Continuous learning neural network system using rolling windows

Abstract

A disclosed method, an analysis computer determines a rolling window associated with interaction data for interactions occurring over time. The analysis computer may retrieve interaction data for interactions occurring in the rolling window. The analysis computer may then generate pseudo interaction data based on historical interaction data. The analysis computer may optionally embed the interaction data and the pseudo interaction data for the interactions occurring within the rolling window to form an interaction data matrix. The analysis computer may then use the interaction data matrix to form a neural network model derived from the interaction data and the pseudo interaction data in the rolling window.

Description

[0001] Cross-reference to related applications

[0002] This application is a non-provisional application of U.S. Patent Application No. 62 / 734,149 filed on September 20, 2018, the entirety of which is incorporated herein by reference. Background Art

[0003] Cyberattacks are becoming more dynamic and automated. Cyberattacks can be tracked and analyzed to predict future attacks. However, new cyberattacks may occur before a complete data analysis is performed using all previous data. While automated learning can solve some problems, these models can drift over time. To combat this threat, an automated solution is needed to monitor incoming data.

[0004] Embodiments of the invention address this and other problems, individually and collectively. Summary of the invention

[0005] One embodiment relates to a method comprising: determining, by an analysis computer, a rolling window associated with interaction data for interactions that occur over time; retrieving, by the analysis computer, interaction data for interactions that occur within the rolling window; generating, by the analysis computer, pseudo-interaction data based on historical interaction data; and forming, by the analysis computer, a neural network model using the interaction data and the pseudo-interaction data for interactions that occur within the rolling window.

[0006] Another embodiment relates to an analysis computer, comprising: a processor; a computer-readable medium coupled to the processor, the computer-readable medium comprising code executable by the processor to implement a method, the method comprising: determining a rolling window associated with interaction data for interactions that occur over time; retrieving interaction data for interactions that occur within the rolling window; generating pseudo-interaction data based on historical interaction data; and forming a neural network model using the interaction data and the pseudo-interaction data for interactions that occur within the rolling window - an interaction data matrix.

[0007] More details about embodiments of the present invention can be found in the detailed description and accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 An example monitoring system according to an embodiment is shown.

[0009] Figure 2 An example block diagram of an analysis computer is shown in accordance with some embodiments.

[0010] Figure 3An example diagram illustrating a learning process according to an embodiment is shown.

[0011] Figure 4 An example flow chart of a monitoring method according to an embodiment is shown.

[0012] Figure 5 An example flow chart illustrating a dynamic embedding determination method according to some embodiments is shown.

[0013] Figure 6 An example flow chart illustrating a pseudo interaction data generation method according to some embodiments is shown. DETAILED DESCRIPTION

[0014] Before discussing the embodiments, some terms may be described in further detail.

[0015] A "machine learning model" may include the application of artificial intelligence that provides a system with the ability to automatically learn and improve from experience without being explicitly programmed. A machine learning model may include a set of software routines and parameters that can predict the output of a process (e.g., identification of a computer network attacker, authentication of a computer, appropriate recommendations based on a user search query, etc.) based on a "feature vector" or other input data. The structure of the software routine (e.g., the number of subroutines and the relationships between them) and / or the values ​​of the parameters may be determined during a training process that may use actual results of the process being modeled, such as identification of different classes of input data. Examples of machine learning models include support vector machines (SVMs), models that classify data by establishing gaps or boundaries between differently classified inputs, and neural networks, i.e., a collection of artificial "neurons" that perform functions by activating in response to inputs. In some embodiments, the neural network may include a convolutional neural network, a recursive neural network, and the like.

[0016] A "model database" may include a database that may store machine learning models. Machine learning models may be stored in the model database in various forms, such as a set of parameters or other values ​​that define the machine learning models. Models in the model database may be stored in association with keywords that convey some aspect of the model. For example, a model for evaluating a news article may be stored in the model database in association with the keywords "news," "publicity," and "information." A server computer may access the model database and retrieve models from the model database, modify models in the model database, delete models from the model database, or add new models to the model database.

[0017] A "feature vector" may include a set of measurable properties (or "features") representing an object or entity. A feature vector may include a collection of data represented digitally in the form of an array or vector structure. A feature vector may also include a collection of data that can be represented as a mathematical vector, on which vector operations such as scalar products can be performed. A feature vector may be determined or generated from input data. A feature vector may be used as an input to a machine learning model so that the machine learning model produces a certain output or classification. Based on the nature of the input data, the construction of a feature vector may be implemented in various ways. For example, for a machine learning classifier that classifies a word as a correct spelling or a misspelling, a feature vector corresponding to a word such as "LOVE" may be represented as a vector (12, 15, 22, 5), which corresponds to the alphabetical index of each letter in the input data word. For more complex "inputs", such as human entities, exemplary feature vectors may include features such as a person's age, height, weight, a numerical representation of relative happiness, and the like. Feature vectors may be represented and stored electronically in a feature storage area. In addition, feature vectors may be normalized, i.e., the feature vectors are made to have a unit magnitude. For example, the feature vector (12, 15, 22, 5) corresponding to "LOVE" may be normalized to approximately (0.40, 0.51, 0.74, 0.17).

[0018] A "rolling window" may include a time range. In some embodiments, a rolling window may include a time range during which data (e.g., interaction data) may occur. For example, a rolling window may include a range of past hours, days, weeks, months, etc. In some embodiments, a rolling window may include a start time and an end time. In other embodiments, a rolling window may include a range of a predetermined amount of data. For example, a first rolling window may include the first 500 data items, a second rolling window may include data items 501 to 1000, etc.

[0019] An "interaction" may include a mutual effect or influence. An "interaction" may include a communication, contact, or exchange between parties, devices, and / or entities. An example interaction may include a login attempt by a device to a secure webpage hosted by a server computer. Additional example interactions include a transaction between two parties and an exchange of data between two devices. In some embodiments, an interaction may include a user request to access secure data, a secure webpage, a secure location, etc. In other embodiments, an interaction may include a payment transaction in which two devices may interact to facilitate payment.

[0020] "Interaction data" may include data associated with an interaction. Interaction data may include any suitable data representing and / or associated with an interaction. In some embodiments, interaction data for interactions occurring over time may include a timestamp and an entity identifier (e.g., a user identifier, an IP address, etc.). An example of interaction data may be web page login attempt data. In some embodiments, interaction data may include HTTP header packet data. HTTP header packet data may include data fields such as authorization, browser type, connection, date, expected, forwarded, from, host, warning, etc.

[0021] "Pseudo-interaction data" may include data similar to interaction data. In some embodiments, pseudo-interaction data may include data elements similar to interaction data. For example, if interaction data includes an IP address and a date, pseudo-interaction data may also include an IP address and a date. In some embodiments, pseudo-interaction data may include historical interaction data that is determined to be similar to current interaction data. In other embodiments, pseudo-interaction data may include generated interaction data.

[0022] “Historical interaction data” may include past interaction data. For example, interaction data not included in the current rolling window (eg, whose timestamp is before the start time of the rolling window) may be historical interaction data.

[0023] A "topological graph" may include a representation of a graph in a plane of different vertices connected by edges. Different vertices in a topological graph may be referred to as "nodes". Each node may represent specific information of an event, or may represent specific information of a profile of an entity or object. Nodes may be related to each other by a set of edges E. An "edge" may be described as an unordered pair consisting of two nodes that are subsets of a graph G = (V, E), where G is a graph including a set of vertices (nodes) V connected by a set of edges E. For example, a topological graph may represent a transaction network in which a node representing a transaction may be connected by an edge to one or more nodes related to the transaction, such as nodes representing information of a device, user, transaction type, etc. An edge may be associated with a numerical value referred to as a "weight", which may be assigned to a pairwise connection between two nodes. Edge weight may be identified as the strength of the connection between two nodes and / or may be related to distance or cost, as it often represents the amount required to move from one node to the next.

[0024] A "subgraph" or "sub-graph" may include a graph formed from a subset of elements of a larger graph. Elements may include vertices and connecting edges, and a subset may be a set of nodes and edges selected from the entire set of nodes and edges for the larger graph. For example, multiple subgraphs may be formed by randomly sampling graph data, where each random sample may be a subgraph. Each subgraph may overlap with another subgraph formed from the same larger graph.

[0025] A "community" may include a set of nodes in a graph that are densely connected within the group. A community may be a subgraph or a portion / derivative thereof, and a subgraph may or may not be a community and / or include one or more communities. Communities may be identified from a graph using graph learning algorithms, such as graph learning algorithms for mapping protein complexes. Communities identified using historical data may be used to classify new data for prediction. For example, identifying communities may be used as part of a machine learning process, where predictions may be made about information elements based on their relationships to one another.

[0026] The term "node" may include a discrete data point representing specified information. Nodes may be connected to each other in a topological graph by edges, which may be assigned values ​​called edge weights in order to describe the strength of the connection between two nodes. For example, a first node may be a data point representing a first device in a network, and the first node may be connected in a graph to a second node representing a second device in the network. The strength of a connection may be defined by an edge weight, which corresponds to the degree to which information can be quickly and easily transferred between two nodes. Edge weights may also be used to express the cost or distance required to move from one state or node to the next. For example, a first node may be a data point representing a first location of a machine, and the first node may be connected in a graph to a second node for a second location of the machine. An edge weight may be the energy required to move from the first location to the second location.

[0027] A "server computer" may include a powerful computer or cluster of computers. For example, a server computer may be a mainframe, a cluster of small computers, or a group of servers operating as a unit. In one example, a server computer may be a database server coupled to a network server. A server computer may include one or more computing devices and may use any of a variety of computing structures, arrangements, and compilations to service requests from one or more client computers.

[0028] "Memory" may include any suitable device or devices that can store electronic data. Suitable memory may include a non-transitory computer-readable medium that stores instructions executable by a processor to implement the desired method. Examples of memory may include one or more memory chips, disk drives, etc. Such memory may operate using any suitable electrical, optical, and / or magnetic modes of operation.

