Automated generation of adaptive policies from organizational data for detection of risk-related events

A system, comprising:

• a memory;
• and
• at least one processing device, coupled to the memory, operative to implement the following steps:
• obtaining a plurality of features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises one or more of a discrete value of the given feature and a range of values for the given feature;
• obtaining a probability of occurrence associated with each data value based on the organization data;
• identifying a plurality of candidate anomalous data values based on the probabilities of occurrence;
• determining an intervention rate for a plurality of combinations of the candidate anomalous data values;
• automatically generating one or more policies for the organization using one or more of the combinations of candidate anomalous data values based on a corresponding intervention rate, wherein the one or more policies are used to detect one or more risk-related events associated with user transactions of the organization;
• initiating, based on the one or more policies, a generation of at least one authentication challenge for at least one of the user transactions;
• and
• transitioning from the one or more generated policies to a risk engine based on estimated risk detection rates of the risk engine and the one or more generated policies, wherein the risk engine is trained using a supervised machine learning technique.

A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

• extracting a plurality of features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises one or more of a discrete value of the given feature and a range of values for the given feature;
• obtaining a probability of occurrence associated with each data value based on the organization data;
• identifying a plurality of candidate anomalous data values based on the probabilities of occurrence;
• determining an intervention rate for a plurality of combinations of the candidate anomalous data values;
• automatically generating one or more policies for the organization using one or more of the combinations of candidate anomalous data values based on a corresponding intervention rate, wherein the one or more policies are used to detect one or more risk-related events associated with user transactions of the organization;
• initiating, based on the one or more policies, a generation of at least one authentication challenge for at least one of the user transactions;
• and
• transitioning from the one or more generated policies to a risk engine based on estimated risk detection rates of the risk engine and the one or more generated policies, wherein the risk engine is trained using a supervised machine learning technique.