Capital One Services, LLC

Sarvani Kare

Patrick Sofo

Lee Adcock

Farshid Marbouti

Benjamin Polk

Daniel Tran

Boshika Tara

Geeta Shyamala

Stephen Fletcher

Ramachandra Kancharla

Venu Kumar Nannapaneni

Yifan Guo

Ada Musheyev

Ganesh Kandula

Joshua S Edwards

Michael Bakr Mossoba

Nahid Farhady Ghalaty

Vannia Gonzalez Macias

Daniel Liu

Andrew Stevens

Gurpreet Singh Sandhu

Urvish Patel

Zabihullah Tora

James Harris

Methods and systems are described herein for detecting anomalous access to system resources. An anomaly detection system may access system events from one or more computing devices and may generate entries from the system events. Each entry may include a corresponding timestamp indicating a time when a corresponding system event occurred, a corresponding user identifier indicating a user account within a computing environment associated with the corresponding system event, a corresponding location identifier indicating a location within the computing environment, and a corresponding action identifier indicating an action that the user account performed with respect to the location or an object within the computing environment. The generated entries may be aggregated and input into an anomaly detection model to obtain anomalous activity identified by the model.

Anomaly detection in computing system events

Methods and systems disclosed herein describe generating virtual backgrounds for video communications. A virtual background generator may monitor a user's calendar and/or inbox for meetings. The virtual background generator may analyze the context of calendar invites and/or scheduled meetings to generate one or more virtual backgrounds for a video conference. A first background may be displayed for the video conference. Additionally, the virtual background generator may update the virtual background based on an analysis of one or more topics being discussed during the video conference. Based on the analysis of the one or more topics being discussed, the virtual background generator may generate a second virtual background to replace the first virtual background.

Automatic image generator using meeting content

In some implementations, a labeling device may determine a label value associated with a label of the document that is associated with a first application. The labeling device may generate a label map that includes an indication of a key-value pair associated with the label value. The labeling device may write, based on the key-value pair associated with the label value, the label value to one or more file properties associated with the document, or may add, based on the key-value pair associated with the label value, the label value as content associated with the document. The label value may persist with the document based on transferring the document from the first application to a second application.

Automated persistence of label information associated with a document

In some implementations, a device may receive a request to generate a virtual credential associated with an account of a user. The device may transmit an indication of the virtual credential, wherein the virtual credential is to be transmitted by a wearable device. The device may communicate, with the wearable device, to identify a usage status of the wearable device, wherein the usage status indicates whether the wearable device is being worn by the user. The device may perform an action, to secure the virtual credential based on communicating with the wearable device and based on the usage status, including: maintaining, by the device, a validity of the virtual credential based on the usage status indicating that the wearable device is being worn by the user; or invalidating, by the device, the virtual credential based on the usage status indicating that the wearable device has been removed from the user.

Enhanced credential security based on a usage status of a wearable device

In some implementations, a system may receive a shell script associated with a computing device. The system may generate a character frequency feature vector based on the shell script. The system may input text of the shell script to a convolutional neural network (CNN) branch of a trained deep learning model. The system may input the character frequency feature vector to a feedforward neural network (FNN) branch of the trained deep learning model. The system may determine using the trained deep learning model, respective probability scores for each of a plurality of obfuscation types for the shell script based on a combined output of the CNN branch and the FNN branch. The system may detect whether the shell script is obfuscated based on respective probability scores for each of the plurality of obfuscation types determined for the shell script.

Deep learning based detection of malicious shell scripts

In some implementations, a device may store a set of data in a first database associated with a fixed storage duration and a storage parameter that restricts access associated with adding or modifying information stored in the first database. The device may process a subset of data from the set of data, wherein processing the subset of data includes performing one or more data processing operations performed via data processing operation documentation that defines the one or more data processing operations. The device may store the data processing operation documentation in a second database associated with a variable storage duration for data stored in the second database. The device may provide the first database and the second database as data sources for a data searching application to enable the first database and the second database to be searchable via a dashboard associated with the data searching application.

Searchable data processing operation documentation associated with data processing of raw data

Methods and systems comprising a first portion of a model that includes a model component that is trained to perform sentiment analysis based on training data for a plurality of users (e.g., what language, phrases, and/or responses the population at large uses). The first portion of the model also includes a model component that is trained to identify user intent based on the sentiment analysis that is specific to user groups. For example, the system first determines the likely context and/or meaning of communications of the user. The system then determines a likely intent of the user based on the likely context and/or meaning of communications (e.g., based on a correlation of the meaning of communications of the user and the intents of users corresponding to a user group of the user).

Methods and systems for cyber threat detection using artificial intelligence models in data-sparse environments

In some implementations, a system may receive a shell script associated with a computing device. The system may generate a character frequency feature vector based on the shell script. The system may input text of the shell script to a convolutional neural network (CNN) branch of a trained deep learning model. The system may input the character frequency feature vector to a feedforward neural network (FNN) branch of the trained deep learning model. The system may determine using the trained deep learning model, a respective probability score for each of a plurality of obfuscation types for the shell script based on a combined output of the CNN branch and the FNN branch. The system may detect whether the shell script is obfuscated based on the respective probability score for each of the plurality of obfuscation types determined for the shell script.

Anomaly detection in computing computing system events

Growing community of inventors

Clarksville, MD, United States of America

Sarvani Kare