[0029] "Processor" may refer to any suitable one or more data computing devices. A processor may include one or more microprocessors working together to perform the desired functions. A processor may include a CPU, which includes at least one high-speed data processor, suitable for executing program components for executing user and / or system generated requests. The CPU may be a microprocessor, such as AMD's Athlon, Duron and / or Opteron; IBM and / or Motorola's PowerPC; IBM and Sony's Cell processor; Intel's Celeron, Itanium, Pentium, Xeon and / or XScale; and / or similar processors.

[0030] Embodiments may allow for continuous learning and reconstruction of machine learning models. The analysis computer may determine a rolling window associated with interaction data for interactions that occur over time. After determining the rolling window, the analysis computer may retrieve interaction data for interactions that occur within the rolling window. The analysis computer may then generate pseudo interaction data based on the historical interaction data, and then embed the interaction data for interactions that occur within the rolling window and the pseudo interaction data to form an interaction data matrix. The analysis computer may then form a neural network model using the interaction data matrix.

[0031] As an illustrative example, the interaction data may include login attempts (e.g., attempts to log in to a secure web page). The analysis computer may determine a rolling window of 1 week in length and then retrieve data related to login attempts that occurred within 1 week. The analysis computer may also retrieve data related to previous login attempts that may have occurred before the rolling window (e.g., historical interaction data). The previous login attempts may have occurred in the past 2 months, 6 months, 1 year, etc. The analysis computer may, for example, generate data related to pseudo login attempts based on trends in the data related to previous login attempts. For example, the analysis computer may determine that previous login attempts indicate that fraudulent login attempts are typically performed by a specific browser type at night and originate from similar locations. Past login attempts associated with such trends may be selected to serve as pseudo login attempts. However, it should be understood that the analysis computer may determine any suitable trend in previous login attempts.

[0032] After creating the pseudo login attempt, the analysis computer can optionally embed the current login attempt and the pseudo login attempt to form an interaction data matrix, which can represent the current login attempt and the pseudo login attempt in a vector space. The analysis computer can then use the interaction data matrix to form a neural network model. For example, the analysis computer can train a neural network that can predict whether a given login attempt is a fraudulent or non-fraudulent login attempt.

[0033] Utilizing current login attempts and pseudo login attempts when training a neural network can allow for a result model that has increased predictive power. For example, pseudo login attempts can emphasize specific trends by introducing data related to those trends.

[0034] This addresses the problem when a fraudster and a security system can react to the actions of the other, which can lead to situations involving game theory (e.g., situations where there is strategic interaction between rational decision makers). For example, a fraudster may perform fraudulent login attempts from a first geographic location. Therefore, the security system can be modified so that login attempts originating from the first geographic location are more specifically scrutinized than login attempts originating from other geographic locations. The fraudster may then change their strategy and may, for example, perform IP spoofing. The fraudster may modify the IP address so that to the security system, the login attempt appears to originate from a second geographic location. Again, the security system can be modified so that login attempts originating from the second geographic location are more specifically scrutinized than login attempts originating from other geographic locations. However, if the model that implements these changes (e.g., determines to scrutinize a particular geographic location) analyzes current data, they may stop scrutinizing login attempts from the first geographic location. Therefore, it is just reacting to what the fraudster is currently doing and may not be desirable.

[0035] Another option for solving the above problem may be to use all historical data and all data within the current rolling window (e.g., current interaction data). However, training a neural network using all historical interaction data and current interaction data can take a long time because a large amount of data needs to be processed. If a neural network takes too long to train, it cannot react to, for example, cyber attacks that may occur on a smaller time scale.

[0036] I. System

[0037] Figure 1A monitoring system 100 is shown that includes an analysis computer 102, an interactive data database 104, a data receiving computer 106, a plurality of remote clients 108-112, and a requesting client 114. The analysis computer 102 may be in operational communication with the interactive data database 104 and the requesting client 114. The interactive data database 104 may be in operational communication with the data receiving computer 106. The data receiving computer 106 may be in operational communication with the plurality of remote clients 108-112.

[0038] The components of the monitoring system 100 can communicate with each other via any suitable means including a communication network. Messages and other communications can be in encrypted or unencrypted form. The communication network can be any one and / or combination of the following: direct interconnection; the Internet; a local area network (LAN); a metropolitan area network (MAN); an operating task as a node on the Internet (OMNI); a secure custom connection; a wide area network (WAN); a wireless network (e.g., using protocols such as, but not limited to, wireless application protocol (WAP), I-mode, etc.); etc. Messages between devices and computers can be transmitted using a secure communication protocol, such as, but not limited to, file transfer protocol (FTP); hypertext transfer protocol (HTTP); secure hypertext transfer protocol (HTTPS), secure socket layer (SSL), etc.

[0039] For simplicity of explanation, Figure 1 A certain number of components are shown in FIG. However, it should be understood that embodiments of the present invention may include more than one of each component.

[0040] The plurality of remote clients 108-112 may include a first remote client 108, a second remote client 110, and an Nth remote client 112. The remote client may include any suitable device (e.g., a personal computer, a server computer, a laptop, a smart phone, etc.). A remote client such as the first remote client 108 may interact with the data receiving computer 106. For example, the data receiving computer 106 may host a secure web page. The remote client may attempt to log in to the secure web page (e.g., interact with the data receiving computer 106). In some embodiments, the login attempt may be a successful login attempt, a fraudulent login attempt, a failed login attempt, etc.

[0041] The data receiving computer 106 may be configured or programmed to store the interaction data in the interaction data database 104. The data receiving computer 106 may receive data from a remote client. For example, the data receiving computer 106 may receive an HTTP header packet and / or any other suitable data associated with a login attempt. The data receiving computer 106 may store the interaction data (e.g., HTTP header packet) in the interaction data database 104. In some embodiments, the data receiving computer 106 may forward the interaction data to an intermediate computer, which may store the interaction data in the interaction data database 104.

[0042] The interaction data database 104 may include any suitable database. The database may be a conventional, fault-tolerant, relational, scalable, secure database, such as Oracle TM or Sybase TM A commercially available database, or in some embodiments a database commercially available from other open source alternatives (eg, MySQL, etc.) The interaction data database 104 may store interaction data.

[0043] The analysis computer 102 may be configured or programmed to analyze the interaction data. For example, in some embodiments, the analysis computer 102 may determine a rolling window associated with the interaction data for the interaction occurring over time. The analysis computer 102 may retrieve the interaction data occurring in the rolling window from the interaction data database 104. The analysis computer 102 may also generate pseudo interaction data based on the historical interaction data. In some embodiments, the analysis computer 102 may generate pseudo interaction data based on one or more data trends in the historical interaction data. One or more trends may be determined in any suitable matter described herein. For example, the analysis computer 102 may cluster the historical interaction data into community groups based on the similarities between the interactions represented as historical interaction data. As an illustrative example, in the case where the interaction data may include login attempts, the historical interaction data may be clustered into IP address spoofing communities (which may include login attempts performed by spoofed IP addresses), trusted communities (which may include trusted login attempts), network attack communities (which may include login attempts performed by device networks for secure web pages), etc.

[0044] The analysis computer 102 may also embed the interaction data for the interactions occurring within the rolling window and the pseudo interaction data to form an interaction data matrix. The analysis computer 102 may then use the interaction data matrix to form a neural network model.

[0045] In some embodiments, the analysis computer 102 may store the neural network model in a model database. At any suitable time thereafter, the analysis computer 102 may receive a request message including request data from the request client 114. In some embodiments, the request message may include, for example, a request for the analysis computer 102 to perform analysis on the request data including interaction data. In other embodiments, the request message may request a prediction from the analysis computer 102. The request client 114 may include any suitable computer that may be configured to request information from the analysis computer 102.

[0046] The analysis computer 102 may determine a response message to the request message. The response message may include response data output by the neural network model based on the request data. The analysis computer 102 may then provide the response message to the requesting client 114.

[0047] Figure 2 A block diagram of an exemplary analysis computer 200 is shown in accordance with some embodiments. The analysis computer 200 may include a memory 202, a processor 204, a network interface 206, and a computer-readable medium 208. The computer-readable medium 208 may include a plurality of software modules. The computer-readable medium 208 may include a pseudo-interaction data generation module 208A, an embedding module 208B, and a machine learning module 208C. However, it should be understood that the computer may include any other suitable modules (e.g., a database communication module, a rolling window determination module, etc.).

[0048] The analysis computer 200 may be in operative communication with an interaction data database 210. The interaction data database 210 may be similar to the interaction data database 104, and the details thereof need not be repeated here.

[0049] The memory 202 may be used to store data and code. The memory 202 may be coupled to the processor 204 internally or externally (e.g., a cloud-based data storage device), and may include any combination of volatile and / or non-volatile memory, such as RAM, DRAM, ROM, flash memory, or any other suitable memory device. For example, the memory 202 may store encryption keys, interaction data, weight values, etc.

[0050] The computer-readable medium 208 may include code executable by the processor 204 to perform a method comprising: determining, by an analysis computer, a rolling window associated with interaction data for interactions that occur over time; retrieving, by the analysis computer, interaction data for interactions that occur within the rolling window; generating, by the analysis computer, pseudo-interaction data based on historical interaction data; and forming, by the analysis computer, a neural network model using the interaction data and the pseudo-interaction data for interactions that occur within the rolling window.

[0051] The pseudo-interaction data generation module 208A may include code or software that can be executed by the processor 204 to generate pseudo-interaction data. The pseudo-interaction data may include data similar to the interaction data. In some embodiments, the pseudo-interaction data may include data elements similar to the interaction data. For example, if the interaction data includes an IP address, a host, a time, and has been forwarded, the pseudo-interaction data may also include an IP address, a host, a time, and has been forwarded. In other embodiments, the pseudo-interaction data may include historical interaction data that is determined to be similar to the current interaction data. In other embodiments, the pseudo-interaction data may include generated interaction data. The pseudo-interaction data generation module 208A in conjunction with the processor 204 may generate pseudo-interaction data in any suitable manner based on the historical interaction data stored in the interaction data database 210.

