Machine learning for event monitoring
AssigneeCapital One Services, LLC
InventorsSamuel SHARPE, Christopher Bayan BRUSS, James O. H. MONTGOMERY
Life of this patent
Estimating the term…
Abstract
In some aspects, a computing system may use a machine learning model (e.g., a large language model) with a variety of query tokens as seeds to predict probabilities of future events. The system may then use the probabilities to determine the probability of a target event based on the query tokens. The system may then sort the query tokens by probability of the target event and select the top N query tokens (e.g., the top three events for a user that are predicted to be followed by the target event). The events indicated by the query tokens may be monitored for a given time period, and, if any of those events occur, the system may generate an alert.
Claims20
A system for determining events for monitoring for cyber security incidents by using a large language model to simulate future events and identifying alert-worthy events based on the simulations, the system comprising:
- one or more processors programmed with instructions that, when executed by the one or more processors, cause operations comprising:
- obtaining a large language model trained to predict an event performed by a user, the large language model having been trained on a dataset comprising event sequences, wherein a second event of the event sequences indicates a probability that an earlier first event comprised a cybersecurity incident;
- obtaining a set of query tokens, wherein each query token of the set of query tokens is usable as a seed event for the large language model, and wherein each query token of the set of query tokens is of the same query token type;
- inputting an event sequence and the set of query tokens into the large language model, wherein the event sequence is input into the large language model multiple times, each time appended with a different query token of the set of query tokens;
- in response to inputting the event sequence and the set of query tokens into the large language model, generating, for each pair of a set of pairs of the event sequence and a respective query token of the set of query tokens, a set of probabilities of future events;
- determining, for each query token in the set of query tokens and based on the set of probabilities of future events, a given probability of a target event;
- determining a first query token of the set of query tokens, wherein the first query token is associated with a first probability of the target event that satisfies a threshold probability;
- and
- based on the first query token being associated with the first probability of the target event, marking a first event associated with the first query token for monitoring.
A method comprising:
- obtaining a machine learning model trained to predict an event, the machine learning model having been trained on a dataset comprising event sequences;
- obtaining a set of query tokens, wherein each query token of the set of query tokens is usable as a seed event for the machine learning model;
- inputting an event sequence and the set of query tokens into the machine learning model to generate, for each combination of a set of combinations of the event sequence and a respective query token of the set of query tokens, a set of probabilities of future events;
- determining a first query token of the set of query tokens, wherein the first query token is associated with a first probability of a target event that satisfies a threshold probability;
- and
- marking, based on the first query token being associated with the first probability of the target event, a first event associated with the first query token for monitoring.
One or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors, cause operations comprising:
- obtaining a machine learning model trained to predict an event, the machine learning model having been trained on a dataset comprising event sequences;
- obtaining a first event sequence comprising an indication of events in which a user has previously participated;
- generating, based on inputting the first event sequence into the machine learning model, a set of probabilities of future events;
- determining, based on the set of probabilities of future events, that a target event has greater than a threshold probability of occurring;
- and
- determining, based on the target event having greater than the threshold probability of occurring, a first classification for a historical event in the first event sequence, wherein the first classification corresponds to the target event.
Dependencies are inferred from the claim text.