International Business Machines Corporation

Michael Josiah Bolding

Jian Lin

Matthew Elsner

Yun Pan

Cheng-Ta Lee

Ronald B Williams

Paul Sherwood Taylor

Janki Y Vora

Matthew Paul Ouellette

Peihao Chen

Joe C Wallace

Jerry Pan

Vanessa P Reyes

Dominique J Paster

Wesley Truett

Timothy A Thornburgh

An approach is provided that receives event data that correspond to detected activities performed by a user on one of a set of one or more computer systems. The detected activities are performed by the user over a time duration. The approach analyzes the event data using time-based models. Each of the time-based models correspond to a different time interval that is included in the time duration. The analysis results in time-based risk scores pertaining to the user for each of the different time intervals. An action is then performed based on an overall security risk score of the user with the overall security risk score of the user being calculated based on the different time-based risk scores.

User behavior risk analytic system with multiple time intervals and shared data extraction

A tiered machine learning-based infrastructure comprises a first machine learning (ML) tier configured to execute within an enterprise network environment and that learns statistics for a set of use cases locally, and to alert deviations from the learned distributions. Use cases typically are independent from one another. A second machine learning tier executes external to the enterprise network environment and provides further learning support, e.g., by determining a correlation among multiple independent use cases that are running locally in the first tier. Preferably, the second tier executes in a cloud compute environment for scalability and performance.

Distributed machine learning for anomaly detection

A machine learning (ML)-based technique for user behavior analysis that detects when users deviate from expected behavior. A ML model is trained using training data derived from activity data from a first set of users. The model is refined in a computationally-efficient manner by identifying a second set of users that constitute a 'watch list.' At a given time, a differential data ingestion operation is then performed to incorporate data for the second set of users into the training data, while also pruning at least a portion of the data set corresponding to data associated with any user included in the first set but not in the second set. These operations update the training data used for the machine learning. The machine learning model is then refined based on the updated training data that incorporates the activity data ingested from the users identified in the watch list.

Adaptive object modeling and differential data ingestion for machine learning

A media recording within a data store of a computing device can be identified. The media can be a photograph or a video. The media can be analyzed to determine a participant associated with the media. The participant can be a creator or a subject. The identity of the participant can be determined utilizing biometrics associated with an identity source. The identity can be associated with a confidence score which can indicate the accuracy of the identity. The identity source can be associated with a weighted value which can represent the validity of identity data associated with the source. The identity of the participant can be automatically tagged within the media. The tagging can be a participant name or participant user name.

Intelligent biometric identification of a participant associated with a media recording

Growing community of inventors

Smyrna, GA, United States of America

Michael Josiah Bolding