[0052] For example, the pseudo-interaction data generation module 208A in conjunction with the processor 204 can determine one or more data trends in the historical interaction data. One or more trends can be determined in any suitable matter described herein. For example, the analysis computer 200 can perform a learning process using the historical interaction data. The analysis computer 200 can cluster the historical interaction data into community groups, for example, based on the similarities between the interactions represented as historical interaction data. For more details on clustering data into community groups, please refer to [Fortunato, Santo. "Community detection in graphs", Physics Report 486.3-5 (2010): 75-174], which is incorporated herein by reference. The pseudo-interaction data generation module 208A in conjunction with the processor 204 can generate multiple pseudo interactions based on one or more data trends (e.g., identified in community groups) to form pseudo-interaction data.

[0053] In some embodiments, the plurality of pseudo-interactions may include historical interactions determined to be within a threshold similarity amount of current interaction data (e.g., interaction data occurring within a rolling window). In other embodiments, the plurality of pseudo-interactions may include data elements (e.g., IP address, host, forwarded, etc.) similar to historical interactions determined to be within a threshold similarity amount of current interaction data. Figure 6 Further details regarding generating pseudo interaction data according to some embodiments are discussed.

[0054] Embedding module 208B may include code or software that can be executed by processor 204 to embed interactive data and pseudo-interactive data. In some embodiments, embedding may include transforming input data into output data while maintaining the basic meaning of input data relative to other input data. Embedding module 208B may perform an embedding process (e.g., embedding) in any suitable manner in conjunction with processor 204. Embedding module 208B may map discrete and / or categorical variables to vectors or matrices of continuous numbers in conjunction with processor 204. In some embodiments, the result of the embedding process (e.g., embedded interactive data and pseudo-interactive data) may be referred to as embedding. Embedding may be a low-dimensional, learned continuous vector representation. In order to construct the representation of interactive data and pseudo-interactive data, embedding module 208B may utilize embedded neural networks and supervised tasks to learn embedding in conjunction with processor 204. In some embodiments, the individual dimensions in these result matrices (e.g., interactive data matrices) from the embedding process may not generally have inherent meaning. Instead, analysis computer 200 may utilize the overall pattern of position and distance between vectors.

[0055] For example, if there is input data (e.g., input to embedding module 208B) that includes 50,000 words used in a collection of movie reviews, embedding module 208B in conjunction with processor 204 can learn a 100-dimensional embedding for each word using an embedding neural network trained to predict the sentiment of reviews. Words in the vocabulary that are associated with positive reviews, such as "outstanding" or "excellent", may be closer in the embedding space because the neural network has learned that these words are associated with positive reviews.

[0056] The embedding determined by the embedding module 208B in conjunction with the processor 204 can be a parameter or weight of a neural network that is adjusted during training to minimize the loss of a supervised task. Although in supervised machine learning tasks, the goal is typically to train a model to make predictions about new data, the predictions may not be used further in this embedding model. The embedding module 208B in conjunction with the processor 204 can determine the embedding weights (e.g., representations of interaction data and pseudo-interaction data as continuous vectors). For more details on embedding, see [Alon, Uri et al., "code2vec: Learning distributed representations of code", ACM Conference Proceedings on Programming Languages, 3.POPL (2019): 40], where the embedding of the code snippet is determined, which is incorporated herein by reference.

[0057] The machine learning module 208C may include code or software that can be executed by the processor 204 to train a machine learning model (e.g., a neural network model). In some embodiments, the machine learning module 208C may contain code that defines the machine learning model, as well as code that can enable the processor 204 to train the machine learning model. The trained machine learning model can accept feature inputs and determine outputs (e.g., classification, prediction, etc.) for each input vector. The machine learning module 208C in conjunction with the processor 204 can use a suitable machine learning model based on an algorithm, including but not limited to: a neural network, a decision tree, a support vector method, and a K-means algorithm.

[0058] For example, the machine learning module 208C in conjunction with the processor 204 can build a mathematical model based on sample data referred to as "training data" to make predictions or decisions without being explicitly programmed to perform this task. In some embodiments, the machine learning module 208C in conjunction with the processor 204 can train a neural network. A neural network can be a model based on a collection of connected units or nodes referred to as artificial neurons. Each connection (e.g., edge) can transmit information (e.g., signal) from a node to another node. The node receiving the signal can process the signal and then send a signal to an additional node connected to the node. In some embodiments, the signal at the connection between nodes can include real numbers, and the output of each node can be calculated by a certain nonlinear function of the sum of its inputs. Nodes and edges can have weights that are adjusted as learning proceeds. Weights can increase or decrease the signal strength at the edge. In some embodiments, a node can have a threshold so that a signal is sent only when the aggregate signal exceeds the threshold. Different layers of a neural network can perform different kinds of transformations on its inputs. In addition, the signal can travel from the first layer (e.g., input layer) to the last layer (e.g., output layer) roughly after traversing the intermediate layer (e.g., hidden layer). In some embodiments, the machine learning module 208C in conjunction with the processor 204 can train a neural network, such as referring to Figure 3 described.

[0059] The network interface 206 may include an interface that may allow the analysis computer 200 to communicate with an external computer. The network interface 206 may enable the analysis computer 200 to communicate data with another device (e.g., a requesting client, etc.). Some examples of the network interface 206 may include a modem, a physical network interface (e.g., an Ethernet card or other network interface card (NIC)), a virtual network interface, a communication port, a Personal Computer Memory Card International Association (PCMCIA) slot and card, etc. The wireless protocols enabled by the network interface 206 may include Wi-Fi TMThe data transmitted via the network interface 206 may be in the form of signals, which may be electrical, electromagnetic, optical, or any other signals capable of being received by an external communication interface (collectively referred to as "electronic signals" or "electronic messages"). These electronic messages, which may include data or instructions, may be provided between the network interface 206 and other devices via a communication path or channel. As mentioned above, any suitable communication path or channel may be used, such as wire or cable, optical fiber, telephone line, cellular link, radio frequency (RF) link, WAN or LAN network, the Internet, or any other suitable medium.

[0060] II. Methods

[0061] Embodiments may use the systems and devices described herein to create at least a machine learning model based on interaction data. Figure 3-4 Some examples of such methods are described. In some embodiments, the analysis computer may include Figure 1 The analysis computer 102 or Figure 2 The analysis computer 200.

[0062] According to some embodiments, the analysis computer can continuously rebuild the deep learning model based on the dynamic embedding of interaction data, and the interaction data includes, for example, HTTP header packets. In some embodiments, the analysis computer can create an AI system that can learn in real time. Previous machine learning models (e.g., deep learners, etc.) may have problems when processing interaction data because the data may come from many different distributions and groups. Traditional neural networks that evaluate different distributions in real time will overfit the data. In some embodiments, the analysis computer can pre-set some smoothing of the information space (e.g., by embedding interaction data). The analysis computer can feed embedded data (e.g., interaction data matrix) into the learner.

[0063] A. Neural Network

[0064] The analysis computer can embed the interaction data to form an interaction data matrix as described herein. The analysis computer can then input the interaction data matrix into, for example, a neural network. Figure 3 300. The learning process according to some embodiments is shown. As shown, artificial neural network 300 includes a series of layers, each layer representing a set of nodes. For example, node 310 can be the first element of a first vector of interaction data 302 (e.g., a vector of data elements including interactions). Similarly, node 312 can be the second element of the first vector of interaction data 302, and node 314 can be the Nth element of the first vector of interaction data 302.

[0065] The first vector may include data associated with the first login attempt. For example, the first element of the first vector (e.g., at node 310) may include an IP address. The second element of the first vector (e.g., at node 312) may include a browser type. The Nth element of the first vector (e.g., at node 314) may include a host.

[0066] In some embodiments, before training the neural network, the analysis computer may embed the input interaction data. For example, edges 320, 322, and 324 may illustrate the embedding of the interaction data. The interaction data 302 as a whole may be embedded, and the resulting vector may be input into the neural network at input layer 304. The neural network may be embedded (not in Figure 3 The embedding process is specifically shown in the figure, and the embedding process is further described in detail below.

[0067] As an illustrative example, the first interaction data of interaction data 302 may include three data elements. The three data elements may be an IP address "123.01.02.3456", a browser type "browser_A1", and a host "en.example.org." Interaction data 302 may be embedded, for example, via an embedding neural network (e.g., a neural network that may embed data). The embedding neural network may map the elements of input interaction data 302 to a vector of values. As mentioned above, the embedding neural network is not embedded in the Figure 3 Specifically shown in .

[0068] For example, the data input into the embedding neural network may include [123.01.02.3456, browser_A1, en.example.org]. In some embodiments, the data elements of the input interaction data 302 may be split in any suitable manner, for example, via NGram splitting. For example, the analysis computer may determine to split the above interaction data 302 into [123_01, 01_02, 02_3456, 123, 01, 02, 3456, browser_A1, browser, A1, en, example, org, en.example.org]. This data may be input into the embedding neural network. The output vector corresponding to the input data may be determined by the embedding neural network and may include, for example, [1.2, 3.4, 1.0]. In some embodiments, the output vector [1.2, 3.4, 1.0] may be referred to as an embedding. The set of all output vectors may be referred to as an interaction data matrix, because each column or row of the matrix may include an output vector. It should be understood that even though edges 320, 322, and 324 illustrate a one-to-one connection between the nodes of the interaction data 302 and the input layer 304, in some embodiments, the embedding process may convolve the input data elements. For more details on embedding, see [Alon, Uri, et al., "code2vec: Learning distributed representations of code", ACM Conference on Programming Languages, 3.POPL (2019): 40], where embeddings for code snippets are determined, which is incorporated herein by reference.

