Abstract: Computerized methods and systems obtain threat data generated from activity data using unsupervised learning. The activity data is collected from enterprises and describes activities performed on the enterprises. The threat data indicates likelihood that sequences of activities performed on the enterprises are indicative of malicious intent. A supervised ML model that processes sequential data is trained by providing a training set of sequential data to the supervised ML model. The training set includes at least some of the obtained threat data, and data derived from activity data collected from at least some of the enterprises. The trained supervised ML receives new data that describes a sequence of activities performed on an enterprise, and processes the received new data to produce a prediction of whether the sequence of activities performed on the enterprise will lead to a malicious action on the enterprise. In some embodiments, multiple supervised ML models are used.

Abstract: Computerized methods and systems obtain threat data generated from activity data using unsupervised learning. The activity data is collected from enterprises and describes activities performed on the enterprises. The threat data indicates likelihood that sequences of activities performed on the enterprises are indicative of malicious intent. A supervised ML model that processes sequential data is trained by providing a training set of sequential data to the supervised ML model. The training set includes at least some of the obtained threat data, and data derived from activity data collected from at least some of the enterprises. The trained supervised ML receives new data that describes a sequence of activities performed on an enterprise, and processes the received new data to produce a prediction of whether the sequence of activities performed on the enterprise will lead to a malicious action on the enterprise. In some embodiments, multiple supervised ML models are used.