Abstract: In another example, a device includes a processor and a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations. The operations include acquiring a plurality of data items from a plurality of data sources, wherein the at least two data sources data sources of the plurality of data sources are maintained by different entities, normalizing attributes of the plurality of data items, using a first machine learning technique, matching at least two data items of the plurality of data items to form a grouping, wherein the matching is based on similarities observed in the attributes of the at least two data items subsequent to the normalizing, and creating a single profile for an individual associated with the at least two data items, based on the grouping, wherein the single profile consolidates the attributes of the at least two data items.

Abstract: Aspects of the subject disclosure may include, for example, receiving input data via a transformation UI, generating transformation configuration data, causing the transformation UI to present transformation object data per the transformation configuration data, where the transformation object data identifies data objects each including an input and output field name and a data type, detecting, from the transformation UI, an instruction defining a mapping for the input data, including a modification to the output field name of a data object such that the input field name of the data object is mapped to the modified output field name, based on the detecting the instruction, modifying the first transformation configuration data per the mapping to derive second transformation configuration data, performing a transformation of the input data based on the second transformation configuration data, and causing the transformation UI to present a transformation output. Other embodiments are disclosed.

Abstract: Aspects of the subject disclosure may include, for example, receiving input data via a transformation UI, generating transformation configuration data, causing the transformation UI to present transformation object data per the transformation configuration data, where the transformation object data identifies data objects each including an input and output field name and a data type, detecting, from the transformation UI, an instruction defining a mapping for the input data, including a modification to the output field name of a data object such that the input field name of the data object is mapped to the modified output field name, based on the detecting the instruction, modifying the first transformation configuration data per the mapping to derive second transformation configuration data, performing a transformation of the input data based on the second transformation configuration data, and causing the transformation UI to present a transformation output. Other embodiments are disclosed.

Abstract: A processing system including at least one processor may obtain a first input data set associated with a telephone number from a first service provider that implements a multi-factor authentication process for permitting an access to a service of the first service provider and may apply at least the first input data set to a machine learning model implemented by the processing system to obtain a risk score associated with the telephone number for a subscriber identity module swap of a subscriber identity module, where the machine learning model is trained to generate the risk score associated with the telephone number in accordance with at least the first input data set. The processing system may then perform at least one remedial action associated with the telephone number and the subscriber identity module, in response to the risk score.

Abstract: Data stream based event sequence anomaly detection for mobility customer fraud analysis is presented herein. A system obtains a sequence of events comprising respective modalities of communication that correspond to a subscriber identity associated with a communication service—the sequence of events having occurred within a defined period. Based on defined classifiers representing respective fraudulent sequences of events, the system determines, via a group of machine learning models corresponding to respective machine learning processes, whether the sequence of events satisfies a defined condition with respect to likelihood of representing a fraudulent sequence of events of the respective fraudulent sequences of events. In response to the sequence of events being determined to satisfy the defined condition, the system sends, via a user interface of the system, a notification indicating that the sequence of events has been determined to represent the fraudulent sequence of events.

Abstract: A processing system may obtain a request to add at least a first feature to a feature graph database, where the request comprises a first feature ontology of the first feature, and where the first feature ontology comprises: a label of the first feature and a relationship of the first feature to a concept or to another feature. The processing system may then identify whether the first feature is a duplicate of a second feature in the feature graph database based at least upon the first feature ontology and a second feature ontology of the second feature and generate an indication of whether the first feature is a duplicate in response to the identifying.

Abstract: A processing system may apply a community detection process to a feature graph database to identify a plurality of communities of features, the feature graph database comprising: a plurality of objects, each associated with one of a feature or a concept, and a plurality of relationships between the plurality of objects. Next, the processing system may label a first plurality of features of the feature graph database with at least a first community label, where the first plurality of features comprises features of at least a first community of the plurality of communities. The processing system may then obtain a search associated with at least one feature of the feature graph database, where the at least one feature is a part of the at least the first plurality of features of the at least the first community, and provide the first plurality of features in response to the search.

Abstract: A processing system may maintain a communication graph that includes nodes representing a plurality of phone numbers including a first phone number and edges between the nodes representing a plurality of communications between the plurality of phone numbers and may generate at least one vector via a graph embedding process applied to the communication graph, the at least one vector representing features of at least a portion of the communication graph. The processing system may then apply the at least one vector to a prediction model that is implemented by the processing system and that is configured to predict whether the first phone number is associated with a type of network activity associated with a telecommunication network and may implement a remedial action in response to an output of the prediction model indicating that the first phone number is associated with the type of network activity.

Abstract: A processing system including at least one processor may obtain a request from a first entity to train a machine learning model, access at least one data feature of at least a second entity, and train the machine learning model on behalf of the first entity in accordance with the at least one data feature of the at least the second entity to generate a trained machine learning model, where the at least one data feature of the at least the second entity is a restricted data feature that is inaccessible to the first entity. The processing system may then provide the trained machine learning model to the first entity.

Abstract: A processing system may obtain a feature vector for a relationship between first and second user identities within a telecommunication network, the feature vector including: a first number of communications from the first user identity to the second user identity for a first communication channel, a first volume associated with the first number of communications, a second number of communications from the second user identity to the first user identity for the first communication channel, and a second volume associated with the second number of communications. The processing system may then calculate a scaled distance between the feature vector and a centroid comprising a mean vector of a set of relationships between user identities within the telecommunication network, where the scaled distance is associated to a trust value, and perform at least one remedial action in the telecommunication network based on the trust value.