[0069] In other embodiments, at edges 320, 322, and 324, the analysis computer may re-weight the first element, the second element, and the Nth element, respectively. The analysis computer may weight the elements of the interaction data 302 in any suitable manner known to those skilled in the art. In some embodiments, each vector of the interaction data 302 may be individually weighted and then individually input to the input layer 304, such as Figure 3 At edge 322, the analysis computer may re-weight the second element.

[0070] At one side of this series of layers there is an input layer 304. Input layer 304 includes a set of nodes (e.g., nodes 330, 332, and 334) referred to herein as input nodes. Each of these input nodes can be mapped to a specific feature of the object model or the object model itself. In some embodiments, each "feature" can actually include a combination of other features. For example, a feature can include multiple data points, labels associated with those data points (e.g., region labels), the position of the data point relative to the rest of the object model, or any other suitable feature. For example, in some embodiments, a feature can be the result of embedding interaction data, as described herein.

[0071] On the other side of this series of layers is output layer 308. Output layer 308 may include multiple output nodes. Each output node may be mapped to an object model associated with a particular class of objects. In some embodiments, each output node may be mapped to one of a plurality of regions associated with an object model provided as input. As an illustrative example, output layer 308 may include two nodes (e.g., nodes 370-372). Node 370 may correspond to an output of "fraud", while node 372 may correspond to an output of "non-fraud". However, it should be understood that output layer 308 may include any suitable number of nodes (e.g., 2, 5, 10, 100, etc.).

[0072] One or more hidden layers 306 may separate the input layer 304 and the output layer 308. The set of hidden layers 306 may include "N" hidden layers, where "N" is an integer greater than or equal to 1. Each hidden layer may also include a set of nodes referred to herein as hidden nodes.

[0073] On one side of hidden layer 306, hidden nodes (e.g., nodes 350, 352, and 354) are interconnected to input nodes. Each input node can be connected to each hidden node of the hidden layer connected to input layer 304. On the other side of hidden layer 306, hidden nodes are connected to output nodes. Each output node can be connected to each hidden node of the hidden layer connected to output layer 308. In other words, each input node is connected to each hidden node in the hidden layer closest to input layer 304, and each output node is connected to each hidden node in the hidden layer closest to output layer 308. Input nodes are not directly interconnected to output nodes. If there are multiple hidden layers, input nodes are only interconnected to the hidden nodes of the nearest hidden layer. These hidden nodes are interconnected to the hidden nodes of the next hidden layer, and so on.

[0074] An interconnection may represent a piece of information learned about the two interconnected nodes. In contrast, a connection between a hidden node and an output node may represent a piece of information learned that is specific to the output node. The interconnections may be assigned digital weights that may be tuned (e.g., based on a training data set) so that the artificial neural network 300 adapts to the input and is able to "learn."

[0075] Typically, the hidden layer 306 allows knowledge about the input nodes of the input layer 304 to be shared between the output nodes of the output layer 308. To this end, an activation function can be applied to the input nodes by the hidden layer 306. In an example, the activation function can be non-linear. Different non-linear activation functions can be used, including, for example, rectifier functions. The activation function can include any suitable activation (e.g., step function, logistic function, hyperbolic tangent function (Tanh function), rectified linear unit (ReLU), soft maximum transfer function (softmax), etc.).

[0076] The artificial neural network 300 can also use one or more cost or loss functions to find the best solution (e.g., the best activation function). The best solution can represent a situation where the cost of no solution is lower than the cost of the best solution. In an example, the cost function includes a mean square error function that minimizes the mean square error between the output and the target value within the example pair. In some embodiments, a back propagation algorithm that uses gradient descent to minimize the cost function can be used to train the artificial neural network 300. Using the back propagation algorithm, the output value is compared with the correct answer to calculate the value of a certain predefined error function. In some embodiments, the error is then fed back through the network via various techniques. Using this information, the algorithm can adjust the weight of each connection so that the value of the error function is reduced by a certain small amount. In other embodiments, the artificial neural network 300 can be an autoencoder neural network, wherein both the input and output are provided to the artificial neural network during training, and the autoencoder learns to reconstruct its input.

[0077] In the depicted artificial neural network 300, a prediction model can be generated so that the hidden layer 306 retains information (e.g., specific variable values ​​and / or transformation functions) of a set of input values ​​and output values ​​used to train the artificial neural network 300. This retained information can be applied to new interaction data to identify the possibility that the interaction data is fraudulent or non-fraudulent. In some embodiments, the artificial neural network 300 can be trained on samples with known classifications (e.g., fraudulent or non-fraudulent). For example, the artificial neural network 300 can be used to generate a prediction model using inputs including multiple known fraudulent input samples and known non-fraudulent input samples, wherein the results are optimized to minimize the distance between the results of the fraudulent samples and the fraudulent center, and to maximize the distance between the results of the non-fraudulent samples and the center. In this example, the result prediction model can be applied to the original interaction data input to generate the results of the interaction data input with respect to the results of the known samples.

[0078] By way of illustration, we can use both known fraudulent samples and non-fraudulent samples as input to train a model such as Figure 3 Depicted neural network. Each output node in this example can represent an outcome that is located within the hyperspace. When new interaction data is presented as input to the trained neural network, the neural network will output an outcome that can be evaluated based on its location within the hyperspace.

[0079] B. Monitoring Methods

[0080] Figure 4 A flow chart showing a monitoring method according to an embodiment is shown. The following will be described in the context of analyzing computer analysis interaction data. Figure 4 The method shown. The interaction data may include, for example, login attempts to secure web pages. The login attempts may be fraudulent login attempts or authentic login attempts. The analysis computer may create a deep learner (e.g., a neural network) that can predict fraudulent login attempts, such as fraudulent login attacks that may occur during a network attack. However, it should be understood that the method can be applied to other situations and use cases.

[0081] Prior to step 404, the data receiving computer may receive interaction data from, for example, a remote client. For example, the data receiving computer may host a secure web page. The remote client may attempt to access the secure web page. During the login attempt, the data receiving computer may receive any suitable data associated with the login attempt. For example, the received interaction data may include data of an HTTP header packet. The HTTP header packet may contain data such as: IP address, browser type, forwarded (e.g., original information of a client connected to a web server through an HTTP proxy), host (e.g., domain name of the server (for virtual hosting), and TCP port number where the server is listening. In some embodiments, the port number may be omitted if the port is a standard port for the requested service), warning (e.g., general warning about possible problems with the entity body), etc. The interaction data may also include a timestamp. The host header field in the request may provide host and port information from the target URL, thereby enabling the original server to distinguish resources when serving requests for multiple host names on a single IP address. A fraudulent entity (e.g., a fraudster) may attempt to fraudulently log in to a web page. At step 404, the data receiving computer may store the interaction data in an interaction data database.

[0082] At step 406, the analysis computer may determine a rolling window associated with the interaction data for interactions that occur over time. The rolling window may allow the analysis computer to retrieve a specific portion of the interaction data. The analysis computer may retrieve the interaction data for interactions that occur within the rolling window from the interaction data database. The rolling window may be for any suitable length of time, e.g., a month, a week, a day, etc. In some embodiments, the analysis computer may also filter the interaction data that has been obtained using the rolling window.

[0083] In some embodiments, at step 408, after retrieving the interaction data occurring within the rolling window, the analysis computer may determine one or more error matrices. The one or more error matrices may represent weights that may be used during the embedding process (e.g., at step 414) to embed the interaction data. The one or more error matrices may be determined, such as Figure 5Described in further detail. One or more error matrices can indicate, for example, how much error there is in a prediction created by a trained model. One or more error matrices can be used to transform input interaction data. The error matrix of a trained model that transforms the interaction data in this manner to obtain a low-error can be an optimal error matrix and can be stored. Embedding can include mapping discrete variables to vectors of continuous numbers. In the context of neural networks, embedding can include a low-dimensional, learned continuous vector representation of discrete variables. Neural network embeddings can be very useful because they can reduce the dimensionality of categorical variables and meaningfully represent categories in a transformed space. An analysis computer can determine the optimal embedding for the interaction data. For example, an analysis computer can perform a dynamic time graph embedding process.

[0084] In some embodiments, during the dynamic embedding process, the analysis computer may represent the input data (e.g., interaction data occurring within a rolling window) as a graph comprising a plurality of nodes connected via edges. In some embodiments, the interaction data may be stored as a graph. For more details on graph data and graph database models, see [Angles, Renzo, and Claudio Gutierrez, "Survey of graph database models," ACM Computing Surveys (CSUR) 40.1 (2008): 1], which is incorporated herein by reference.

[0085] In some embodiments, the analysis computer can use, for example, NGram to split one or more data elements of interactive data (e.g., IP addresses). NGram can be a continuous sequence of n items from a given text or data sample. As an illustrative example, the analysis computer can receive the original data field "123.01.02.3456", which can be an IP address. For example, the NGram of the IP address can be "123_01, 01_02, 02_3456, 123, 01, 02, 3456". Then, the analysis computer can determine the adjacency matrix and the degree matrix, as known to those skilled in the art. The adjacency matrix can be a square matrix, which can represent a finite graph. The elements of the adjacency matrix can indicate whether multiple pairs of vertices (e.g., nodes) in the graph are adjacent. The degree matrix can be a diagonal matrix, which can contain information about the number of times each vertex is used - that is, the number of edges attached to each vertex. The adjacency matrix and the degree matrix can allow the analysis computer to perform analysis on the graph data (e.g., interactive data).

[0086] In some embodiments, the analysis computer can then apply a transformation function to the edge weights based on the time and error matrix. The time matrix can include weights based on the duration of the corresponding interaction. For example, the analysis computer can provide larger weights to more recent data. In this way, the analysis can place more emphasis on more recent data in the data that occurs within the rolling window. The error matrix can be determined in any suitable manner. For example, the error matrix can be determined using a simulated annealing process that can determine the best solution.

