Machine learning models for generation of execution action data structures based on device delivery latency

A system comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the one or more processors to:
• obtain, from an out-of-network data source, an anomaly indication for an event type associated with a set of event participant identifiers indicated by temporal sequences for a network;
• generate sets of event rate gradients associated with sets of time blocks based on event rates for events of the event type indicated by the temporal sequences;
• determine a set of compromised nodes by:
• selecting a set of time blocks for which an associated set of event rate gradients falls below an acceleration threshold to identify a set of candidate compromised nodes;
• filtering the set of candidate compromised nodes by a shared geographic identifier to detect a preliminary set of compromised nodes;
• and
• determining an expanded time window based on an earliest time block of the set of candidate compromised nodes satisfying an event rate threshold and a geographic-based criteria;
• and
• perform a search through the temporal sequences based on the expanded time window and the event type to obtain the set of compromised nodes.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:

• obtain, from an out-of-network data source, an anomaly indication for an event type associated with a set of event participant identifiers indicated by temporal sequences for a network;
• generate sets of event rate gradients associated with sets of time blocks based on event rates for events of the event type indicated by the temporal sequences;
• determine a set of compromised nodes by:
• selecting a set of time blocks for which an associated set of event rate gradients falls below an acceleration threshold to identify a set of candidate compromised nodes;
• filtering the set of candidate compromised nodes by a shared geographic identifier to detect a preliminary set of compromised nodes;
• and
• determining an expanded time window based on an earliest time block of the set of candidate compromised nodes satisfying an event rate threshold and a geographic-based criteria;
• and
• perform a search through the temporal sequences based on the expanded time window and the event type to obtain the set of compromised nodes.