Enterprise Cascade Models

A system, comprising:

• one or more processors;
• one or more non-transitory computer-readable storage mediums including instructions configured to cause the one or more processors to perform operations including:
• accessing first data that represents activity involving a first service provided to a customer;
• accessing second data that represents activity involving a second service provided to a customer, wherein the activity involving the second service and the activity involving the first service both include authorized customer activity, and wherein the activity associated with the second service further includes unauthorized activity;
• accessing filtering criteria for filtering the first data, wherein the filtering criteria facilitates selecting a portion of the first data for use in classifying activity associated with the second service;
• filtering, on a computing device, the first data, wherein filtering is performed using the filtering criteria and includes selecting a retained portion of the first data, the retained portion of the first data being separate from a rejected portion of the first data that is not retained;
• and
• analyzing the second data and the retained portion of the first data, wherein analyzing includes classifying the activity associated with the second service, wherein classifying distinguishes the unauthorized activity from the authorized activity associated with the second service.

A computer-program product, tangibly embodied in a machine-readable non-transitory storage medium, including instructions configured to cause a data processing apparatus to perform operations including:

• accessing first data that represents activity involving a first service provided to a customer;
• accessing second data that represents activity involving a second service provided to a customer, wherein the activity involving the second service and the activity involving the first service both include authorized customer activity, and wherein the activity associated with the second service further includes unauthorized activity;
• accessing filtering criteria for filtering the first data, wherein the filtering criteria facilitates selecting a portion of the first data for use in classifying activity associated with the second service;
• filtering, on a computing device, the first data, wherein filtering is performed using the filtering criteria and includes selecting a retained portion of the first data, the retained portion of the first data being separate from a rejected portion of the first data that is not retained;
• and
• analyzing the second data and the retained portion of the first data, wherein analyzing includes classifying the activity associated with the second service, wherein classifying distinguishes the unauthorized activity from the authorized activity associated with the second service.