[0087] The analysis computer can perform Figure 5 The simulated annealing process described in further detail herein. Figure 5 In an overview of the invention, the simulated annealing process may include an unsupervised deep learner (e.g., a restricted Boltzmann machine, etc.), which may be used to create community groups from input data. A restricted Boltzmann machine (RBM) may be a generative random artificial neural network that may learn a probability distribution over a set of its inputs. Community groups may be used to create new links between vertices in the original graph. For example, the analysis computer may apply a transformation to an adjacency matrix. The transformation may include applying a time matrix to an adjacency matrix. The analysis computer may then create a model, such as a gradient boosting tree, that may predict whether the interaction data is fraudulent interaction data. The analysis computer may then use a sample data set to evaluate the performance of the resulting model. The analysis computer may determine a residual error value for each input interaction data based on the performance analysis. The analysis computer may also determine a total error. In some embodiments, the total error may be determined as a mean square error (MSE). If the total error exceeds a predetermined error threshold, the analysis computer may determine a storage error matrix. Otherwise, the analysis computer may iterate the process. For example, the analysis computer may transform the interaction data using an error matrix determined from the residual error, and create a new model using the transformed interaction data. If the MSE meets a predetermined threshold, or in some embodiments, if a maximum iteration is reached, the process may end.

[0088] At step 410, in some embodiments, the best N error matrices may be selected and stored in a database. For example, the stored error matrices may meet the requirements of the dynamic embedding process described in further detail herein. The analysis computer may store error matrices that produce a neural network that includes the lowest total error. By doing so, the analysis computer may store error matrices that may be used to train a neural network when used to transform input interaction data, thereby obtaining a low error model. Later, these error matrices that are the best N error matrices may be used later during embedding of interaction data at step 414. In some embodiments, the analysis computer may also store the trained embedded neural network in association with the stored error matrices.

[0089] At step 412, the analysis computer may generate pseudo-interaction data. In addition to the current interaction data, the pseudo-interaction data may also allow the analysis computer to include additional interaction data representing trends over time. In some embodiments, the pseudo-interaction data may be generated by a pseudo-interaction data generator. In some embodiments, the analysis computer may generate pseudo-interaction data based on historical interaction data. In some embodiments, the analysis computer may determine one or more data trends in the historical interaction data, the one or more data trends including interactions occurring within and outside the scrolling window. The analysis computer may generate multiple pseudo-interactions based on the one or more data trends to form pseudo-interaction data.

[0090] In one illustration, the analysis computer can generate pseudo-interaction data by determining a community group of IP addresses for historical interaction data, wherein the community group includes IP addresses that are typically associated with fraudulent login attempts. In this example, the trend can be that these IP addresses typically perform fraudulent login attempts. The analysis computer can then generate pseudo-interaction data including the IP addresses included in the community group. In some embodiments, the interaction data for interactions that occur over time may include a timestamp and an entity identifier (e.g., an IP address that can identify an entity). The analysis computer can create pseudo-interaction data including a timestamp and an entity identifier for the pseudo-interaction, so that the pseudo-interaction data can mimic the interaction data. For example, the analysis computer can create pseudo-interaction data with a timestamp that occurs within a rolling window.

[0091] refer to Figure 6 More details about pseudo interaction data generation are discussed in detail in this paper. Figure 6An overview of the unsupervised deep learning model of the whole can be used to export data. The model can be generated with several different time windows. Data can be filtered by removing data that is stably scored within a previously predefined termination threshold (records that appear in similar cluster groups). Using the learner of the whole, cluster groups can be generated based on fraud trends from a predetermined time period (e.g., the past three weeks). Historical interaction data can be selected based on whether the historical interaction data is in the same cluster group of recent interaction data. Historical interaction data can be filtered using, for example, a weighted information vector distance score (e.g., to determine which interactions of historical interaction data are most similar to the interactions of current interaction data). The best matching historical interaction data can then be selected, and in some embodiments, the best matching historical interaction data is modified to conform to the current interaction data (e.g., editing the timestamp of the historical interaction data so that it falls within the current rolling window). The selected historical interaction data can be included as pseudo-interaction data. Then, when the model is rebuilt, the data can be added as fraudulent pseudo-interactions. For example, if a specific community of IP addresses is strongly associated with a fraud pattern type that is becoming a trend (e.g., currently occurring), the analysis computer can use those IP addresses to generate fraudulent pseudo-interaction data. Examples of fraud may be transaction fraud, login fraud, spam fraud, etc.

[0092] For example, pseudo-interaction data generated by an analysis computer may include a fraud pattern, such as "nighttime cyberattack originating from location A expressed in English," which may be associated with 8 IP addresses. The fraud pattern may be determined via a community group, which may include 8 IP addresses associated with a fraud trend and may indicate that the IP addresses share a location code, a language code, etc. 8 IP addresses may be associated with performing a cyberattack, where the fraud pattern may indicate that if one IP address initiates a login attempt, the other 7 will typically also perform a login attempt soon. This fraud trend may be used to include in current interaction data so as not to forget the 8 IP addresses that jointly performed the fraud. The pseudo-interaction data may include interaction data that includes login attempts that may have previously occurred by these 8 IP addresses. For example, the analysis computer may include the following 8 login attempts as pseudo-interaction data: 1) [Time: 23:10, Host: www.example.com, Location: A, Language: English], 2) [23:11, www.example.com, A, English], 3) [23:12, www.example.com, A, English], 4) [23:12, www.example.com, A, English], 5) [23:12, www.example.com, A, English], 6) [23:13, www.example.com, A, English], 7) [23:13, www.example.com, A, English], and 8) [23:13, www.example.com, A, English]. However, it should be understood that the pseudo-interaction data may include more or fewer data elements, as shown in this example.

[0093] At step 414, after retrieving the interaction data occurring within the rolling window and generating pseudo-interaction data, the analysis computer can embed the interaction data and pseudo-interaction data for the interaction occurring within the rolling window to form an interaction data matrix. Each column or row (depending on the embodiment) of the interaction data matrix can correspond to an interaction. In some embodiments, the analysis computer can embed the interaction data and pseudo-interaction data N times, once for each error matrix in one or more error matrices determined at step 410. For example, the analysis computer can embed the interaction data using each error matrix in one or more error matrices, and in some embodiments, one or more associated embedding neural networks can be used to embed the interaction data. For example, the analysis computer can input the interaction data into the embedding neural network to embed the data. If steps 408-410 are not performed, the analysis computer can embed the interaction data based on an error matrix that can be predetermined.

[0094] As an illustrative example, for interaction data related to a login attempt, data from an http header packet may be embedded. For example, IP address data may be embedded by splitting the octets into separate columns. Browser type data may be embedded by splitting the data components based on space. Forwarded data may be embedded by splitting the 'for' and 'to' IP addresses separated by an octet. Host data may be embedded by splitting the domain name into components and performing natural language parsing where appropriate. Warning data may be embedded by splitting by space. However, it should be understood that other embedding schemes may be determined and that they may not produce a one-to-one representation of the input data elements of the interaction data (e.g., the embedding process may or may not convolve the data elements of the input interaction data).

[0095] For example, the first IP address "123.01.02.3456" can be represented by [123_01, 01_02, 02_3456, 123, 01, 02, 3456] (e.g., via Ngram). The second IP address "123.01.02.9999" can be represented by [123_01, 01_02, 02_9999, 123, 01, 02, 9999]. For simplicity, the first IP address can be represented as [0, 1, 2, 3, 4, 5, 6], and the second IP address can be represented as [0, 1, 7, 3, 4, 5, 8]. Embedding these two IP addresses can be input as, for example, Embedding(9, 2, input_length = 7). The first independent variable (9) can be the number of different entries or possible values ​​(e.g., 0, 1, 2, 3, 4, 5, 6, 7, 8) in the training set (e.g., the first IP address and the second IP address). The second independent variable (2) can indicate the size of the embedding vector (e.g., how long the output vector will be, or the output - in this case, there will be 2 elements per output vector). The input_length independent variable can indicate the size of each input sequence (e.g., vector) (e.g., how many elements are in the input vector). Once the network has been trained, the weights of the embedding layer can be obtained, in this case, the weights have size (9, 2) (e.g., 9 elements per input vector and 2 elements per output vector) and can be shown as Table 1 below, which can be used to map inputs to embedding vectors.

[0096] IP address component index Embed 123_01 0 [1.1,3.4] 01_02 1 [1.2,2.1] 02_3456 2 [0.9,3.4] 123 3 [2.8,2.8] 01 4 [0.7,3.1] 02 5 [3.2,2.0] 3456 6 [2.5,1.2] 02_9999 7 [1.2,4.0] 9999 8 [2.6,1.5]

[0097] Table 1: Example embeddings

[0098] In this example, the only difference between the first IP address and the second IP address is the last four digits. As shown in the table above, the output of the neural network can produce similar embeddings, even though the numbers themselves are very different. These four digits can share common properties, such as they can be associated with different devices operated by the same person connected to the same subnet. For example, in the table above, the IP address components "3456" and "9999" can generate embeddings [2.5, 1.2] and [2.6, 1.5], respectively, and can indicate that they can share common properties. "3456" and "9999" can specify a mobile phone and a laptop computer associated with the same person using the same subnet, respectively, and "the same person" in this example can be a common attribute.

[0099] By using embedding as input to the learning model, similar data can be reflected in the input data provided to the learning model (420, which is described in further detail below), so that the learning model can be trained in a more accurate and efficient manner. In other words, similar data can reflect some basic meaning in the data, and the basic meaning can be given to the learning model used subsequently.

[0100] The IP address components, indexes and corresponding embeddings of Table 1 illustrate example embeddings, however, it should be understood that any suitable output embedding may be determined by the analysis computer. Furthermore, the input may include the interaction data as a whole, rather than just the IP address as in the above example.

