# US 12,603,903 B2 · Methods and systems for cyber threat detection using artificial intelligence models in data-sparse environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,903 B2 - Document ID: US12603903B2 - Status: Granted - Kind: B2 - Application number: 18/830,352 - Filed: 2024-09-10 - Published: 2024-12-26 - Granted: 2026-04-14 - Earliest claimed: 2022-07-08 - Assignees: Capital One Services, LLC - Applicants: Capital One Services, LLC - Inventors: Farshid Marbouti; Gurpreet Singh Sandhu; Sarvani Kare; Nahid Farhady Ghalaty; Daniel Liu; Patrick Sofo; Lee Adcock - Web page: https://patentgrep.com/patent/US12603903B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 40/30: Semantic analysis - G06N 3/045: Combinations of networks - H04L 41/16: using machine learning or artificial intelligence - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Methods and systems comprising a first portion of a model that includes a model component that is trained to perform sentiment analysis based on training data for a plurality of users (e.g., what language, phrases, and/or responses the population at large uses). The first portion of the model also includes a model component that is trained to identify user intent based on the sentiment analysis that is specific to user groups. For example, the system first determines the likely context and/or meaning of communications of the user. The system then determines a likely intent of the user based on the likely context and/or meaning of communications (e.g., based on a correlation of the meaning of communications of the user and the intents of users corresponding to a user group of the user). ## Claims ### Claim 1 A system for generating cyber incident responses using artificial intelligence models in data-sparse environments, the system comprising: one or more processors; and a non-transitory, computer-readable medium comprising instructions that, when executed by the one or more processors, cause operations comprising: receiving user profile data, wherein the user profile data comprises electronically transmitted content that is generated by a user and a user characteristic for the user, and wherein the user characteristic comprises demographic information about the user; generating, based on the user profile data, a first feature input; inputting the first feature input into a first model component of an artificial intelligence model to generate a first output, wherein the first model component comprises a neural network that is trained to predict a plurality of user intents based on the user characteristic, and a respective probability for each of the plurality of user intents based on a semantic analysis; receiving user interaction data, wherein the user interaction data comprises time series data indicating an interaction rate of the user with a user device as a function of time; generating, based on the user interaction data, a second feature input; inputting the second feature input into a second model component of the artificial intelligence model to generate a second output, wherein the second model component comprises a machine learning model that is trained to generate user engagement metrics for users based on interaction rates of users; and determining a cyber incident probability based on the first output and the second output. ### Claim 2 A method for generating incident responses using artificial intelligence models in data-sparse environments, the method comprising: receiving user profile data, wherein the user profile data comprises content generated by a user and a user characteristic for the user; inputting the user profile data into a first model component of an artificial intelligence model to generate a first output, wherein the first model component comprises a neural network that is trained to predict a plurality of user intents based on the user characteristic, and a respective probability for each of the plurality of user intents based on a semantic analysis of the content; receiving user interaction data, wherein the user interaction data comprises time series data indicating an interaction rate of the user with a user device as a function of time; inputting the user interaction data into a second model component of the artificial intelligence model to generate a second output, wherein the second model component comprises a machine learning model that is trained to generate user engagement metrics for users based on interaction rates of users; and generating for display, in a user interface, an incident response based on the first output and the second output. ### Claim 3 (depends on 2) The method of claim 2, further comprising: determining a content characteristic for the content generated by the user; and determining a content map for the content generated by the user comprising a vector array of values indicative of the content map and the content characteristic. ### Claim 4 (depends on 2) The method of claim 2, further comprising: determining a first number of user interactions over a first time period; determining a second number of user interactions over a second time period; and determining the interaction rate based on the first number and the second number. ### Claim 5 (depends on 2) The method of claim 2, wherein generating for display the incident response based on the first output and the second output further comprises: determining an incident probability based on the first output and the second output; comparing the incident probability to a threshold incident probability; in response to comparing the incident probability to the threshold incident probability, determining that the incident probability corresponds to the threshold incident probability; and in response to determining that the incident probability corresponds to the threshold incident probability, determining to generate for display the incident response. ### Claim 6 (depends on 2) The method of claim 2, wherein generating for display the incident response based on the first output and the second output further comprises: inputting the first output and the second output into a third model component, wherein the third model component is trained to determine types of incidents; receiving a third output from the third model component; determining a type of incident based on the third output; and selecting the incident response from a plurality of incident responses