At&t Intellectual Property I, LP

Prince Paulraj

Ana Armenta

Edmond J Abrahamian

Christopher Kim

Elijah Hall

Andrew Campbell

Heather Wighton

Mger Babayan

Stephen Grandinetti

Mohammad Omar Khalid Mirza

Weiping Liu

Maisam Shahid Wasti

Paul Ireifej

Surya Murali

Prabhu Gururaj

Yukun Zeng

Arjun Coimbatore Nagarasan

Shreyash Taywade

Shilpi Harpavat

James H Pratt

Chih Chien Huang

Jean Luo

Sai Sharath Japa

Antoine Diffloth

Brandon Bolong Lee

Cuong Vo

Prathiba Sugumaran

Ryan Steckel

Aspects of the subject disclosure may include, for example, receiving input data via a transformation UI, generating transformation configuration data, causing the transformation UI to present transformation object data per the transformation configuration data, where the transformation object data identifies data objects each including an input and output field name and a data type, detecting, from the transformation UI, an instruction defining a mapping for the input data, including a modification to the output field name of a data object such that the input field name of the data object is mapped to the modified output field name, based on the detecting the instruction, modifying the first transformation configuration data per the mapping to derive second transformation configuration data, performing a transformation of the input data based on the second transformation configuration data, and causing the transformation UI to present a transformation output. Other embodiments are disclosed.

Transformation as a service

A method performed by a processing system including at least one processor includes detecting that new data has been added to a repository of reusable machine learning models and machine learning model features, applying data protection to the new data, testing the new data for bias, merging at least a portion of the new data with stored data from the repository to build a new machine learning model in which the data protection is preserved, and publishing the new machine learning model in the repository.

Governance mechanisms for reuse of machine learning models and features

Anomalies associated with events relating to users or user accounts can be detected. An anomaly detection management component (ADMC) determines embedded arrays comprising data bit groups representative of groups of properties and groups of relationships between properties associated with users, based on analysis of data related to events associated with users. ADMC trains a neural network (NN) based on applying embedded arrays to NN, in accordance with an artificial intelligence (AI) analysis process. ADMC determines an embedded array comprising data bits representative of properties and relationships between properties associated with a user based on analysis of data associated with the user. Trained NN can determine a pattern relating to the properties and relationships associated with the user based on AI-based analysis of the embedded array. Trained NN can detect an anomaly in the pattern based on AI-based analysis of the pattern, wherein the anomaly relates to an event.

Anomaly detection relating to communications using information embedding

A processing system may obtain a request to add at least a first feature to a feature graph database, where the request comprises a first feature ontology of the first feature, and where the first feature ontology comprises: a label of the first feature and a relationship of the first feature to a concept or to another feature. The processing system may then identify whether the first feature is a duplicate of a second feature in the feature graph database based at least upon the first feature ontology and a second feature ontology of the second feature and generate an indication of whether the first feature is a duplicate in response to the identifying.

Disambiguation of feature graph databases

Mitigation of temporal generalization losses a target machine learning model is disclosed. Mitigation can be based on identifying, removing, modifying, transforming, etc., features, explanatory variables, models, etc., that can have an unstable relationship with a target outcome over time. Implementation of a more stable representation can be initiated. Temporal stability measures (TSMs) for one or more model feature(s) can be determined based on one or more variable performance metrics (VPMs). A group of one or more VPMs can be selected based on features of a model in either a development or production environment. Model feature modification can be recommended based on a TSM, which can prune a feature, transform a feature, add a feature, etc. Temporal stability information can be presented, e.g., via a dashboard-type user interface. Models can be updated based on mutations of a model comprising a feature modification(s), including competitive champion/challenger model updating.

Mitigating temporal generalization for a machine learning model

A processing system including at least one processor may obtain a first input data set associated with a telephone number from a first service provider that implements a multi-factor authentication process for permitting an access to a service of the first service provider and may apply at least the first input data set to a machine learning model implemented by the processing system to obtain a risk score associated with the telephone number for a subscriber identity module swap of a subscriber identity module, where the machine learning model is trained to generate the risk score associated with the telephone number in accordance with at least the first input data set. The processing system may then perform at least one remedial action associated with the telephone number and the subscriber identity module, in response to the risk score.