[0101] At step 416, after embedding the data (e.g., the interaction data occurring within the rolling window and the pseudo interaction data), the analysis computer can determine the test sample and separate the test sample from the rest of the data. For example, the analysis computer can separate 10%, 20%, 30%, 40%, 50%, etc. of the interaction data matrix. The analysis computer can separate subgroups of the interaction data matrix to form the test sample. The analysis computer can separate the test sample in any suitable manner known to those skilled in the art. At step 418, the test sample can be stored in a test data database. The test sample can be separated from the training sample to later evaluate the model trained with the training sample.

[0102] At step 420, after storing the test sample, the analysis computer can then use the data to reconstruct the deep learning model. For example, the analysis computer can use the interaction data matrix to form a neural network model. The analysis computer can form the neural network model in any suitable manner. The neural network can be a convolutional neural network, a recursive neural network, etc. For example, in some embodiments, the analysis computer can build a deep learning model based on the vectors of the interaction data matrix of the interaction data (e.g., HTTP header packet data).

[0103] For example, the analysis computer can train a neural network with interaction data in the interaction data matrix that is not included in the test sample. For example, each column or row (depending on the embodiment) of the interaction data matrix can correspond to an interaction vector. Each vector can be input into the neural network for training. Based on the training, the analysis computer can determine a plurality of neural network weights that partially define the neural network model. For example, the analysis computer can train the neural network such as Figure 3 As shown. The analysis computer can then evaluate the neural network model using the test sample. At step 422, the analysis computer can store the reconstructed deep learning model (e.g., neural network model) in a candidate database.

[0104] At step 424, after storing the neural network model in the candidate database, the analysis computer may evaluate the neural network model in the candidate database using test data from the test data database. The analysis computer may evaluate the neural network model with the test data in any suitable manner. The analysis computer may input the test data into the neural network model to determine the output. For example, the analysis computer may input login attempt data. The neural network model may predict (e.g., classify) the input login attempt data as fraudulent or non-fraudulent. In some embodiments, the analysis computer may determine whether there is a bias in the distribution and / or fit of the model.

[0105] At step 426, the analysis computer may determine whether the model is acceptable based on the evaluation. For example, the analysis computer may determine whether the neural network model accurately predicts the input login attempt data as fraudulent or non-fraudulent. The analysis computer may determine whether the model is acceptable based on the model's prediction accuracy. For example, if the model accurately predicts 70%, 80%, 90%, 95%, 99%, etc. of the input login attempt data, the analysis computer may determine that the model is acceptable.

[0106] If the analysis computer determines that the model is unacceptable, the analysis computer may discard the unacceptable model and end the process. In some embodiments, if other models are stored in the candidate database, the analysis computer may repeat steps 424-426 for each other model stored in the candidate database. If the analysis computer determines that the model is acceptable, the analysis computer may proceed to step 428. At step 428, the analysis computer may store the neural network model in the current model database.

[0107] At any suitable time, at step 430, the analysis computer may receive a request message including the requested data. The analysis computer may receive the requested data from any suitable external computer (e.g., Figure 1The requesting client 114 receives the request message. In some embodiments, the request data may include new interaction data (e.g., a login attempt including a timestamp, an IP address, a host, etc.).

[0108] At step 432, after receiving the request message, the analysis computer may determine a response message to the request message. The response message may include response data output by the neural network model based on the request data. For example, the analysis computer may determine whether the new interaction data indicates a fraudulent login attempt. As another example, in some embodiments, the analysis computer may determine a prediction of whether one or more entities associated with one or more IP addresses will attempt a fraudulent login attempt.

[0109] At step 434, the analysis computer may transmit the response message to the requesting client. Upon receiving the response message, the requesting client may then be quickly able to react to the fraudulent login attempt (if determined to be fraudulent by the analysis computer). By being able to more accurately predict fraudulent login attempts, network attacks may be more effectively and quickly identified, thereby allowing for faster and more definitive adoption of attack mitigation strategies to combat network attacks.

[0110] C. Dynamic Embedding

[0111] Figure 5 A dynamic embedding determination method according to some embodiments is shown. In some embodiments, Figure 5 The described method can be performed by an analysis computer, as described herein. Figure 4 The dynamic embedding determination method is performed at step 408. During the dynamic embedding process, the analysis computer can determine the optimal embedding for the interaction data. For example, during steps 502-518, the analysis computer can transform the interaction data to train and test the model before inputting it into the model. The transformation can be applied via, for example, an error matrix. The analysis computer can later redetermine the error matrix based on an evaluation of the performance of the model. In some embodiments, if the performance is poor (e.g., the total error is high), the analysis computer can apply the error matrix of the model to the interaction data and then train and evaluate the next model. The analysis computer can repeat this process until the total error of the model's prediction exceeds a predetermined threshold. In this case, the error matrix of the model can be stored and later used in Figure 4 The input data is embedded in step 414 of , because the error matrix is ​​the best error matrix that can be applied to the input data so that the overall error of the resulting model is low.

[0112] At step 502, the analysis computer may retrieve interaction data from an interaction data database (e.g., Figure 4An initial error matrix is ​​created at step 406 of . For example, the interaction data may be in the form of a graph including a plurality of nodes connected via edges. The analysis computer may generate an initial error matrix, which may include data elements having predetermined values ​​(e.g., 1). The size of the initial error matrix may be similar to the size of the interaction data (e.g., the size of the adjacency matrix and / or the number matrix). In some embodiments, the analysis computer may weight the data elements in the error matrix based on the timestamp associated with the corresponding interaction of the data element. The data elements in the error matrix may be weighted by, for example, a linear degradation function based on the time of the corresponding interaction. In this manner, the analysis computer may weight the initial error matrix based on how long the interaction of the interaction data has occurred.

[0113] As an illustrative example, the analysis computer may first embed the data using an error matrix that may describe the current embedding strategy. Initially, the analysis computer may not know the optimal error embedding strategy represented by the optimal error matrix. Thus, the analysis computer may determine to create an initial error matrix in which each element may be equal to a value of 1.

[0114] At step 504, after creating the initial error matrix, the analysis computer may split a portion of the interaction data into a test sample. For example, the analysis computer may split the interaction data into a first portion and a second portion. The first portion may be a test sample. The second portion may be a training sample. In some embodiments, the second portion may include more interaction data than the first portion. However, it should be understood that any suitable percentage of interaction data may be included in the first portion. At step 506, the analysis computer may store the test sample in a test sample database.

[0115] At step 508, after storing the test sample, the analysis computer may train one or more models with the interaction data. Specifically, the analysis computer may train one or more models with the second portion of the interaction data (e.g., the training sample). The one or more models may include any suitable model, for example, in some embodiments, the one or more models may include a decision tree. As known to those skilled in the art, the analysis computer may create a decision tree in part by performing gradient tree boosting using the training sample and predefined target features. The predefined target features may include any suitable target for a decision tree (e.g., determining whether the input interaction data is fraudulent or non-fraudulent).

[0116] At step 510, after training one or more models, the analysis computer can evaluate the one or more models with test samples retrieved from the test sample database. For example, the analysis computer can input the interaction data of the test sample into the model. The model, such as a decision tree, can determine whether the input interaction data can be classified as "fraud" or "non-fraud" or other suitable predefined target features.

[0117] At step 512, after evaluating one or more models with the test sample, the analysis computer can update the error matrix and determine the total error. The total error can be determined in any suitable manner. For example, in some embodiments, the total error can be a mean square error (MSE). The error matrix can be updated based on the residuals from the evaluation of each input interaction data. For example, the residuals in a statistical or machine learning model can include the difference between the observed values ​​of the data (e.g., observed fraudulent or non-fraudulent login attempts) and the predicted values ​​of the data (e.g., the prediction of fraudulent or non-fraudulent login attempts). The residuals can be a diagnostic metric used when evaluating the quality of the model. In some embodiments, the residuals can be referred to as errors. In some embodiments, the analysis computer can examine the residuals based on the magnitude of the residuals and / or whether the residuals form a pattern.

[0118] For example, for the case where the residuals are all zero, the model predicts perfectly. The further the residuals are from zero, the less accurate the model is. In the case of linear regression, the larger the sum of squared residuals, the smaller the R-squared statistic, all else being equal. In the case where the mean residual is not zero, it suggests that the model may be systematically biased (i.e., it consistently over-predicts or under-predicts). For the case where the residuals contain a pattern, the model may be qualitatively wrong because it cannot explain some property of the interaction data.

[0119] Elements of the error matrix may be updated based on residuals associated with corresponding interaction data. For example, a neural network may incorrectly predict a fraudulent login attempt when a trusted login attempt is provided. Elements of the error matrix associated with a trusted login attempt may be updated based on residuals from incorrect predictions of the trusted login attempt.

[0120] At step 514, after updating the error matrix and the total error, the analysis computer may determine whether the total error exceeds a predetermined threshold. The total error may exceed the threshold (e.g., depending on a measure of the threshold, greater than or equal to the threshold, or less than or equal to the threshold). If the analysis computer determines that the total error is not exceeded (e.g., the evaluation criteria are met), the analysis computer may proceed to step 516, during which the analysis computer may transform the interaction data based on the evaluation. If the analysis computer determines that the total error exceeds the predetermined threshold, the analysis computer may proceed to step 518.

[0121] At step 516, after determining that the total error of the model does not exceed the predetermined threshold, the analysis computer can transform the interaction data using the error matrix. In this way, the input interaction data can be modified using the residuals determined from the previous model. The analysis computer can then repeat steps 508-512 with the transformed interaction data. The analysis computer can perform steps 508-516 any suitable number of times until the total error of the model exceeds the predetermined threshold at step 514, or until a maximum number of iterations has been performed. By transforming the input interaction data, the analysis computer can determine which error matrix most accurately embeds the input interaction data.

