Detecting and preventing cyber threats

A system for detecting or preventing cyber threats in a distributed computing environment, comprising:

• a memory;
• one or more processors coupled with the memory and configured to perform:
• obtaining a first machine learning model based on a first training dataset,
• the first training dataset having a first plurality of feature vectors and classifications of the first plurality of feature vectors into a first plurality of classes,
• each feature vector of the first plurality of feature vectors corresponding to a plurality of types of data, including graph data representing relationships among user accounts, computing devices, and computer applications and time series data representing changes over time,
• the first machine learning model generating a first score for specific input data to the first machine learning model indicating how well the specific input data matches the first plurality of feature vectors,
• the first score including an aggregate of a plurality of scores for the first plurality of classes,
• the first plurality of classes corresponding to at least multiple abnormal conditions;
• obtaining a second machine learning model that is a generative AI model based on a second training dataset,
• the second training dataset having a second plurality of feature vectors and classifications of the second plurality of feature vectors including a second plurality of classes,
• each feature vector of the second plurality of feature vectors corresponding to the plurality of types of data,
• the second machine learning model generating a second score for certain input data into the second machine learning model indicating how much the certain input data deviates from the second plurality of feature vectors,
• the second plurality of classes corresponding to no anomalous condition;
• obtaining fusion logic that blends the first machine learning model and the second machine learning model to generate a third score, comprising using an output of the second machine learning model to determine an input of the first machine learning model;
• receiving new data associated with a user account, including particular graph data and particular time series data;
• generating a new feature vector from the new data;
• applying the fusion logic to the new feature vector to obtain a final output;
• determining that the final output satisfies a predetermined condition;
• taking an action based on the determining, including preventing, aborting, or rolling back a database transaction.

A non-transitory, computer-readable storage medium storing one or more sequences of instructions which when executed cause one or more processor to perform:

• obtaining a first machine learning model based on a first training dataset,
• the first training dataset having a first plurality of feature vectors and classifications of the first plurality of feature vectors into a first plurality of classes,
• each feature vector of the first plurality of feature vectors corresponding to a plurality of types of data, including graph data representing relationships among user accounts, computing devices, and computer applications and time series data representing changes over time,
• the first machine learning model generating a first score for specific input data to the first machine learning model indicating how well the specific input data matches the first plurality of feature vectors,
• the first score including an aggregate of a plurality of scores for the first plurality of classes,
• the first plurality of classes corresponding to at least multiple abnormal conditions;
• obtaining a second machine learning model that is a generative AI model based on a second training dataset,
• the second training dataset having a second plurality of feature vectors and classifications of the second plurality of feature vectors including a second plurality of classes,
• each feature vector of the second plurality of feature vectors corresponding to the plurality of types of data,
• the second machine learning model generating a second score for certain input data into the second machine learning model indicating how much the certain input data deviates from the second plurality of feature vectors,
• the second plurality of classes corresponding to no anomalous condition;
• obtaining fusion logic that blends the first machine learning model and the second machine learning model to generate a third score, comprising using an output of the second machine learning model to determine an input of the first machine learning model;
• receiving new data associated with a user account, including particular graph data and particular time series data;
• generating a new feature vector from the new data;
• applying the fusion logic to the new feature vector to obtain a final output;
• determining that the final output satisfies a predetermined condition;
• taking an action based on the determining, including preventing, aborting, or rolling back a database transaction.