Machine learning model feature sharing for subscriber identity module hijack prevention

A processing system may obtain a feature vector for a relationship between first and second user identities within a telecommunication network, the feature vector including: a first number of communications from the first user identity to the second user identity for a first communication channel, a first volume associated with the first number of communications, a second number of communications from the second user identity to the first user identity for the first communication channel, and a second volume associated with the second number of communications. The processing system may then calculate a scaled distance between the feature vector and a centroid comprising a mean vector of a set of relationships between user identities within the telecommunication network, where the scaled distance is associated to a trust value, and perform at least one remedial action in the telecommunication network based on the trust value.

Trust labeling of call graphs for telecommunication network activity detection

Aspects of the subject disclosure may include, for example, monitoring a first activity undertaken by a communication device during a first communication session, generating, based on the monitoring, first data that indicates an amount of time that is spent on the first activity, comparing, based on the generating, the first data to a threshold, and identifying, based on at least the comparing, an action to take when the amount of time that is spent on the first activity exceeds the threshold. Other embodiments are disclosed.

Apparatuses and methods for detecting suspicious activities through monitored online behaviors

A processing system may maintain a relationship graph that includes nodes and edges representing phone numbers and device identifiers having associations with the phone numbers. The processing system may obtain an identification of a first phone number or a first device identifier for a fraud evaluation and extract features from the relationship graph associated with at least one of the first phone number or the first device identifier. The plurality of features may include one or more device identifiers associated with the first phone number, or one or more phone numbers associated with the first device identifier. The processing system may then apply the features to a prediction model that is implemented by the processing system and that is configured to output a fraud risk value of the first phone number or the first device identifier and implement at least one remedial action in response to the fraud risk value.

Relationship graphs for telecommunication network fraud detection

In another example, a device includes a processor and a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations. The operations include acquiring a plurality of data items from a plurality of data sources, wherein the at least two data sources data sources of the plurality of data sources are maintained by different entities, normalizing attributes of the plurality of data items, using a first machine learning technique, matching at least two data items of the plurality of data items to form a grouping, wherein the matching is based on similarities observed in the attributes of the at least two data items subsequent to the normalizing, and creating a single profile for an individual associated with the at least two data items, based on the grouping, wherein the single profile consolidates the attributes of the at least two data items.

Data harmonization across multiple sources

Data stream based event sequence anomaly detection for mobility customer fraud analysis is presented herein. A system obtains a sequence of events comprising respective modalities of communication that correspond to a subscriber identity associated with a communication service—the sequence of events having occurred within a defined period. Based on defined classifiers representing respective fraudulent sequences of events, the system determines, via a group of machine learning models corresponding to respective machine learning processes, whether the sequence of events satisfies a defined condition with respect to likelihood of representing a fraudulent sequence of events of the respective fraudulent sequences of events. In response to the sequence of events being determined to satisfy the defined condition, the system sends, via a user interface of the system, a notification indicating that the sequence of events has been determined to represent the fraudulent sequence of events.

Data stream based event sequence anomaly detection for mobility customer fraud analysis

A processing system may maintain a communication graph that includes nodes representing a plurality of phone numbers including a first phone number and edges between the nodes representing a plurality of communications between the plurality of phone numbers and may generate at least one vector via a graph embedding process applied to the communication graph, the at least one vector representing features of at least a portion of the communication graph. The processing system may then apply the at least one vector to a prediction model that is implemented by the processing system and that is configured to predict whether the first phone number is associated with a type of network activity associated with a telecommunication network and may implement a remedial action in response to an output of the prediction model indicating that the first phone number is associated with the type of network activity.

Call graphs for telecommunication network activity detection

A method for detecting threat pathways using sequence graphs includes constructing a sequence graph from a set of data containing information about activities in a telecommunications service provider network, where the sequence graph represents a subset of the activities that occurs as a sequence, providing an embedding of the sequence graph as input to a machine learning model, wherein the machine learning model has been trained to detect when an input embedding of a sequence graph is likely to indicate a threat activity, determining, based on an output of the machine learning model, whether the subset of the activities is indicative of the threat activity, and initiating a remedial action to mitigate the threat activity.

Growing community of inventors

Coppell, TX, United States of America

Prince Paulraj