Detection and handling a anomalous activity by a remote entity over a communication network

Abstract

The invention enables detecting and handling threats or malicious activity in network-based communications and/or transactions. In an embodiment of the invention, a data message is received from a remote entity, wherein said first data message includes a first originating internet protocol (IP) address. A data message record having a second originating IP address that matches the first originating IP address, is identified from among a stored set of data message records. The identified data message record is parsed to extract data that identifies the second originating IP address as legitimate or anomalous. Responsive to determining that the second originating IP address is anomalous, a processor implemented instance of a threat handling process flow may be implemented. The determination that the second originating IP address is anomalous may be performed based on a combination of outputs from a variational autoencoder and a graph neural network.