# US 11,451,568 B2 · Automatic model monitoring for data streams

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,568 B2
- Document ID: US11451568B2
- Status: Granted
- Kind: B2
- Application number: 16/667,674
- Filed: 2019-10-29
- Published: 2020-11-19
- Granted: 2022-09-20
- Earliest claimed: 2019-05-13
- Assignees: Feedzai—Consultadoria e Inovação Tecnológica, S.A.
- Applicants: Feedzai—Consultadoria e Inovação Tecnólogica, S.A.
- Inventors: Marco Oliveira Pena Sampaio; Fábio Hernâni dos Santos Costa Pinto; Pedro Gustavo Santos Rodrigues Bizarro; Pedro Cardoso Lessa e Silva; Ana Margarida Caetano Ruela; Miguel Ramos de Araújo; Nuno Miguel Lourenço Diegues
- Web page: https://patentgrep.com/patent/US11451568B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 16/22: Indexing; Data structures therefor; Storage structures
- G06F 16/24568: {Data stream processing; Continuous queries}
- G06F 16/2474: {Sequence data queries, e.g. querying versioned data}
- G06F 21/554: {involving event detection and direct action}
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 5/04: Inference or reasoning models
- G06N 20/00: Machine learning
- G06N 20/20: Ensemble learning
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- H04L 41/0604: using filtering, e.g. reduction of information by using priority, element types, position or time
- H04L 43/16: Threshold monitoring
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- G06F 3/0484: for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 2221/034: Test or assess a computer or a system
- H04L 41/0681: Configuration of triggering conditions
- H04L 41/16: using machine learning or artificial intelligence
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 2463/102: applying security measure for e-commerce
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

In an embodiment, a process for automatic model monitoring for data streams includes receiving an input dataset, using a machine learning model to determine a model score for each data record of at least a portion of the input dataset, and determining monitoring values. Each monitoring value is associated with a measure of similarity between model scores for those data records of the input dataset within a corresponding moving reference window and model scores for those data records of the input dataset within a corresponding moving target window. The process includes outputting the determined monitoring values.

## Claims

### Claim 1

A method comprising:
receiving an input dataset;
using a machine learning model to determine a model score for each data record of at least a portion of the input dataset;
determining monitoring values, wherein each monitoring value is associated with a measure of similarity between model scores for those data records of the input dataset within a corresponding moving reference window and model scores for those data records of the input dataset within a corresponding moving target window;
in response to detecting that at least one of the monitoring values meets the threshold, freezing a time location of the reference window and sliding the target window until at least one of the monitoring values falls below the threshold; and
outputting the determined monitoring values.

### Claim 2 (depends on 1)

The method of claim 1, wherein the input dataset includes at least one of: events received in real time and a stream of data records.

### Claim 3 (depends on 1)

The method of claim 1, wherein the measure of similarity compares (i) a histogram of model scores for those data records of the input dataset within a corresponding moving reference window and (ii) a histogram of model scores for those data records of the input dataset within a corresponding moving target window.

### Claim 4 (depends on 1)

The method of claim 1, wherein the measure of similarity includes Jensen-Shannon divergence.

### Claim 5 (depends on 1)

The method of claim 1, wherein at least one of the target window and the reference window is a fixed size.

### Claim 6 (depends on 1)

The method of claim 1, wherein the size of the target window is based at least in part on an average number of events in a pre-defined period.

### Claim 7 (depends on 1)

The method of claim 1, wherein the size of the reference window is a multiple of the size of the target window.

### Claim 8 (depends on 1)

The method of claim 1, wherein at least one of the target window and the reference window is time-based.

### Claim 9 (depends on 1)

The method of claim 1, wherein the target window captures more recent events in the input dataset than events captured by the reference window.

### Claim 10 (depends on 1)

The method of claim 1, wherein the reference window and the target window are contiguous.

### Claim 11 (depends on 1)

The method of claim 1, wherein determining monitoring values includes using a plurality of homologous reference windows with the same time-based or index-based size that are regularly spaced.

### Claim 12 (depends on 1)

The method of claim 1, wherein outputting the determined monitoring values includes rendering the monitoring values on a graphical user interface.

### Claim 13 (depends on 1)

The method of claim 1, further comprising:
detecting that at least one of the monitoring values meets a threshold; and
in response to the detection that at least one of the monitoring values meets the threshold, providing an indication associated with the detection.

### Claim 14 (depends on 13)

The method of claim 13, wherein detecting that at least one of the monitoring values meets a threshold indicates concept drift.

### Claim 15 (depends on 13)

The method of claim 13, wherein detecting that at least one of the monitoring values meets a threshold indicates a fraud attack.

### Claim 16 (depends on 13)

The method of claim 13, further comprising updating the machine learning model in response to detecting that at least one of the monitoring values meets the threshold.

### Claim 17 (depends on 13)

The method of claim 13, wherein detecting that at least one of the monitoring values meets a threshold is made prior to labels becoming available.

### Claim 18

A system comprising:
a processor configured to receive an input dataset;
use a machine learning model to determine a model score for each data record of at least a portion of the input dataset;
determine monitoring values, wherein each monitoring value is associated with a measure of similarity between model scores for those data records of the input dataset within a corresponding moving reference window and model scores for those data records of the input dataset within a corresponding moving target window;
in response to detecting that at least one of the monitoring values meets the threshold, freezing a time location of the reference window and sliding the target window until at least one of the monitoring values falls below the threshold;
and output the determined monitoring values; and a memory coupled to the processor and configured to provide the processor with instructions.

### Claim 19

A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving an input dataset;
using a machine learning model to determine a model score for each data record of at least a portion of the input dataset;
determining monitoring values, wherein each monitoring value is associated with a measure of similarity between model scores for those data records of the input dataset within a corresponding moving reference window and model scores for those data records of the input dataset within a corresponding moving target window;
in response to detecting that at least one of the monitoring values meets the threshold, freezing a time location of the reference window and sliding the target window until at least one of the monitoring values falls below the threshold; and
outputting the determined monitoring values.