System, Method, and Computer Program Product for User Network Activity Anomaly Detection

    公开(公告)号:US20230308464A1

    公开(公告)日:2023-09-28

    申请号:US18202405

    申请日:2023-05-26

    IPC分类号: H04L9/40

    摘要: Disclosed are a system, method, and computer program product for user network activity anomaly detection. The method includes generating a multilayer graph from network resource data, and generating an adjacency matrix associated with each layer of the multilayer graph to produce a plurality of adjacency matrices. The method further includes assigning a weight to each adjacency matrix to produce a plurality of weights, and generating a merged single layer graph by merging the plurality of layers based on a weighted sum of the plurality of adjacency matrices using the plurality of weights. The method further includes generating a set of anomaly scores by generating, for each node in the merged single layer graph, an anomaly score. The method further includes determining a set of anomalous users based on the set of anomaly scores, detecting fraudulent network activity based on the set of anomalous users, and executing a fraud mitigation process.

    System, method, and computer program product for user network activity anomaly detection

    公开(公告)号:US12074893B2

    公开(公告)日:2024-08-27

    申请号:US18202405

    申请日:2023-05-26

    IPC分类号: H04L9/40

    摘要: Disclosed are a system, method, and computer program product for user network activity anomaly detection. The method includes generating a multilayer graph from network resource data, and generating an adjacency matrix associated with each layer of the multilayer graph to produce a plurality of adjacency matrices. The method further includes assigning a weight to each adjacency matrix to produce a plurality of weights, and generating a merged single layer graph by merging the plurality of layers based on a weighted sum of the plurality of adjacency matrices using the plurality of weights. The method further includes generating a set of anomaly scores by generating, for each node in the merged single layer graph, an anomaly score. The method further includes determining a set of anomalous users based on the set of anomaly scores, detecting fraudulent network activity based on the set of anomalous users, and executing a fraud mitigation process.

    TIME SERIES PREDICTIVE MODEL FOR ESTIMATING METRIC FOR A GIVEN ENTITY

    公开(公告)号:US20240127035A1

    公开(公告)日:2024-04-18

    申请号:US18275598

    申请日:2022-02-01

    IPC分类号: G06N3/0455

    CPC分类号: G06N3/0455

    摘要: A method performed by a computer is disclosed. The method comprises receiving interaction data between electronic devices of a plurality of entities. The interaction data is used to form an entity interaction vector containing a number of interactions between the electronic devices of a chosen entity and an entity time series containing a plurality of metrics per unit time of the interactions. An interaction encoder of the computer can generate an interaction hidden representation of the entity interaction vector using embeddings of the plurality of entities. A temporal encoder of the computer can generate a temporal hidden representation of the entity time series. The interaction hidden representation and the temporal hidden representation can be used to generate a predicted scale and a shape estimation of a target interaction metric. The computer can then generate an estimated interaction metric of a time period using the predicted scale and the shape estimation.

    STRUCTURED GRAPH CONVOLUTIONAL NETWORKS WITH STOCHASTIC MASKS FOR NETWORK EMBEDDINGS

    公开(公告)号:US20240046075A1

    公开(公告)日:2024-02-08

    申请号:US18264052

    申请日:2021-07-02

    IPC分类号: G06N3/0464 G06N3/047

    摘要: A method includes receiving a first data set comprising embeddings of first and second types, generating a fixed adjacency matrix from the first dataset, and applying a first stochastic binary mask to the fixed adjacency matrix to obtain a first subgraph of the fixed adjacency matrix. The method also includes processing the first subgraph through a first layer of a graph convolutional network (GCN) to obtain a first embedding matrix, and applying a second stochastic binary mask to the fixed adjacency matrix to obtain a second subgraph of the fixed adjacency matrix. The method includes processing the first embedding matrix and the second subgraph through a second layer of the GCN to obtain a second embedding matrix, and then determining a plurality of gradients of a loss function, and modifying the first stochastic binary mask and the second stochastic binary mask using at least one of the plurality of gradients.