Bayesian Network Suspicious Activity Detection With Explainable Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current rule-based and machine learning (ML) systems for detecting suspicious events in online network interactions are non-dynamic, require extensive labeled data, and lack meaningful explanations, making them resource-intensive and difficult to update.
Innovation Solution
A Bayesian network (BN) model is used to monitor suspicious events, providing probabilistic estimates and detailed explanations, allowing for continuous learning and timely updates with minimal data and computational resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If rule-based systems are used for detecting suspicious events, then the system is easy to implement and understand, but the system is non-dynamic and hard to update
Solution Approach 1:
The patent applies dynamics by transitioning from static rule-based systems to a dynamic Bayesian network model that can be continuously updated with new data. The BN structure allows parameters and probability distributions to be adjusted dynamically as new suspicious events are detected and validated, enabling the system to adapt to evolving threat patterns without requiring complete reimplementation.
Solution Approach 2:
The patent utilizes parameter changes by modifying the probability distributions and conditional probability tables within the Bayesian network based on observed data. Instead of changing the entire system structure, the approach updates specific parameters (probability values, conditional dependencies) to reflect new patterns, making the system both easy to implement initially and adaptable over time.
2Measurement precision
If machine learning models are used to provide probabilistic output, then the degree of suspicious activity can be quantified, but large amounts of labeled training data are required
Solution Approach 1:
The patent applies partial action by implementing a Bayesian network that can operate with incomplete or limited labeled data. Rather than requiring exhaustive training datasets, the BN model uses available data to establish initial probability distributions and conditional relationships, then incrementally improves accuracy as more data becomes available, avoiding the need for large-scale initial training.
Solution Approach 2:
The system incorporates feedback mechanisms where detected suspicious events and analyst validations are fed back into the Bayesian network to update probability distributions. This continuous feedback loop allows the model to improve its probabilistic outputs over time without requiring massive upfront training datasets, as each detected event contributes to refining the model's understanding.
3Reliability
If current systems generate alerts for suspicious activity, then suspicious events can be detected, but no meaningful explanation is provided about contributing factors
Solution Approach 1:
The Bayesian network acts as an intermediary between raw event data and final detection conclusions, providing a structured framework that captures contributing factors and their relationships. The BN model computes probabilities for various suspicious event types while tracking the influence of different input parameters, enabling the system to generate explanations about which factors contributed most to each detection decision.
Solution Approach 2:
The patent segments the suspicious event detection process into distinct components within the Bayesian network, where each node represents a specific suspicious event type or contributing factor. This segmentation allows the system to not only detect suspicious activity but also identify and explain the specific factors (individual nodes) that contributed to each detection, providing meaningful information about the detection rationale.
Data Source
AI summary
Method includes: configuring ML model to be associated with parameters, for monitoring suspicious event, ML model including BN including nodes, each respectively associated with parameter and including set of values corresponding to parameter; capturing data associated with interactions of customers included in segment; identifying, based on rules, events associated with focal entity corresponding to at least one customer of segment, where suspicious event is indicative that focal entity potentially violated rule; inputting event data corresponding to suspicious event to ML model; outputting by ML model output result including probability prediction of focal entity involvement in suspicious event, probability with which focal entity violated each red flag that the rule is configured to detect, and description of activity that caused violation of the red flag; detecting signal corresponding to user input; and updating ML model by updating a value of set of values associated with a parameter associated with red flag.