System and method for classifying datasets to guide action
A system and method for identifying data connections may submit alert data items of one or more datasets to a machine learning model, wherein the alert data items of each dataset include: an alert rule that initiated an alert for the dataset including a first set of thresholds, one or more data values assessed by the first set of thresholds in the generation of the alert, and an alert categorization of the alert selected from a true positive categorization or a false positive categorization; assess, combinations of the alert categorization in relation to the one or more data values and the alert rule; generate a second set of thresholds for the one or more data values, wherein the second set of thresholds has a reduced false positive categorization of the alerts compared to the first set of thresholds; and update the alert rule to comprise the second set of thresholds.
1 . A method of classifying datasets, the method comprising:
submitting, by a computer, alert data items of one or more datasets to a machine learning (ML) model that is a decision tree, wherein the alert data items of each dataset comprise: an alert rule that initiated an alert for the dataset comprising a first set of thresholds, one or more data values assessed by the first set of thresholds in the generation of the alert, and an alert categorization of the alert selected from a group consisting of: a true positive categorization and a false positive categorization;
assessing, by the ML model, by the computer combinations of the alert categorization in relation to the one or more data values and the alert rule;
generating, by the ML model, by the computer a second set of thresholds for the one or more data values, wherein the second set of thresholds has a reduced false positive categorization of the alerts compared to the first set of thresholds and wherein the second set of thresholds is based on reinforcement learning applied with the ML model, wherein the reinforcement learning is based on ranking the second set of thresholds based on generated threshold values;
updating, by the computer, the alert rule to comprise the second set of thresholds.
2 . A method according to claim 1 , further comprising assigning, by the ML model, by the computer, scores to the generated second set of thresholds.
3 . A method according to claim 1 , wherein the generation of the second set of thresholds comprises increasing the true positive categorization of generation of the alerts compared to the first set of thresholds.
4 . A method according to claim 1 , further comprising applying, by the computer, the second set of thresholds for the rule in the categorization of new datasets.
5 . A method according to claim 1 , further comprising adapting, by the computer, the one or more data values to the second set of thresholds.
6 . A method according to claim 1 , wherein the ML model generates two or more second sets of thresholds for the alert rule and determines the second set of thresholds for the alert rule by selecting the second set of thresholds which has the lowest false positive categorization of the alerts out of the two or more second sets of thresholds.
7 . A method according to claim 6 , wherein selecting the second set of thresholds further comprises selecting the second set of thresholds which has the highest true positive categorization of the alerts out of the two or more second sets of thresholds.
8 . A method according to claim 1 , further comprising selecting, by the computer, a number of threshold groups for the second set of thresholds.
9 . A method according to claim 8 , wherein the threshold groups for the second set of thresholds comprise an escalation alert, a standard alert and a hibernation alert.
10 . A method according to claim 1 , wherein the alert rule is used to block a customer account related to the dataset in case that an alert is initiated for the dataset.
11 . A system for classifying datasets, the system comprising:
a computing device;
a memory; and
a processor, the processor configured to:
submit alert data items of one or more datasets to a ML model that is a decision tree, wherein the alert data items of each dataset comprise: an alert rule that initiated an alert for the dataset comprising a first set of thresholds, one or more data values assessed by the first set of thresholds in the generation of the alert, and an alert categorization of the alert selected from a group consisting of: a true positive categorization and a false positive categorization;
assess, by the ML model, combinations of the alert categorization in relation to the one or more data values and the alert rule;
generate, by the ML model, a second set of thresholds for the one or more data values, wherein the second set of thresholds has a reduced false positive categorization of the alerts compared to the first set of thresholds and wherein the second set of thresholds is based on reinforcement learning applied with the ML model, wherein the reinforcement learning is based on ranking the second set of thresholds based on generated threshold values; and
update the alert rule to comprise the second set of thresholds.
12 . A system according to claim 11 , further comprising the assignment of scores to the generated second set of thresholds by the ML model.
13 . A system according to claim 11 , wherein the generation of the second set of thresholds comprises increasing the true positive categorization of generation of the alerts compared to the first set of thresholds.
14 . A system according to claim 11 , further comprising applying the second set of thresholds for the rule in the categorization of new datasets.
15 . A system according to claim 11 , further comprising adapting the one or more data values to the second set of thresholds.
16 . A system according to claim 11 , wherein the ML model generates two or more second sets of thresholds for the alert rule and determines the second set of thresholds for the alert rule by selecting the second set of thresholds which has the lowest false positive categorization of the alerts out of the two or more second sets of thresholds.
17 . A method of dynamically categorizing customer datasets, the method comprising:
submitting, by a computer, categorization data items of a plurality customer datasets to a ML model that is a decision tree, wherein the categorization data items of each dataset of the plurality of customer datasets comprise: a categorization rule that initiated a categorization for the customer dataset comprising a first set of ranges, wherein the categorization is selected from a group consisting of: a true positive categorization and false positive categorization, and one or more data values assessed by the first set of ranges in the generation of the categorization;
determining, by the ML model, by the computer, combinations of the categorization in relation to the one or more data values and the categorization rule;
generating, the ML model, by the computer, a second set of ranges for the one or more data values, wherein the second set of ranges has a reduced false positive categorization of the categorizations compared to the first set of ranges and wherein the second set of thresholds is based on reinforcement learning applied with the ML model, wherein the reinforcement learning is based on ranking the second set of thresholds based on generated threshold values; and
replacing, by the computer, the first set of ranges with the second set of ranges.