[0122] At step 518, the analysis computer may store the error matrix corresponding to the model for which the total error exceeds the predetermined threshold at step 514. In some embodiments, the analysis computer may store one or more error matrices corresponding to one or more models for which the total error exceeds the predetermined threshold. In some embodiments, the analysis computer may also store the embedded neural network associated with the error matrix.

[0123] After storing one or more error matrices (which may be optimal error matrices), the analysis computer may embed interaction data (e.g., interaction data that occurred within a rolling window) and pseudo interaction data including current interaction data using at least one error matrix at step 414. For example, the error matrix may represent the best way to transform input data (e.g., interaction data) so that the resulting model predicts the target variable (e.g., fraud) more accurately than other models trained from untransformed data.

[0124] D. Pseudo-interaction data generator

[0125] Figure 6 A pseudo interaction data generation method according to some embodiments is shown. In some embodiments, Figure 6 The described method can be performed by an analysis computer as described herein. For example, in some embodiments, the analysis computer can determine one or more data trends in the historical interaction data, the one or more data trends including interactions occurring within and outside the rolling window. The analysis computer can then generate multiple pseudo-interactions based on the one or more data trends to form pseudo-interaction data. In some embodiments, determining one or more trends can also include clustering at least the historical interaction data into one or more community groups. Each of the one or more community groups can include data representing interactions having similar characteristics.

[0126] At step 602, the analysis computer may retrieve interaction data from an interaction data database. The analysis computer may retrieve historical interaction data that may be associated with the interaction data that may have been generated within a determined rolling window (e.g., within a Figure 4In some embodiments, the analysis computer may retrieve all historical interaction data. In other embodiments, the analysis computer may retrieve historical interaction data that occurred within multiple historical rolling windows. Each historical rolling window may have the same size as the rolling window of step 406 (e.g., 2 days, 1 week, etc.). For example, the analysis computer may sample historical interaction data from 10 historical rolling windows. Multiple historical rolling windows may allow the analysis computer to sample historical interaction data, and therefore do not use all stored data to perform data processing, which may be computationally expensive to perform data processing using all stored data. In other embodiments, the analysis computer may apply weights to the historical interaction data of each historical rolling window. For example, the analysis computer may weight more recent data to a greater extent. The analysis computer may weight the historical interaction data of the historical rolling window to emphasize older or new trends in the historical interaction data. In some embodiments, if more than one previous model was created in a previous iteration, the analysis computer may run more than one previous model.

[0127] At step 604, after retrieving the historical interaction data, the analysis computer may execute a previously created model with the historical interaction data as input. In some embodiments, the previously created model may include a deep learner that can cluster the data into community groups. For example, the analysis computer may execute a clustering model that can cluster the inputted historical interaction data. The analysis computer may cluster similar data points in characteristics together. For example, a first interaction may be associated with interaction data including an IP address "1234", a date "01 / 01 / 2019", a time "23:50", a browser "browser_A", and a host "www.example.org". A second interaction may be associated with interaction data including an IP address "2345", a date "01 / 02 / 2019", a time "23:55", a browser "browser_A", and a host "www.example.org". Interaction data for the first interaction and a second interaction data may be clustered based on similar characteristics, for example, due to attempted fraud occurring late at night for the same host and using a similar browser. However, it should be understood that the interaction data may be clustered based on any similarity.

[0128] At step 606, the analysis computer may evaluate the performance of the previous model. The analysis computer may use any suitable metric to evaluate the performance of the previous model. For example, the analysis computer may determine classification accuracy, log loss, confusion matrix, area under the curve (AUC), F1 score, mean absolute error, mean square error, etc. In some embodiments, the analysis computer may use vector distance scores to determine which data (e.g., historical interaction data) and previous models are most stable when executed with historical interaction data. The analysis computer may determine a stability score for each previous model.

[0129] At step 608, after evaluating the performance of the previous model, the analysis computer may weight the historical interaction data based on the performance of the previous model. The analysis computer may weight the historical interaction data in any suitable manner. For example, in some embodiments, the analysis computer may weight the historical interaction data based on the inverse of the stability score.

[0130] For example, if the model is performing well (e.g., accurately predicting a target variable such as fraud), the analysis computer may weight the historical interaction data a smaller amount than if the model is performing poorly (e.g., not accurately predicting a target variable such as fraud). The historical interaction data may be weighted based on the performance of the model because if the data has substantially changed since a previous model was created, the model will perform poorly and the data may be weighted based on the change.

[0131] In some embodiments, after weighting the historical interaction data, if additional historical interaction data is needed, the analysis computer may retrieve additional random samples of the historical interaction data, e.g., as test samples for evaluating (e.g., at step 612) the new model trained at step 610. In other embodiments, the test sample may be a subset of the re-weighted historical interaction data. The test sample may not be used to train the model, but may be used later to evaluate how well the model has been trained.

[0132] At step 610, after weighting the historical interaction data, the analysis computer can create N new models. The N new models can include machine learning models (e.g., neural networks) trained on the weighted historical interaction data. The analysis computer can train the N new models in any suitable manner described herein.

[0133] At step 612, after training the N new models, the analysis computer can evaluate the performance of the N new models. The analysis computer can evaluate the performance of the N new models in any suitable manner described herein. For example, the analysis computer can determine vector distance scores using the test sample to determine which models are most stable for the test sample. In some embodiments, the analysis computer can determine how well the new models perform in the same or similar manner as the evaluation at step 606. For example, the analysis computer can determine how well the new models predict a target variable, such as fraud. A model that frequently receives credible login attempt data but then predicts the data as fraudulent may have poor performance.

[0134] At step 614, the analysis computer may store the new model based on the new model performance determined at step 612. For example, in some embodiments, the analysis computer may rank the new models by stability score and select the top Y models based on predefined values ​​of Y (e.g., 1, 2, 3, 10, etc.). The analysis computer may then store the highest ranked new models in the model database. The new model may be treated as a previous model in future iterations of steps 602-614. The analysis computer may store the best performing new model.

[0135] At step 616, the analysis computer may execute the new model with a data set as input, the data set including historical interaction data and interaction data that occurred within a rolling window (e.g., as retrieved at step 406). The analysis computer may execute the new model in any suitable manner described herein. For example, in order to determine pseudo-interaction data, the analysis computer may execute the model in the model database with the retrieved historical interaction data and the interaction data that occurred within the rolling window. The analysis computer may determine which historical interaction data are similar to the current interaction data based on a criterion (e.g., being part of a trend identified by a determined community group). The historical interaction data that is most similar, for example in terms of a shared community group, may be included as pseudo-interaction data to be used for training a machine learning model (e.g., at step 420). Steps 618-624 describe the determination and selection of historical interaction data that may be included in the pseudo-interaction data.

[0136] At step 618, after executing the new model with the historical interaction data and the interaction data that occurred within the rolling window, the analysis computer can match the interaction data that occurred within the rolling window with the historical interaction data. For example, the new model can cluster the data into community groups based on similarities between data points. The analysis computer can determine whether any interaction data that occurred within the rolling window matches any historical interaction data (e.g., within a threshold similarity amount). For example, the analysis computer can use a vector distance score (or any other suitable similarity metric) to determine the differences between data community groups.

[0137] At step 620, the analysis computer may determine a similarity score for each interaction data within the matched community groups. For example, at step 618, the fraudulent historical interaction community group and the fraudulent current community group may be matched. Then, at step 620, the analysis computer may determine a similarity score between each historical interaction data of the fraudulent historical interaction community group and each interaction data of the fraudulent current community group that occurred within a rolling window. The similarity score may be any suitable similarity score as described herein. In some embodiments, the similarity score may be a vector distance score, which may be, for example, a distance in a vector space between a fraudulent login attempt of the historical interaction data and a fraudulent login attempt of the current interaction data.

[0138] At steps 622 and 624, after determining the similarity score, the analysis computer can sort the interaction data based on the similarity score and include the top X matching historical interaction data into the pseudo interaction data. The top X matching historical interaction data may include the historical interaction data with the highest ranking (e.g., the highest similarity score). In other words, the analysis computer may include the historical interaction data that most closely matches the trend in the current interaction data to the pseudo interaction data. In some embodiments, the pseudo interaction data may include interactions where fraud may have occurred (e.g., fraudulent login attempts). Including these pseudo interactions in the interaction data used to train the machine learning model (e.g., at step 420) may introduce additional data to include trends that occur over time in the historical interaction data and continue into the current interaction data. In this way, when determining a prediction or other suitable machine learning model output, the resulting training model may not forget these overall trends in the historical interaction data.

[0139] III. Experimental Improvements

[0140] As described herein, embodiments are evaluated for models that do not include the use of pseudo-interaction data. The dataset used as interaction data includes the KDD network intrusion dataset from the Third International Knowledge Discovery and Data Mining Tools Competition co-hosted with the KDD-99 The Fifth International Conference on Knowledge Discovery and Data Mining.

[0141] A. Data

[0142] The KDD network intrusion data set is used to test the system and method according to the embodiment. This is the data set used by the 3rd International Knowledge Discovery and Data Mining Tools Competition co-organized with the 5th International Conference on Knowledge Discovery and Data Mining, KDD-99. The data set includes "bad" connections, which are called intrusions or attacks, and "good" normal connections (e.g., non-fraudulent connections). This database contains a standard data set to be audited, which includes various intrusions simulated in a military network environment. For the data set, please refer to http: / / kdd.ics.uci.edu / databases / kddcup99 / kddcup99.html.

[0143] B. Methods

[0144] First, the analysis computer extracted 30% of the "bad" data samples and 10% of the "good" data samples. Then, the analysis computer ran the entire graph learner to create community groups based on the "bad" data. According to the graph model, "bad" patterns were recommended using vector distance scores to find "bad" patterns similar to those found in the 30% samples to generate pseudo-interaction data. Next, two models were generated, one model used 30% of the "bad" data and 10% of the good data, and the second model mixed the simulated "bad" attack with the 30% of the "bad" data. Both models used gradient boosting trees. For performance testing, the analysis computer used a new 10% of the "good" and "bad" samples.

