Automated rule recommendation engine
AssigneeDataVisor Inc.
InventorsCatherine Lu, Patrick Glenn Murray, Ming Qi, Shuo Shan, Yinglian Xie, Fang Yu, Yuhao Zheng
Life of this patent
Estimating the term…
Abstract
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for rule generation and interaction. A rules engine is provided that does not require manual effort to generate or maintain high-quality rules over time for detecting malicious accounts or events. Rules no longer need to be manually added, tuned, or removed from the system. The system is able to determine the health of each rule and automatically add, tune, and remove rules to maintain a consistent, effective rule set.
Claims19
A method for generating rules for identifying malicious accounts or events, the method comprising:
- obtaining input data points associated with a plurality of entities corresponding to a user generated event or a user account;
- determining whether the input data points are labeled or unlabeled;
- in response to determining that the data points are labeled as positive, indicating a corresponding malicious entity, or negative, determining a set of features from the input data points using supervised machine learning techniques;
- generating a group of candidate single variable rules using the determined set of features that provide a greatest coverage of positive data points, wherein each rule specifies a matching condition based on a corresponding feature dimension;
- generating a group of candidate multi-variable rules from the single-variable rules;
- filtering the candidate single-variable and multi-variable rules using the negatively labeled input data points to generate a final set of valid rules;
- outputting the final set of valid rules;
- and
- applying the final set of valid rules to input data to identify malicious accounts or events.
A system comprising:
- one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
- obtaining input data points associated with a plurality of entities corresponding to a user generated event or a user account;
- determining whether the input data points are labeled or unlabeled;
- in response to determining that the data points are labeled as positive, indicating a corresponding malicious entity, or negative, determining a set of features from the input data points using supervised machine learning techniques;
- generating a group of candidate single variable rules using the determined set of features that provide a greatest coverage of positive data points, wherein each rule specifies a matching condition based on a corresponding feature dimension;
- generating a group of candidate multi-variable rules from the single-variable rules;
- filtering the candidate single-variable and multi-variable rules using the labeled input data points to generate a final set of valid rules;
- outputting the final set of valid rules;
- and
- applying the final set of valid rules to input data to identify malicious accounts or events.
One or more computer-readable storage media encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:
- obtaining input data points associated with a plurality of users entities corresponding to a user generated event or a user account;
- determining whether the input data points are labeled or unlabeled;
- in response to determining that the data points are labeled as positive, indicating a corresponding malicious entity, or negative, determining a set of features from the input data points using supervised machine learning techniques;
- generating a group of candidate single variable rules using the determined set of features that provide a greatest coverage of positive data points, wherein each rule specifies a matching condition based on a corresponding feature dimension;
- generating a group of candidate multi-variable rules from the single-variable rules;
- filtering the candidate single-variable and multi-variable rules using the negatively labeled input data points to generate a final set of valid rules;
- outputting the final set of valid rules;
- and
- applying the final set of valid rules to input data to identify malicious accounts or events.
Dependencies are inferred from the claim text.