Abstract: Disclosed are a method and system for generating a behavior profile for a new entity. The method is performed in response to and immediately after a new entity is added to a fraud detection system. The method includes generating a doppelganger behavior profile for the new entity based on feature data of the new entity and pre-existing entities. Generating the profile includes determining a similarity score for each pre-existing entity, ranking the plurality of pre-existing entities based on the score, selecting pre-existing entities based on the ranking, and combining behavior profiles of the preexisting entities to produce the profile. The method also includes assigning the profile to the new entity and monitoring the new entity. The method further includes detecting fraud, an anomaly, and/or malicious intent based on the profile, and automatically suspending an aspect of the new entity in response to the detection.

Abstract: A method and system for generating a behavior profile for a new entity to be added to a behavior-monitored system include receiving feature data of a new entity and feature data of a plurality of pre-existing entities from at least one data source. The plurality of pre-existing entities are associated with a plurality of pre-existing behavior profiles. A doppelganger behavior profile is determined for the new entity based at least partially on the feature data of the new entity and the feature data of the plurality of pre-existing entities, and the doppelganger behavior profile is assigned to the new entity. A target action is implemented with respect to the new entity based at least partially on the doppelganger behavior profile assigned to the new entity.

Abstract: Disclosed are methods for authorizing a transaction, including receiving a policy message, the policy message including a policy ruleset for determining whether a transaction is authorized and biometric parameters for a machine learning algorithm for authenticating an identity of a user involved in a transaction, receiving biometric measurement data associated with a biometric measurement of a user involved in the transaction, calculating an authentication score based on the biometric measurement data using the machine learning algorithm, wherein the authentication score includes an indication of whether an identity of the user is authenticated based on the biometric measurement data, determining whether the transaction satisfies the policy ruleset for determining authorization of the transaction, and transmitting a decision message, wherein the decision message includes an indication of whether the transaction satisfies the policy ruleset. Systems and computer program products are also disclosed.

Abstract: Methods and systems for evaluating metrics (e.g., quality of service metrics) corresponding to a monitored computer, detecting metric anomalies, and issuing alerts, are disclosed. A metrics collecting agent, operating on a monitored computer, collects metrics corresponding to the monitored computer and/or one or more monitored services. These metrics are transmitted to a monitoring server that dynamically determines metric thresholds corresponding to normal metrics and anomalous metrics. Using these metric thresholds, along with a machine learning model, the monitoring server can determine whether one or more metrics are anomalous, automatically issue alerts to security and operations teams, and/or transmit a control instruction to the monitored computer in order to fix the issue causing the anomalous metrics.

Abstract: Methods and systems for evaluating microservice system level activities including system calls and commands, and generating security policies for microservices are disclosed. A microservice agent, operating on a microservice host, can collect system level activity data corresponding to a plurality of microservices operating on the microservice host. The microservice agent can transmit the system level activity data to a microservice evaluator that can use the system level activity data to train machine learning models to identify normal and abnormal microservice system level activities. The normal and abnormal system level activities can be used to generate security policies that can be applied to the microservices. Microservices that perform abnormal system level activities or system level activities that violate security policies can be paused or terminated.

Abstract: Methods and systems for evaluating metrics (e.g., quality of service metrics) corresponding to a monitored computer, detecting metric anomalies, and issuing alerts, are disclosed. A metrics collecting agent, operating on a monitored computer, collects metrics corresponding to the monitored computer and/or one or more monitored services. These metrics are transmitted to a monitoring server that dynamically determines metric thresholds corresponding to normal metrics and anomalous metrics. Using these metric thresholds, along with a machine learning model, the monitoring server can determine whether one or more metrics are anomalous, automatically issue alerts to security and operations teams, and/or transmit a control instruction to the monitored computer in order to fix the issue causing the anomalous metrics.

Abstract: A method and system for protecting access to remote systems, such as resource datases containing sensitive resources, such as cryptographic keys or personally identifying information, is disclosed. A server can receive a plurality of access requests from a requesting entity. The server can identify an entity profile corresponding to the access requests, as well as a machine learning model corresponding to the entity profile. The access requests can be used to form access sequences, which can be evaluated by the machine learning model. The machine learning model returns an anomaly score that can be compared to a threshold. If the anomaly score exceeds the threshold, the server can prevent further access to the remote system, for example, by revoking a credential associated with the requesting entity.

Abstract: Methods and systems for inducing model shift in a malicious computer's machine learning model is disclosed. A data processor can determine that a malicious computer uses a machine learning model with a boundary function to determine outcomes. The data processor can then generate transition data intended to shift the boundary function and then provide the transition data to the malicious computer. The data processor can repeat generating and providing the transition data, thereby causing the boundary function to shift over time.

Abstract: Methods and systems for detecting and correcting model shift in machine learning models are disclosed. A computer can receive a set of input data from a data source. The computer can apply the input data to a machine learning model to produce a first set of classification data. The computer can perform a metadata test and validate the current machine learning model and the set of input data using a plurality of previously generated machine learning models. The plurality of previously generated machine learning models can produce a plurality of sets of classification data, which can be compared to the first set of classification data. Based on the comparison, the computer can determine whether the set of input data is associated with a malicious entity.

Abstract: Methods and systems for analyzing request to access resources and determining a resource access policy are provided. The resource access system can train, store, evaluate, and deploy machine learning models that learn to output a trust score associated with a resource access request, the trust score relating to the request's legitimacy. A resource access system can receive a request for a resource from a requesting entity. The resource access system can determine an entity profile using request data in the request. The resource access system can request data from the request to determine whether the request is normal or anomalous. Using a policy engine, the resource access system can determine a resource access policy, such as allowing or denying access to the resource.

Abstract: A method and system for generating a behavior profile for a new entity to be added to a behavior-monitored system include receiving feature data of a new entity and feature data of a plurality of pre-existing entities from at least one data source. The plurality of pre-existing entities are associated with a plurality of pre-existing behavior profiles. A doppelganger behavior profile is determined for the new entity based at least partially on the feature data of the new entity and the feature data of the plurality of pre-existing entities, and the doppelganger behavior profile is assigned to the new entity. A target action is implemented with respect to the new entity based at least partially on the doppelganger behavior profile assigned to the new entity.

Abstract: Disclosed are methods for authorizing a transaction, including receiving a policy message, the policy message including a policy ruleset for determining whether a transaction is authorized and biometric parameters for a machine learning algorithm for authenticating an identity of a user involved in a transaction, receiving biometric measurement data associated with a biometric measurement of a user involved in the transaction, calculating an authentication score based on the biometric measurement data using the machine learning algorithm, wherein the authentication score includes an indication of whether an identity of the user is authenticated based on the biometric measurement data, determining whether the transaction satisfies the policy ruleset for determining authorization of the transaction, and transmitting a decision message, wherein the decision message includes an indication of whether the transaction satisfies the policy ruleset. Systems and computer program products are also disclosed.