Abstract: A method for detecting threat pathways using sequence graphs includes constructing a sequence graph from a set of data containing information about activities in a telecommunications service provider network, where the sequence graph represents a subset of the activities that occurs as a sequence, providing an embedding of the sequence graph as input to a machine learning model, wherein the machine learning model has been trained to detect when an input embedding of a sequence graph is likely to indicate a threat activity, determining, based on an output of the machine learning model, whether the subset of the activities is indicative of the threat activity, and initiating a remedial action to mitigate the threat activity.

Abstract: Mitigation of temporal generalization losses a target machine learning model is disclosed. Mitigation can be based on identifying, removing, modifying, transforming, etc., features, explanatory variables, models, etc., that can have an unstable relationship with a target outcome over time. Implementation of a more stable representation can be initiated. Temporal stability measures (TSMs) for one or more model feature(s) can be determined based on one or more variable performance metrics (VPMs). A group of one or more VPMs can be selected based on features of a model in either a development or production environment. Model feature modification can be recommended based on a TSM, which can prune a feature, transform a feature, add a feature, etc. Temporal stability information can be presented, e.g., via a dashboard-type user interface. Models can be updated based on mutations of a model comprising a feature modification(s), including competitive champion/challenger model updating.

Abstract: In another example, a device includes a processor and a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations. The operations include acquiring a plurality of data items from a plurality of data sources, wherein the at least two data sources data sources of the plurality of data sources are maintained by different entities, normalizing attributes of the plurality of data items, using a first machine learning technique, matching at least two data items of the plurality of data items to form a grouping, wherein the matching is based on similarities observed in the attributes of the at least two data items subsequent to the normalizing, and creating a single profile for an individual associated with the at least two data items, based on the grouping, wherein the single profile consolidates the attributes of the at least two data items.

Abstract: A processing system may maintain a communication graph that includes nodes representing a plurality of phone numbers including a first phone number and edges between the nodes representing a plurality of communications between the plurality of phone numbers and may generate at least one vector via a graph embedding process applied to the communication graph, the at least one vector representing features of at least a portion of the communication graph. The processing system may then apply the at least one vector to a prediction model that is implemented by the processing system and that is configured to predict whether the first phone number is associated with a type of network activity associated with a telecommunication network and may implement a remedial action in response to an output of the prediction model indicating that the first phone number is associated with the type of network activity.

Abstract: A processing system may maintain a relationship graph that includes nodes and edges representing phone numbers and device identifiers having associations with the phone numbers. The processing system may obtain an identification of a first phone number or a first device identifier for a fraud evaluation and extract features from the relationship graph associated with at least one of the first phone number or the first device identifier. The plurality of features may include one or more device identifiers associated with the first phone number, or one or more phone numbers associated with the first device identifier. The processing system may then apply the features to a prediction model that is implemented by the processing system and that is configured to output a fraud risk value of the first phone number or the first device identifier and implement at least one remedial action in response to the fraud risk value.

Abstract: A method performed by a processing system including at least one processor includes detecting that new data has been added to a repository of reusable machine learning models and machine learning model features, applying data protection to the new data, testing the new data for bias, merging at least a portion of the new data with stored data from the repository to build a new machine learning model in which the data protection is preserved, and publishing the new machine learning model in the repository.

Abstract: Aspects of the subject disclosure may include, for example, obtaining first information indicative of a first change to a first aspect of a user account; applying some or all of the first information to a first model to determine a first score associated with the first change; aggregating the first score with one or more first prior scores associated with one or more prior changes to the first aspect of the user account, resulting in a first aggregate score; obtaining second information indicative of a second change to a second aspect of the user account; applying some or all of the second information to a second model, that is different from the first model, to determine a second score associated with the second change; aggregating the second score with one or more second prior scores associated with one or more prior changes to the second aspect of the user account, resulting in a second aggregate score; and storing the first aggregate score and the second aggregate score in a database.

Abstract: Aspects of the subject disclosure may include, for example, receiving input data via a transformation UI, generating transformation configuration data, causing the transformation UI to present transformation object data per the transformation configuration data, where the transformation object data identifies data objects each including an input and output field name and a data type, detecting, from the transformation UI, an instruction defining a mapping for the input data, including a modification to the output field name of a data object such that the input field name of the data object is mapped to the modified output field name, based on the detecting the instruction, modifying the first transformation configuration data per the mapping to derive second transformation configuration data, performing a transformation of the input data based on the second transformation configuration data, and causing the transformation UI to present a transformation output. Other embodiments are disclosed.

Abstract: Determining a recommendation to convert a block of code into a serverless function based on analysis of code in execution in a cloud computing environment is disclosed. The block of code can be correlated to high levels of computing resource utilization that can inflate a cost of deploying a corresponding application in the cloud computing environment by prophylactically increasing an amount of provisioned computing resources to accommodate the high-utilization of the block of code. Converting the block of code into a serverless function can reduce the cost via offloading the functionality from the code into a function call supported by the cloud computing environment in an as-needed capacity, thereby reducing the amount of prophylactically provisioned computing resources. The recommendation can occur continuously in a production environment and cot-to-utilization information can render to facilitate identification of code block conversion targets.

Abstract: In another example, a device includes a processor and a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations. The operations include acquiring a plurality of data items from a plurality of data sources, wherein the at least two data sources data sources of the plurality of data sources are maintained by different entities, normalizing attributes of the plurality of data items, using a first machine learning technique, matching at least two data items of the plurality of data items to form a grouping, wherein the matching is based on similarities observed in the attributes of the at least two data items subsequent to the normalizing, and creating a single profile for an individual associated with the at least two data items, based on the grouping, wherein the single profile consolidates the attributes of the at least two data items.