Charles Schwab Co., Inc.

William Walker

Bashar Abouseido

Rajneesh Kumar

A server for detecting anomalies associated with users accessing a network is caused to receive a dataset including static data and dynamic data. The static data includes location data of resources associated with the network and user data, and the dynamic data includes user access events. The server is further caused to detect, with a plurality of unsupervised machine learning models, an anomaly associated with a user accessing the network based on the static data and the dynamic data, determine whether the detected anomaly is critical, and in response to determining the detected anomaly is critical, generate and transmit a security alert specific to the detected anomaly to a security operation center. Other example servers, systems, apparatuses, methods, and non-transitory computer readable medium for detecting anomalies associated with users accessing a network are also disclosed.

Growing community of inventors

Denver, CO, United States of America

William Walker