One or more techniques and/or systems are provided for risk assessment. Historical authentication data and/or compromised user account data may be evaluated to identify a set of authentication context properties associated with user authentication sessions and/or a set of malicious account context properties associated with compromised user accounts (e.g., properties indicative of whether a user recently visited a malicious site, created a fake social network profile, logged in from unknown locations, etc.). The set of authentication context properties and/or the set of malicious account context properties may be annotated to create an annotated context property training set that may be used to train a risk assessment machine learning model to generate a risk assessment model. The risk assessment model may be used to evaluate user context properties of a user account event to generate a risk analysis metric indicative of a likelihood the user account event is malicious or safe.

Risk assessment modeling

Included are embodiments for tokenizing sensitive data. Some embodiments of systems and/or methods are configured to receive sensitive data from a vendor, determine a token key for the vendor, and utilize a proprietary algorithm, based on the token key to generate a vendor-specific token that is associated with the sensitive data. Some embodiments include creating a token identifier that comprises data related to the token key sending the vendor-specific token and the token identifier to the vendor.

Tokenizing sensitive data

In this paper, we present a recursive algorithm for extracting classification rules from feedforward neural networks (NNs) that have been trained on data sets having both discrete and continuous attributes. The novelty of this algorithm lies in the conditions of the extracted rules: the rule conditions involving discrete attributes are disjoint from those involving continuous attributes. The algorithm starts by first generating rules with discrete attributes only to explain the classification process of the NN. If the accuracy of a rule with only discrete attributes is not satisfactory, the algorithm refines this rule by recursively generating more rules with discrete attributes not already present in the rule condition, or by generating a hyperplane involving only the continuous attributes. We show that for three real-life credit scoring data sets, the algorithm generates rules that are not only more accurate but also more comprehensible than those generated by other NN rule extraction methods.

Recursive Neural Network Rule Extraction for Data With Mixed Attributes

The fuzzy min-max (FMM) network is a supervised neural network classifier that forms hyperboxes for classification and prediction. In this paper, we propose modifications to FMM in an attempt to improve its classification performance when a small number of large hyperboxes are formed in the network. Given a new input pattern, in addition to measuring the fuzzy membership function of the input pattern to the hyperboxes formed in FMM, an Euclidean distance measure is introduced for predicting the target class associated with the new input pattern. A rule extraction algorithm is also embedded into the modified FMM network. A confidence factor is calculated for each FMM hyperbox, and a user-defined threshold is used to prune the hyperboxes with low confidence factors. Fuzzy if-then rules are then extracted from the pruned network. The benefits of the proposed modifications are twofold, viz., to improve the performance of FMM when large hyperboxes are formed in the network; to facilitate the extraction of a compact rule set from FMM to justify its predictions. To assess the effectiveness of modified FMM, two benchmark pattern classification problems are experimented, and the results from different methods published in the literature are compared. In addition, a fault detection and classification problem with a set of real sensor measurements collected from a power generation plant is evaluated using modified FMM. The results obtained are analyzed and explained, and implications of the modified FMM network as a useful fault detection and classification tool in real environments are discussed.

A modified fuzzy min-max neural network with rule extraction and its application to fault detection and classification

In this paper, a review on condition monitoring of induction motors is first presented Then, an ensemble of hybrid intelligent models that is useful for condition monitoring of induction motors is proposed The review covers two parts, ie, (i) a total of nine commonly used condition monitoring methods of induction motors; and (ii) intelligent learning models for condition monitoring of induction motors subject to single and multiple input signals Based on the review findings, the Motor Current Signature Analysis (MCSA) method is selected for this study owing to its online, non-invasive properties and its requirement of only single input source; therefore leading to a cost-effective condition monitoring method A hybrid intelligent model that consists of the Fuzzy Min–Max (FMM) neural network and the Random Forest (RF) model comprising an ensemble of Classification and Regression Trees is developed The majority voting scheme is used to combine the predictions produced by the resulting FMM–RF ensemble (or FMM–RFE) members A benchmark problem is first deployed to evaluate the usefulness of the FMM–RFE model Then, the model is applied to condition monitoring of induction motors using a set of real data samples Specifically, the stator current signals of induction motors are obtained using the MCSA method The signals are processed to produce a set of harmonic-based features for classification using the FMM–RFE model The experimental results show good performances in both noise-free and noisy environments More importantly, a set of explanatory rules in the form of a decision tree can be extracted from the FMM–RFE model to justify its predictions The outcomes ascertain the effectiveness of the proposed FMM–RFE model in undertaking condition monitoring tasks, especially for induction motors, under different environments

Condition monitoring of induction motors: A review and an application of an ensemble of hybrid intelligent models

In this paper, we introduce a novel Mamdani-type fuzzy model, referred to as the all-permutations fuzzy rule base (APFRB), and show that it is mathematically equivalent to a standard feedforward neural network. We describe several applications of this equivalence between a neural network and our fuzzy rule base (FRB), including knowledge extraction from and knowledge insertion into neural networks.

Are artificial neural networks white boxes

There is disclosed a technique for detecting risky domains. The technique comprises collecting information in connection with a domain. The technique also comprises generating a profile comprising at least one metric associated with the domain based on the collected information. The technique further comprises determining the riskiness in connection with the domain based on the generated profile.

Detecting risky domains

A processing device comprises a processor coupled to a memory and is configured to obtain at least one rule set utilized to detect malicious activity in a computer network, to determine one or more trigger conditions for each of a plurality of rules of the at least one rule set, to identify alerts generated responsive to the determined trigger conditions, to compute correlations between respective pairs of the plurality of rules based on the identified alerts, and to aggregate groups of two or more of the plurality of rules into respective aggregated rules based at least in part on the computed correlations. The aggregated rules are illustratively applied in conjunction with remaining unaggregated ones of the plurality of rules of the one or more rule sets to detect malicious activity in the computer network. The processing device may be implemented in a computer network or network security system.

Unsupervised aggregation of security rules

Extracting symbolic knowledge from recurrent neural networks---A fuzzy logic approach

Techniques of identifying fraud detection rule strength involve varying the rendering of a graph from transaction data. Along these lines, a rules server computer provides a general graph from a group of transaction entries defining a group of fraudulent and authentic transactions on an electronic display. A user defines selection criteria that the rules server computer applies to the group of transaction entries to generate a subgroup of transaction entries. From the subgroup of transaction entries, the rules server computer provides a focused graph on the electronic display from the subgroup of transaction entries defining a subgroup of the group of fraudulent and authentic transactions. A ratio of the number of fraudulent transactions to the number of authentic transactions represented in the focused graph identifies the strength of the selection criteria for use in a fraud detection rule.

Eyal Kolman

Papers

Are artificial neural networks white boxes

Detecting risky domains

Unsupervised aggregation of security rules

Extracting symbolic knowledge from recurrent neural networks---A fuzzy logic approach

Rendering transaction data to identify fraud detection rule strength