based on the type. ### Claim 7 (depends on 2) The method of claim 2, wherein generating for display the incident response based on the first output and the second output further comprises: inputting the second output into a third model component to generate a third output, wherein the third model component comprises multi-modal stacking; and selecting the incident response from a plurality of incident responses based on the third output. ### Claim 8 (depends on 2) The method of claim 2, wherein generating for display the incident response based on the first output and the second output further comprises: inputting the first output and the second output into a third model component, wherein the third model component is trained to determine weighted averages for inputs; determining a third output based on a weighted average of the first output and the second output; and selecting the incident response from a plurality of incident responses based on the third output. ### Claim 9 (depends on 2) The method of claim 2, wherein the first model component is trained on top of pre-trained word vectors for sentence-level classification tasks. ### Claim 10 (depends on 2) The method of claim 2, further comprising: receiving training data, wherein the training data comprises user characteristics labeled with corresponding use intents; and training the first model component based on the training data. ### Claim 11 (depends on 2) The method of claim 2, wherein the first output comprises a multi-class classification for the plurality of user intents, and wherein the respective probability for each of the plurality of user intents based on the semantic analysis of the content comprises a probability value between 0 and 1. ### Claim 12 A non-transitory, computer-readable medium comprising instructions that, when executed by one or more processors, cause operations comprising: receiving user profile data, wherein the user profile data comprises content generated by a user and a user characteristic for the user; inputting the user profile data into a first model component of an artificial intelligence model to generate a first output, wherein the first model component comprises a neural network that is trained to predict a plurality of user intents based on the user characteristic, and a respective probability for each of the plurality of user intents based on a semantic analysis of the content; receiving user interaction data, wherein the user interaction data comprises time series data indicating an interaction rate of the user with a user device as a function of time; inputting the user interaction data into a second model component of the artificial intelligence model to generate a second output, wherein the second model component comprises a machine learning model that is trained to generate user engagement metrics for users based on interaction rates of users; and generating for display, in a user interface, a response based on the first output and the second output. ### Claim 13 (depends on 12) The non-transitory, computer-readable medium of claim 12, further comprising: determining a content characteristic for the content generated by the user; and determining a content map for the content generated by the user comprising a vector array of values indicative of the content map and the content characteristic. ### Claim 14 (depends on 12) The non-transitory, computer-readable medium of claim 12, wherein the instructions further cause operations comprising: determining a first number of user interactions over a first time period; determining a second number of user interactions over a second time period; and determining the interaction rate based on the first number and the second number. ### Claim 15 (depends on 12) The non-transitory, computer-readable medium of claim 12, wherein generating for display the response based on the first output and the second output further comprises: determining a probability based on the first output and the second output; comparing the probability to a threshold probability; in response to comparing the probability to the threshold probability, determining that the probability corresponds to the threshold probability; and in response to determining that the probability corresponds to the threshold probability, determining to generate for display the response. ### Claim 16 (depends on 12) The non-transitory, computer-readable medium of claim 12, wherein generating for display the response based on the first output and the second output further comprises: inputting the first output and the second output into a third model component, wherein the third model component is trained to determine types of incidents; receiving a third output from the third model component; determining a type of incident based on the third output; and selecting the response from a plurality of responses based on the type. ### Claim 17 (depends on 12) The non-transitory, computer-readable medium of claim 12, wherein generating for display the response based on the first output and the second output further comprises: inputting the second output into a third model component to generate a third output, wherein the third model component comprises multi-modal stacking; and selecting the response from a plurality of responses based on the third output. ### Claim 18 (depends on 12) The non-transitory, computer-readable medium of claim 12, wherein generating for display the response based on the first output and the second output further comprises: inputting the first output and the second output into a third model component, wherein the third model component is trained to determine weighted averages for inputs; determining a third output based on a weighted average of the first output and the second output; and selecting the response from a plurality of responses based on the third output. ### Claim 19 (depends on 12) The non-transitory, computer-readable medium of claim 12, wherein the first model component is trained on top of pre-trained word vectors for sentence-level classification tasks. ### Claim 20 (depends on 12) The non-transitory, computer-readable medium of claim 12, wherein the instructions further cause operations comprising: receiving training data, wherein the training data comprises user characteristics labeled with corresponding use intents; and training the first model component based on the training data.