Sas Institute Inc.

Thomas J O'Connell

Prathaban Mookiah

Weichen Wang

Hamoon Azizsoltani

Ian Holmes

John Robert Watkins

Logical rules can be automatically generated for use with event detection systems according to some aspects of the present disclosure. For example, a computing device can extract a group of logical rules from trained decision trees and apply a test data set to the group of logical rules to determine count values corresponding to the logical rules. The computing device can then determine performance metric values based on the count values, select a subset of logical rules from among the group of logical rules based on the performance metric values, and provide at least one logical rule in the subset for use with an event detection system. The event detection system can be configured to detect an event in relation to a target data set that was not used to train the decision trees.

Automatically generating rules for event detection systems

Malicious activity can be detected and prevented in real-time or otherwise. For example, a system of the present disclosure can receive a request from a user to obtain access to an entity, determine data objects based on the request, and access data-object network definitions corresponding to the determined data objects. The system can also receive a profile for the user indicating behavioral information relating to the user. The system can then determine a likelihood that the request is associated with malicious activity based on (i) the data objects, (ii) the profile, and (iii) the data-object network definitions. The system can allow or deny the user access to the entity based on the likelihood that the request is associated with malicious activity.

Growing community of inventors

Cary, NC, United States of America

Thomas J O'Connell