Fair Isaac Corporation

Matthew Kennel

Scott Michael Zoldi

Hua Li

Jehangir Athwal

Xinwei Xue

Xinwai Xue

Computer-implemented method and systems to improve training and performance of artificial intelligence (AI) systems having one or more machine learning models stored in one or more data storage mediums connected in at least one computing network is provided. The method comprises receiving student model scores, generated by a student machine learning model stored in a data storage medium, the student machine learning model having a primary loss function; receiving teacher scores provided by one or more analytic resources, the teacher scores being provided based on known results and behavior of pre-existing machine learning models used for accomplishing a first series of classification objectives; transforming the teacher scores into transformed teacher scores.

Rank distillation for training supervised machine learning models

Systems and methods for training a machine learning model implemented over a network configured to represent the machine learning model are provided. At least one or more directed edges connect the one or more nodes an edge representing a connection between a first node and a second node, the second node computing an activation depending on the values of activations on first nodes and values associated with the connections, the connection being either conforming or non-conforming. The machine learning model may be trained by iteratively adjusting parameters w and b, respectively associated with weights and biases associated with edges connecting computational nodes. Connections between nodes may be sparsified by adjusting the parameter w to a first value for non-conforming connections during the training phase to reduce complexity of the connections among the plurality of nodes, or to ensure the input-output function of the network adheres to additional constraints.

Training artificial neural networks with constraints

Systems and methods for providing insights about a machine learning model are provided. The method includes, using training data to train the machine learning model to learn patterns to determine whether data associated with an event provides an indication that the event belongs to a certain class from among a plurality of classes, evaluating one or more features of the machine learning model to produce a data set pairing observed scores S and a set of predictive input variables V, and constructing at least one data-driven estimator based on an explanatory statistic, the estimator being represented in a computationally efficient form and packaged with the machine learning model and utilized to provide a definition of explainability for a score generated by the machine learning model.

Attributing reasons to predictive model scores with local mutual information

Attributing reasons to predictive model scores

A predictive estimator, trained on a data corpus, is used to generate a probability estimate based a sequence of data related to an entity. The predictive estimator computes an instantaneous surprise score which is a quantification of a short-term deviation of a datum from the probability estimate. To compute the instantaneous surprise score, the predictive estimator is initialized with default values of the predictive estimator. Then, for each of data input of the datum to the predictive estimator, the instantaneous surprise score is calculated, corresponding to the deviation of the data input from the probability estimate. This generates an estimate of the probability of observing the datum given past data on the entity and the predictive estimator. The predictive estimator is updated with the datum and the time step advanced.

Collaborative profile-based detection of behavioral anomalies and change-points

A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.

Cyber security adaptive analytics threat monitoring system and method

In one aspect, input data for a predictive model characterizing a level of risk for a data transaction is received that includes values for categorical variables and one or more of binary variables and continuous variables the predictive model. Thereafter, one or more of the categorical variables is associated with one of a plurality of keys. Each key having corresponding coefficients for at least a subset of the binary variables and the continuous variables and the coefficients being dependent on a value for the key. A composite value based on values for each of at least a subset of the binary variables and the continuous variables as calculated using the corresponding coefficients for each key can then be generated. Scoring of the data transaction using the binary variables, the continuous variables, and the composite variables can then be initiated by the predictive model. Related apparatus, systems, techniques and articles are also described.

Growing community of inventors

San Diego, CA, United States of America

Matthew Kennel