# US 11,113,650 B2 · Automated generation of adaptive policies from organizational data for detection of risk-related events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,650 B2 - Document ID: US11113650B2 - Status: Granted - Kind: B2 - Application number: 16/261,913 - Filed: 2019-01-30 - Published: 2020-07-30 - Granted: 2021-09-07 - Earliest claimed: 2019-01-30 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Alex Zaslavsky; Arkady Koganov; Anatoly Gendelev - Web page: https://patentgrep.com/patent/US11113650B2 ## CPC - G06Q 10/0635: Risk analysis of enterprise or organisation activities - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/00: Machine learning - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Techniques are provided for generating adaptive policies from organization data for detection of risk-related events. One method comprises obtaining features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises a discrete value of the given feature or a range of values for the given feature; obtaining a probability of occurrence associated with each data value based on the organization data; identifying a plurality of candidate anomalous data values based on the probabilities of occurrence; determining an intervention rate for a plurality of combinations of the candidate anomalous data values; and generating policies for the organization using the combinations of candidate anomalous data values based on a corresponding intervention rate. The generated policies are used to detect one or more risk-related events. ## Claims ### Claim 1 A method, comprising: extracting a plurality of features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises one or more of a discrete value of the given feature and a range of values for the given feature; obtaining a probability of occurrence associated with each data value based on the organization data; identifying, using at least one processing device, a plurality of candidate anomalous data values based on the probabilities of occurrence; determining, using at least one processing device, an intervention rate for a plurality of combinations of the candidate anomalous data values; automatically generating, using at least one processing device, one or more policies for the organization using one or more of the combinations of candidate anomalous data values based on a corresponding intervention rate, wherein the one or more policies are used to detect one or more risk-related events associated with user transactions of the organization; initiating, based on the one or more policies, a generation of at least one authentication challenge for at least one of the user transactions; and transitioning from the one or more generated policies to a risk engine based on estimated risk detection rates of the risk engine and the one or more generated policies, wherein the risk engine is trained using a supervised machine learning technique. ### Claim 2 (depends on 1) The method of claim 1, further comprising the step of combining two or more of the identified features into a multi-dimensional feature. ### Claim 3 (depends on 1) The method of claim 1, further comprising the step of discretizing one or more continuous features into said range of values for the one or more continuous features. ### Claim 4 (depends on 1) The method of claim 1, wherein the identifying step further comprises the step of comparing the probabilities of occurrence to a predefined anomaly threshold. ### Claim 5 (depends on 1) The method of claim 1, wherein the generating step further comprises the step of selecting a given combination of candidate anomalous data values when the corresponding intervention rate satisfies a predefined intervention rate threshold. ### Claim 6 (depends on 1) The method of claim 1, wherein the generating step further comprises the step of selecting a combination of the candidate anomalous data values having a smallest number of features. ### Claim 7 (depends on 1) The method of claim 1, further comprising the step of assessing a performance of the one or more generated policies. ### Claim 8 A system, comprising: a memory; and at least one processing device, coupled to the memory, operative to implement the following steps: obtaining a plurality of features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises one or more of a discrete value of the given feature and a range of values for the given feature; obtaining a probability of occurrence associated with each data value based on the organization data; identifying a plurality of candidate anomalous data values based on the probabilities of occurrence; determining an intervention rate for a plurality of combinations of the candidate anomalous data values; automatically generating one or more policies for the organization using one or more of the combinations of candidate anomalous data values based on a corresponding intervention rate, wherein the one or more policies are used to detect one or more risk-related events associated with user transactions of the organization; initiating, based on the one or more policies, a generation of at least one authentication challenge for at least one of the user transactions; and transitioning from the one or more generated policies to a risk engine based on estimated risk detection rates of the risk engine and the one or more generated policies, wherein the risk engine is trained using a supervised machine learning technique. ### Claim 9 (depends on 8) The system of claim 8, wherein the identifying step further comprises the step of comparing the probabilities of occurrence to a predefined anomaly threshold. ### Claim 10 (depends on 8) The system of claim 8, wherein the generating step further comprises the step of selecting a given combination of candidate anomalous data values when the corresponding intervention rate satisfies a predefined intervention rate threshold. ### Claim 11 (depends on 8) The system of claim 8, wherein the generating step further comprises the step of selecting a combination of the candidate anomalous data values having a smallest number of features. ### Claim 12 (depends on 8) The system of claim 8, further comprising the step of assessing a performance of the one or more generated policies. ### Claim 13 A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps: extracting a plurality of features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises one or more of a discrete value of the given feature and a range of values for the given feature; obtaining a probability of occurrence associated with each data value based on the organization data; identifying a plurality of candidate anomalous data values based on the probabilities of occurrence; determining an intervention rate for a plurality of combinations of the candidate anomalous data values; automatically generating one or more policies for the organization using one or more of the combinations of candidate anomalous data values based on a corresponding intervention rate, wherein the one or more policies are used to detect one or more risk-related events associated with user transactions of the organization; initiating, based on the one or more policies, a generation of at least one authentication challenge for at least one of the user transactions; and transitioning from the one or more generated policies to a risk engine based on estimated risk detection rates of the risk engine and the one or more generated policies, wherein the risk engine is trained using a supervised machine learning technique. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the identifying step further comprises the step of comparing the probabilities of occurrence to a predefined anomaly threshold. ### Claim 15 (depends on 13) The computer program product of claim 13, wherein the generating step further comprises the step of selecting a given combination of candidate anomalous data values when the corresponding intervention rate satisfies a predefined intervention rate threshold. ### Claim 16 (depends on 13) The computer program product of claim 13, wherein the generating step further comprises the step of selecting a combination of the candidate anomalous data values having a smallest number of features. ### Claim 17 (depends on 13) The computer program product of claim 13, further comprising the step of assessing a performance of the one or more generated policies. ### Claim 18 (depends on 1) The method of claim 1, further comprising the step of initiating, based on the risk engine, a generation of at least one additional authentication challenge for at least another one of the user transactions. ### Claim 19 (depends on 1) The method of claim 1, wherein said transitioning comprises setting a ratio of authentication challenges generated based on the one or more policies for the user transactions to authentical challenges generated based on the risk engine for the user transactions. ### Claim 20 (depends on 1) The method of claim 1, wherein said transitioning comprises gradually increasing the percentage of the authentication challenges generated based on the risk engine relative to the authentication challenges based on the one or more policies.