Gradient-Boosted Decision Trees for Real-Time Cyber Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing artificial intelligence models face challenges in detecting fraudulent and unauthorized communications in data sparse environments due to the sparse availability of high-quality training data, the need for real-time decision-making without latency, and the requirement for highly accurate and precise results.

Innovation Solution

A novel artificial intelligence architecture using a gradient boosted decision tree trained in data sparse environments, with a data transformation step to minimize latency and generate a dual variable output, including a confidence score for communication classification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If traditional artificial intelligence models are used for fraud detection, then real-time decision-making capability is improved, but the models fail to perform accurately in data sparse environments due to lack of high-quality training data

Engineering Contradiction:
Improvereal-time decision-making speedVSAvoiddetection accuracy
Core Design Contradiction:
SpeedVSMeasurement precision

Solution Approach 1:

The patent changes the fundamental parameters of the AI model by using gradient boosted decision trees instead of traditional neural networks, and by transforming the data representation into fixed-length feature inputs. This parameter change enables the model to achieve both real-time decision-making and high accuracy in data sparse environments, as the decision tree structure is inherently more efficient for real-time queries and the fixed-length transformation ensures consistent processing time.

Inventive Principle:
Principle #35Parameter changes

2Measurement precision

If complex data transformation is applied to prepare training data, then data quality is improved, but processing time and latency increase

Engineering Contradiction:
Improvedata qualityVSAvoidprocessing latency
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies preliminary action by pre-defining and pre-computing the data transformation rules that convert variable-length communication data into fixed-length feature inputs. These transformation rules are established beforehand based on the communication protocol structure, allowing rapid conversion during real-time processing without requiring complex on-the-fly data preparation, thus reducing latency while maintaining data quality.

Inventive Principle:
Principle #10Preliminary action

3Adaptability or versatility

If the AI model processes variable-length data inputs, then data flexibility is improved, but lookup time becomes dynamic and cannot be optimized for real-time processing

Engineering Contradiction:
Improvedata input flexibilityVSAvoidlookup time consistency
Core Design Contradiction:
Adaptability or versatilityVSSpeed

Solution Approach 1:

The patent changes the data representation parameter from variable-length to fixed-length feature inputs. This transformation is achieved by defining a standardized set of features and transforming the communication data into this fixed structure, which allows the gradient boosted decision tree model to process all inputs with consistent, optimized lookup time while maintaining the ability to handle diverse communication types through the feature transformation layer.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentUS20250291911A1Systems and methods for real-time cyber incident detection in data sparse environments using artificial intelligence
Publication Date: 2025.09.18 CAPITAL ONE SERVICES LLC
  • US20250291911A1 patent drawing
  • US20250291911A1 patent drawing
  • US20250291911A1 patent drawing

AI summary

The systems and methods use a gradient boosted decision tree, which may be trained in data sparse environments. The system also uses a data transformation step to collapse complex data into a standardized feature input (e.g., a fixed length feature input) that may be processed by the model with a constant (or near-constant) lookup time and with minimal latency. Finally, the system generates a dual variable output that provides both a metric of whether a communication is fraudulent and/or unauthorized as well as a confidence level of that determination.