[0145] C. Results

[0146] Table 2 below illustrates the precision and recall of models implemented with datasets that do not include pseudo interaction data and datasets that do include pseudo interaction data. Precision can be determined as:

[0147] Precision = True Positives / (True Positives + False Positives)

[0148] Recall can be determined as:

[0149] Recall = True negatives / (True negatives + False negatives)

[0150] Accuracy Recall Dataset without pseudo-interaction data .63 .47 Dataset with pseudo interaction data .72 .69

[0151] Table 2: Experimental results

[0152] Embodiments of the present disclosure have many advantages. Table 2 illustrates the improvement in both precision and recall when utilizing pseudo-interaction data as described herein compared to when pseudo-interaction data is not used. Thus, embodiments of the present disclosure allow an analysis computer to utilize pseudo-interaction data to more accurately predict whether interaction data (e.g., login attempt data) is fraudulent. By being able to more accurately predict fraudulent login attempts, network attacks can be more effectively and quickly identified. Thus allowing attack mitigation strategies to be adopted more quickly and more clearly to combat network attacks.

[0153] Embodiments of the present disclosure have advantages over the case where all data is used to train the model. For example, while another option might be to use all historical data and all data within the current rolling window (e.g., current interaction data), training a neural network using all historical interaction data and current interaction data can take a long time because a large amount of data needs to be processed. If a neural network takes too long to train, it cannot react to, for example, a cyber attack that may occur on a smaller time scale.

[0154] In addition, embodiments of the present disclosure have advantages over the case where only current data from the current rolling window is used to train the model. For example, a fraudster and a security system may react to the actions of the other party, and this reaction may lead to a situation involving game theory (e.g., a situation where there is a strategic interaction between rational decision makers). A fraudster may perform a fraudulent login attempt from a first geographic location. Therefore, the security system can be modified so that login attempts originating from the first geographic location are more specifically scrutinized than login attempts originating from other geographic locations. The fraudster may then change their strategy and may, for example, perform IP spoofing. The fraudster may modify the IP address so that the login attempt appears to the security system to be from a second geographic location. Again, the security system can be modified so that login attempts originating from the second geographic location are more specifically scrutinized than login attempts originating from other geographic locations. However, if the model that implements these changes (e.g., determines to scrutinize a specific geographic location) analyzes the current data, they may stop scrutinizing login attempts from the first geographic location. Therefore, it is only reacting to what the fraudster is currently doing.

[0155] Although the steps in the above flow chart and process flow are shown or described in a particular order, it should be understood that embodiments of the present invention may include methods with steps in different orders. In addition, steps may be omitted or added, and they may still be in embodiments of the present invention.

[0156] Any software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as Java, C, C++, C#, Objective-C, Swift, or a scripting language such as Perl or Python, using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer-readable medium for storage and / or transmission, suitable media including random access memory (RAM), read-only memory (ROM), magnetic media such as a hard drive or floppy disk, or optical media such as a compact disk (CD) or a digital versatile disk (DVD), flash memory, etc. The computer-readable medium may be any combination of such storage or transmission devices.

[0157] Such programs can also be encoded and transmitted using carrier signals adapted to be transmitted via wired, optical and / or wireless networks that meet multiple protocols including the Internet. Therefore, the computer-readable medium according to an embodiment of the present invention can be created using data signals encoded with such programs. The computer-readable medium encoded with program code can be encapsulated with compatible devices or provided separately with other devices (e.g., downloaded via the Internet). Any such computer-readable medium can reside on or in a single computer product (e.g., hard drive, CD or entire computer system), and can be present on or in different computer products in a system or network. The computer system can include a monitor, printer or other suitable display for providing any result mentioned herein to the user.

[0158] The above description is illustrative rather than restrictive. After those skilled in the art have read this disclosure, many variations of the present invention will become apparent. Therefore, the scope of the present invention should not be determined with reference to the above description, but should be determined with reference to the pending claims and their full scope or equivalent.

[0159] One or more features of any embodiment may be combined with one or more features of any other embodiment without departing from the scope of the present invention.

[0160] As used herein, the use of "a," "an," or "the" is intended to mean "at least one" unless clearly indicated to the contrary.

Claims

1. A method for a neural network system, the method comprising: determining, by the analysis computer, a rolling window associated with the interaction data for interactions occurring over time; retrieving, by the analysis computer, interaction data for interactions occurring within the scrolling window; generating pseudo interaction data based on historical interaction data by the analysis computer; embedding the interaction data and the pseudo-interaction data for the interactions occurring within the rolling window to form an interaction data matrix; as well as forming, by the analysis computer, a neural network model using the interaction data matrix, The forming of the neural network model further comprises: splitting a portion of the interaction data matrix to form a test sample; training a neural network using the interaction data matrix not included in the test sample; Based on the training, determining a plurality of neural network weights that partially define the neural network model; Evaluating the neural network model using the test sample; and Based on the evaluation, the neural network model is stored in a model database. 2 . The method of claim 1 , wherein the rolling window comprises a time range during which the interaction data occurs.

3. The method according to claim 1, wherein generating the pseudo interaction data further comprises: determining, by the analysis computer, one or more data trends in the historical interaction data, the one or more data trends including interactions occurring within and outside of the rolling window; as well as A plurality of pseudo interactions are generated by the analysis computer based on the one or more data trends to form the pseudo interaction data.

4. The method of claim 3, wherein determining the one or more data trends further comprises: At least the historical interaction data is clustered, by the analysis computer, into one or more community groups, wherein each of the one or more community groups includes data representing interactions having similar characteristics.

5. The method according to claim 1, further comprising: The test sample is stored in a database by the analysis computer.

6. The method according to claim 1, wherein the neural network is a convolutional neural network or a recurrent neural network.

7. The method according to claim 1, further comprising: determining one or more error matrices; as well as The interaction data and the pseudo-interaction data for the interactions occurring within the rolling window are embedded with a machine learning model and the one or more error matrices to form the interaction data matrix.

8. The method of claim 7, wherein determining the one or more error matrices further comprises: training a model by the analysis computer using a first portion of the interaction data for the interactions occurring within the rolling window; evaluating, by the analysis computer, the model using a second portion of the interaction data for the interactions that occurred within the rolling window; determining, by the analysis computer, an error matrix and a total error based on the evaluation; determining, by the analysis computer, whether the total error exceeds a predetermined error threshold; as well as If the total error exceeds the predetermined error threshold, the error matrix is ​​stored in a database by the analysis computer.

9. The method according to claim 1, further comprising: receiving, by the analysis computer, a request message including request data; as well as A response message to the request message is determined by the analysis computer, the response message including response data output by the neural network model based on the request data.

10. An analysis computer comprising: processor; A computer readable medium coupled to the processor, the computer readable medium comprising code executable by the processor to implement a method comprising: determining a rolling window associated with interaction data for interactions occurring over time; retrieving interaction data for interactions occurring in the scrolling window; Generate pseudo interaction data based on historical interaction data; embedding the interaction data and the pseudo-interaction data for the interactions occurring within the rolling window to form an interaction data matrix; and Using the interaction data matrix to form a neural network model, The forming of the neural network model further comprises: splitting a portion of the interaction data matrix to form a test sample; training a neural network using the interaction data matrix not included in the test sample; Based on the training, determining a plurality of neural network weights that partially define the neural network model; Evaluating the neural network model using the test sample; and Based on the evaluation, the neural network model is stored in a model database.

11. The analysis computer according to claim 10, further comprising: a pseudo interaction data generating module coupled to the processor; an embedded module coupled to the processor; as well as A machine learning module is coupled to the processor.

12. The analysis computer of claim 10, wherein generating the pseudo interaction data further comprises: determining one or more data trends in the historical interaction data, the one or more data trends including interactions occurring within and outside of the rolling window; as well as A plurality of pseudo interactions are generated based on the one or more data trends to form the pseudo interaction data.

13. The analysis computer of claim 10, wherein the interaction data for interactions occurring over time comprises a timestamp and an entity identifier, and wherein the pseudo-interaction data for pseudo-interactions comprises a timestamp and an entity identifier.

14. The analysis computer of claim 10, wherein the interaction is a login attempt and includes a timestamp, an IP address, and a browser type, wherein a login attempt occurs when an entity attempts to log into a secure web page.

15. The analysis computer according to claim 14, wherein generating the pseudo interaction data based on historical interaction data further comprises: determining a community group of similar login attempts of the historical interaction data, wherein the community group includes an IP address associated with the fraudulent login attempt; as well as The pseudo interaction data including at least the IP addresses included in the community group is generated.

16. The analysis computer of claim 10, wherein the method further comprises: A prediction of whether one or more entities associated with the one or more IP addresses will attempt a fraudulent login attempt is determined using the neural network model.

17. The analysis computer of claim 10, wherein the method further comprises: receiving a request message including request data from a requesting client, wherein the request data includes new interaction data; Determining, by the analysis computer, a response message to the request message, the response message comprising response data output by the neural network model based on the new interaction data; as well as The response message is provided to the requesting client.

18. The analysis computer of claim 10, wherein the method further comprises: determining one or more error matrices; as well as The interaction data and the pseudo-interaction data for the interactions occurring within the rolling window are embedded with a machine learning model and the one or more error matrices to form the interaction data matrix.

19. The analysis computer of claim 18, wherein determining the one or more error matrices further comprises: training a model using a first portion of the interaction data for the interactions occurring within the rolling window; evaluating the model using a second portion of the interaction data for the interactions that occurred within the rolling window; determining an error matrix and a total error based on the evaluating; determining whether the total error exceeds a predetermined error threshold; as well as If the total error exceeds the predetermined error threshold, the error matrix is ​​stored in a database.

Images