Systems and methods for automated rule-based detection

A non-transitory computer readable medium having instructions stored thereon, wherein the instructions, when executed by a processor cause a device to perform operations comprising:

• receiving an input data set representing a plurality of interactions that may be classified as malicious or non-malicious;
• generating at least one strategy tree including a plurality of rule-based strategies, wherein the at least one strategy tree comprises a strategy tree having a highest area-under-the-curve metric among a plurality of strategy trees for a true positive verse false positive curve and is generated by a machine learning model configured to generate a tree structure;
• ranking the rule-based strategies based on a precision-recall-stability (PRS) score generated for each of the rule-based strategies, wherein the PRS score is a single metric combining Precision, Recall and Stability of each rule-based strategy;
• extracting at least a first rule-based strategy having a highest PRS score;
• and
• evaluating one or more interactions using the first rule-based strategy to determine when the one or more interactions are malicious.

A method, comprising:

• receiving an input data set representing a plurality of interactions that may be classified as malicious or non-malicious;
• generating at least one strategy tree including a plurality of rule-based strategies, wherein the at least one strategy tree comprises a strategy tree having a highest area-under-the-curve metric among a plurality of strategy trees for a true positive verse fake positive curve and is generated by a machine learning model configured to generate a tree structure;
• ranking the rule-based strategies based on a precision-recall-stability (PRS) score generated for each of the rule-based strategies, wherein the PRS score is a single metric combining Precision, Recall and Stability of each rule-based strategy;
• extracting at least a first rule-based strategy having a highest PRS score;
• and
• evaluating one or more interactions using the first rule-based strategy to determine when the one or more interactions are malicious.