Systems and methods for maintaining data privacy in a shared detection model system

A local node comprising a processing device and a memory comprising instructions which are executed by the processing device for retraining a model based on a data set comprising data, the local node further comprising:

• an aggregation module configured to aggregate the data into features that describe the contents of the data;
• a retraining module configured to retrain a detection model using the features by implementing an algorithm that includes at least one selected feature and a threshold for triggering an activity alert;
• an instructions module configured to determine instructions for calculating the at least one selected feature from a different collection of data;
• and
• a sharing module configured to:
• generate a package having the instructions for calculating the at least one selected feature from the different collection of data and the threshold, and
• transmit the package to a local node for implementation of the retrained detection model with data stored at the local node.

A computer-implemented method for updating a detection model while maintaining data protection in a data processing system comprising a processing device and a memory comprising instructions which are executed by the processing device, the method comprising:

• receiving features from a plurality of local nodes, the features being aggregated data that describe the contents of the data relevant to a respective local node;
• generating, by the processing device, a detection model based on the received features from the plurality of local nodes, the detection model comprising a threshold for comparing to at least one selected feature or combination of features and triggering an activity alert;
• determining, by the processing device, instructions for calculating the at least one selected feature or combination of features from a different collection of data;
• generating, by the processing device, a package having the instructions for calculating the at least one selected feature from the different collection of data and the threshold;
• and
• transmitting the package to each of the plurality of local nodes for implementation of the detection model with data stored at the local node.

A detection model system comprising a processing device and a memory comprising instructions which are executed by the processing device for retraining a detection model, the detection model system further comprising:

• a data control module configured to receive features from at least one local node, the features being aggregated data that describe the contents of the data relevant to a respective local node;
• a model manager configured to generate a detection model based on the received features from the plurality of local nodes, the detection model comprising a threshold for comparing to at least one selected feature or combination of features and triggering an activity alert;
• and
• a privacy manager configured to determine instructions for calculating the at least one selected feature or combination of features from a different collection of data,
• wherein the model manager is further configured to:
• generate a package having the instructions for calculating the at least one selected feature from the different collection of data and the threshold;
• and
• transmit the package to each of the plurality of local nodes for implementation of the detection model with data stored at the local node.