Capital One Services, LLC

Patrick Sofo

Sarvani Kare

Nahid Farhady Ghalaty

Farshid Marbouti

Boshika Tara

Lee Adcock

Geeta Shyamala

Ana Cruz

Stephen Fletcher

Vincent Pham

Christopher Camenares

Vannia Gonzalez Macias

Joseph Boayue

Jason Trost

Daniel Liu

Gurpreet Singh Sandhu

Benjamin Yin

Urvish Patel

Methods and systems are described herein for detecting anomalous access to system resources. An anomaly detection system may access system events from one or more computing devices and may generate entries from the system events. Each entry may include a corresponding timestamp indicating a time when a corresponding system event occurred, a corresponding user identifier indicating a user account within a computing environment associated with the corresponding system event, a corresponding location identifier indicating a location within the computing environment, and a corresponding action identifier indicating an action that the user account performed with respect to the location or an object within the computing environment. The generated entries may be aggregated and input into an anomaly detection model to obtain anomalous activity identified by the model.

Anomaly detection in computing system events

Methods and systems described herein for processing of codes stored within security objects may involve scanning a multitude of codes using the security object. When the codes have been scanned, the security object may store the codes until the mechanism is triggered by, for example, detection of a code processing device. As the security object cycles through the stored codes, it may detect a sound from the code processing device, and then a subsequent sound indicating that a first code and a second code have been processed. The security object may determine whether some codes (e.g., between the first code and the second code) may have been skipped and based on that determination, the security object may update cycling time (e.g., time each code is displayed) and then cycle through the other codes.

Security card with code scanner

In some implementations, a system may receive a shell script associated with a computing device. The system may generate a character frequency feature vector based on the shell script. The system may input text of the shell script to a convolutional neural network (CNN) branch of a trained deep learning model. The system may input the character frequency feature vector to a feedforward neural network (FNN) branch of the trained deep learning model. The system may determine using the trained deep learning model, respective probability scores for each of a plurality of obfuscation types for the shell script based on a combined output of the CNN branch and the FNN branch. The system may detect whether the shell script is obfuscated based on respective probability scores for each of the plurality of obfuscation types determined for the shell script.

Deep learning based detection of malicious shell scripts

Methods and systems comprising a first portion of a model that includes a model component that is trained to perform sentiment analysis based on training data for a plurality of users (e.g., what language, phrases, and/or responses the population at large uses). The first portion of the model also includes a model component that is trained to identify user intent based on the sentiment analysis that is specific to user groups. For example, the system first determines the likely context and/or meaning of communications of the user. The system then determines a likely intent of the user based on the likely context and/or meaning of communications (e.g., based on a correlation of the meaning of communications of the user and the intents of users corresponding to a user group of the user).

Methods and systems for cyber threat detection using artificial intelligence models in data-sparse environments

In some implementations, a system may receive a shell script associated with a computing device. The system may generate a character frequency feature vector based on the shell script. The system may input text of the shell script to a convolutional neural network (CNN) branch of a trained deep learning model. The system may input the character frequency feature vector to a feedforward neural network (FNN) branch of the trained deep learning model. The system may determine using the trained deep learning model, a respective probability score for each of a plurality of obfuscation types for the shell script based on a combined output of the CNN branch and the FNN branch. The system may detect whether the shell script is obfuscated based on the respective probability score for each of the plurality of obfuscation types determined for the shell script.

Anomaly detection in computing computing system events

Analyzing communications to determine appropriateness and provide recommendations based on prior communications. Prior communications may create a baseline tone based on the sentiment, words, or phrases used in previous communications between the user and the intended recipient and/or other user recipient pairs. Machine learning techniques may be used to continuously update a baseline tone.

System and method for electronic text analysis and contextual feedback

Systems, methods, and computer-readable storage media for quantifying meeting effectiveness for an individual. A system configured as disclosed herein uses data from multiple meetings in which a user participated to create a user profile for the user. The system then receives data related to a new meeting in which the user participated, processes the new meeting data into segments using natural language processing, tags the resulting segments based on contexts, and compares the tagged segments to the user profile to generate a meeting effectiveness score for the new meeting which is specific to the user. The system can use machine learning to iteratively improve an ability of the system to generate the tagged segments using historical meeting data and updating that historical meeting data with each iteration of scoring a meeting's effectiveness.

Growing community of inventors

Arlington, VA, United States of America

Patrick Sofo