Label and Network Graph Expansion Using Multiple Feature Extraction Procedures

A non-transitory computer-readable medium having instructions stored thereon that are executable by a server system to perform operations comprising:

• accessing a machine learning model trained using a plurality of different features generated using two or more feature extraction procedures;
• determining, using the machine learning model, labels for one or more unlabeled nodes in a bi-partite network graph whose nodes correspond to different entities and electronic communications and whose edges correspond to different interactions between the nodes, wherein the determining is performed based on output of the machine learning model for values of the plurality of different features corresponding to the one or more unlabeled nodes;
• updating, based on the determining, the bi-partite network graph, wherein the updating includes assigning the determined labels to the one or more unlabeled nodes in the bi-partite network graph;
• and
• performing one or more preventative actions for one or more entities corresponding to the one or more nodes with the assigned labels, wherein the one or more preventative actions are performed based on the assigned labels indicating that behavior of entities corresponding to the one or more nodes are anomalous.

A system comprising:

• a processor;
• and
• a non-transitory computer-readable medium having stored thereon instructions that are executable by the processor to cause the system to perform operations comprising:
• determining, using a trained machine learning model, labels for one or more unlabeled nodes in a network graph whose nodes correspond to different entities and whose edges correspond to different electronic communications executed between the different entities, wherein the determining is performed based on output of the machine learning model for values of a plurality of different features corresponding to the one or more unlabeled nodes, wherein the trained machine learning model is trained using a plurality of different features generated using one or more feature extraction procedures;
• updating, based on the determining, the network graph, wherein the updating includes assigning the determined labels to the one or more unlabeled nodes in the network graph;
• and
• performing one or more preventative actions for one or more entities corresponding to the one or more nodes with the assigned labels, wherein the one or more preventative actions are performed based on the assigned labels indicating that behavior of entities corresponding to the one or more nodes are anomalous.