Feature Extraction Techniques

A non-transitory computer-readable medium having instructions stored thereon that are executable by a server system to perform operations comprising:

• generating, from a plurality of electronic communications, a bi-partite network graph that includes a plurality of nodes and edges, wherein the plurality of nodes correspond to one of electronic communications and entities participating in the electronic communications;
• capturing a plurality of snapshots of the bi-partite network graph, wherein the plurality of snapshots include nodes and edges existing at a plurality of different time intervals;
• generating, for nodes included in respective snapshots of the plurality of snapshots, a plurality of different types of features, wherein generating the plurality of different types of features includes generating a neighbor convolution feature for a given node in a given snapshot by:
• compressing a plurality of node behavior features for one or more neighbor nodes to the given node, wherein the one or more neighbor nodes are one hop away from the given node within the given snapshot of the bi-partite network graph;
• and
• training, using the plurality of different types of features, a machine learning model, wherein the trained machine learning model is usable to predict whether one or more unlabeled nodes in the bi-partite network graph are anomalous.

A system comprising:

• a processor;
• and
• a non-transitory computer-readable medium having stored thereon instructions that are executable by the processor to cause the system to perform operations comprising:
• generating, by a server system from a plurality of electronic communications, a network graph that includes a plurality of nodes and edges;
• capturing, by the server system, a plurality of snapshots of the network graph, wherein the plurality of snapshots include nodes and edges existing at a plurality of different time intervals;
• generating, by the server system for nodes included in respective snapshots of the plurality of snapshots, a plurality of different types of features, wherein generating the plurality of different types of features includes generating community diffusion features for a plurality of nodes in a given snapshot by:
• determining, using one or more distance procedures, a distance between unlabeled nodes included in a given snapshot and one or more labeled nodes located near the center of the given snapshot;
• and
• determining a connectivity density for the unlabeled nodes, including determining a number of nodes that the unlabeled nodes are connected to that are known to be anomalous;
• and
• training, by the server system using the plurality of different types of features, a machine learning model, wherein the trained machine learning model is usable to predict whether one or more unlabeled nodes in the network graph are anomalous.