest for each node of at least a portion of the data graph. The process further includes receiving an identification of one or more nodes of interest in the data graph, performing message passing between at least a portion of the nodes of the data graph using at least the determined measures of interest to identify a corresponding subgraph of interest for each of the one or more nodes of interest in the data graph, and performing an analysis action using the one or more identified subgraphs of interest.

Abstract: In an embodiment, a process for automatic model monitoring for data streams includes receiving an input dataset, using a machine learning model to determine a model score for each data record of at least a portion of the input dataset, and determining monitoring values. Each monitoring value is associated with a measure of similarity between model scores for those data records of the input dataset within a corresponding moving reference window and model scores for those data records of the input dataset within a corresponding moving target window. The process includes outputting the determined monitoring values.

Abstract: In an embodiment, a process for explanation reporting based on differentiation between items in different data groups includes obtaining model scores from a first machine learning model and training a second machine learning model to learn how to differentiate between two groups based on at least one of: features and the model scores obtained from the first machine learning model. The process includes applying the second machine learning model to each data record in a first group of data records to determine a corresponding ranking score for each data record in the first group, and based on the corresponding ranking scores, determining a relative contribution of each of the data records in the first group to the differentiation between the first group of data records and a second group of data records.

Abstract: In an embodiment, a process for adaptive threshold estimation for streaming data includes determining initial positions for a set of percentile bins, receiving a new data item in a stream of data, and identifying one of the set of percentile bins corresponding to the new data item. The process includes incrementing a count of items in the identified percentile bin, adjusting one or more counts of data items in one or more of the percentile bins including by applying a suppression factor based on a relative ordering of items, and redistributing positions for the set of percentile bins to equalize respective count numbers of items for each percentile bin of the set of percentile bins. The process includes utilizing the redistributed positions of the set of percentile bins to determine a percentile distribution of the data stream, and calculating a threshold based at least in part on the percentiles distribution.

Abstract: Techniques described herein include determining, for each account of several accounts, an element blame score (EBS) for each potential point of compromise (POC) of a plurality of POCs. Determining the EBS includes: representing the determinations as a computer computational matrix operation, dividing a matrix of the operation into blocks, and distributing the blocks among nodes for distributed computation. The method further includes determining an overall compromise blame score (OCBS) for each potential POC based on the determined EBS and determining whether the OCBSs have converged. If the OCBSs have converged, select at least one of the potential POCs as a likely POC based at least on the corresponding OCBS of the selected likely POC. If the determined OCBSs have not converged, updating the OCBS for each potential POC and the EBSs for each potential POC.

Abstract: In an embodiment, a process for semantic-aware feature engineering includes receiving semantic labels for data fields of training data. Each of the semantic labels is associated with a semantic meaning associated with a corresponding data field. The process includes automatically generating at least one new feature using at least a portion of the semantic labels.

Abstract: Techniques described herein include determining, for each account of several accounts, an element blame score (EBS) for each potential point of compromise (POC) of a plurality of POCs. Determining the EBS includes: representing the determinations as a computer computational matrix operation, dividing a matrix of the operation into blocks, and distributing the blocks among nodes for distributed computation. The method further includes determining an overall compromise blame score (OCBS) for each potential POC based on the determined EBS and determining whether the OCBSs have converged. If the OCBSs have converged, select at least one of the potential POCs as a likely POC based at least on the corresponding OCBS of the selected likely POC. If the determined OCBSs have not converged, updating the OCBS for each potential POC and the EBSs for each potential POC.

Abstract: Techniques described herein include determining, for each account of several accounts, an element blame score (EBS) for each potential point of compromise (POC) of a plurality of POCs. Determining the EBS includes: representing the determinations as a computer computational matrix operation, dividing a matrix of the operation into blocks, and distributing the blocks among nodes for distributed computation. The method further includes determining an overall compromise blame score (OCBS) for each potential POC based on the determined EBS and determining whether the OCBSs have converged. If the OCBSs have converged, select at least one of the potential POCs as a likely POC based at least on the corresponding OCBS of the selected likely POC. If the determined OCBSs have not converged, updating the OCBS for each potential POC and the EBSs for each potential POC.

Abstract: Computer memory management during real-time fraudulent transaction analysis is disclosed. In an embodiment, a method includes receiving a transaction entry and determining whether the transaction entry is potentially fraudulent, including by determining whether the transaction entry is correlated with another transaction entry in the computer memory or an already-identified suspicious pattern of other transaction entries. The method further includes determining whether to evict the transaction entry from the computer memory based on the determination of whether the transaction entry is potentially fraudulent. The method includes providing a result of fraudulent transaction analysis performed using the computer memory that has been optimized.

Abstract: Techniques described herein include determining, for each account of several accounts, an element blame score (EBS) for each potential point of compromise (POC) of a plurality of POCs. Determining the EBS includes: representing the determinations as a computer computational matrix operation, dividing a matrix of the operation into blocks, and distributing the blocks among nodes for distributed computation. The method further includes determining an overall compromise blame score (OCBS) for each potential POC based on the determined EBS and determining whether the OCBSs have converged. If the OCBSs have converged, select at least one of the potential POCs as a likely POC based at least on the corresponding OCBS of the selected likely POC. If the determined OCBSs have not converged, updating the OCBS for each potential POC and the EBSs for each potential POC.

Abstract: A system and method that facilitates and effectuates database query optimization, comprising a progressive optimization component that receives a query and associated parametric values, and based at least in part on the received query, the progressive optimization component determines whether or not the query has been submitted in the past. Where the query has been previously submitted, the progressive optimization component locates an optimal or near-optimal execution plan based on previously persisted and similarly situated and optimized execution plans that can subsequently be used to evaluate the query and its associated parametric values thereby obviating unnecessary and repeated calls to a database optimizer for queries that are similar though not necessarily identical.