Disruptor validation engine(s) for assessing the quality of disruptors

1 . A distributor validation engine comprising:

a non-transitory computer-readable storage medium comprising processor-executable instructions stored on the non-transitory computer-readable storage medium; and

one or more processors coupled to the computer-readable storage medium and configured to execute the processor-executable instructions, wherein the processor-executable instructions, when executed by the one or more processors, direct the distributor validation engine, to at least:

determine a plurality of disruption alerts associated with one or more disruptors, wherein a disruption alert of the plurality of disruption alerts indicates potential malicious activity within a tenant environment;

generate a probability grade for one or more disruption alerts of the plurality of disruption alerts, wherein the probability grade indicates a likelihood that the potential malicious activity is actually malicious;

determine a disruption classification for the one or more disruption alerts based on the probability grade; and

generate a quality grade for the one or more disruptors based on the disruption classification of the one or more disruption alerts of the plurality of disruption alerts.

2 . The distributor validation engine of claim 1 , wherein the processor-executable instructions to generate the quality grade for the one or more disruptors based on the disruption classification of each disruption alert, when executed by the one or more processors, further direct the distributor validation engine to:

generate a disruptor signal-to-noise ratio (SNR) estimation for each of the one or more disruptors based on the disruption classification for each of the plurality of disruption alerts.

3 . The distributor validation engine of claim 1 , wherein the processor-executable instructions to determine the disruption classification for each of the plurality of disruption alerts based on the probability grade, when executed by the one or more processors, further direct the distributor validation engine to:

determine a first disruption classification for a first subset of disruption alerts; and

determine a second disruption classification for a second subset of disruption alerts, wherein:

the first disruption classification indicates that the first subset of disruption alerts corresponds to a valid disruption;

the second disruption classification indicates that the second subset of disruption alerts corresponds to an invalid disruption; and

the plurality of disruption alerts comprises the first subset of disruption alerts and the second subset of disruption alerts.

4 . The distributor validation engine of claim 1 , wherein:

the one or more disruptors comprises a first disruptors; and

the processor-executable instructions to generate the quality grade for the one or more disruptors based on the disruption classification of the one or more disruption alerts, when executed by the one or more processors, further direct the distributor validation engine to:

determine a confidence contribution for the one or more disruption alerts in each of the disruption classification;

generate a contribution summation for each of the disruption classifications based on the confidence contributions for the one or more disruption alerts in each respective disruption classification; and

determine a disruptor signal-to-noise ratio (SNR) estimation range for the first disruptor based on the contribution summation for each disruption classification.

5 . The distributor validation engine of claim 1 , wherein the disruptor validation engine comprises a machine learning (ML) model and the processor-executable instructions, when executed by the one or more processors, further direct the distributor validation engine to:

train the ML model on a training dataset based on historical disruption alerts, wherein the training dataset comprises:

a plurality of disruption alert features; and

a plurality of alert responses;

test the ML model on an inference dataset, wherein the inference dataset is different from the training dataset; and

determine a threshold range for the disruption classification based on testing on the inference dataset.

6 . The distributor validation engine of claim 1 , wherein:

the processor-executable instructions to generate the probability grade for each of the plurality of disruption alerts, when executed by the one or more processors, further direct the distributor validation engine to:

submit the plurality of disruption alerts to a first ML model; and

receive, from the first ML model a first plurality of probability grades, wherein each of the first plurality of probability grades corresponds to a respective disruption alert of the plurality of disruption alerts; and

the processor-executable instructions to determine the disruption classification for each of the plurality of disruption alerts based on the probability grade, when executed by the one or more processors, further direct the computing apparatus to:

determine an unknown disruption classification for a subset of disruption alerts based on a subset of probability grades corresponding to the subset of disruption alerts, wherein the plurality of disruption alerts comprises the subset of disruption alerts; and the first plurality of probability grades comprises the subset of probability grades; and

submit the subset of disruption alerts to one or more additional ML models;

receive, from the one or more additional ML models, a second plurality of probability grades for a disruption alert in the subset of disruption alerts; and

determine the disruption classification for each of the plurality of disruption alerts based on the first plurality of probability grades and the second plurality of probability grades.

7 . A method implemented by one or more processors executing instructions stored on a non-transitory computer-readable medium comprising:

determining a plurality of disruption alerts associated with one or more disruptors, wherein a disruption alert of the plurality of disruption alerts indicates potential malicious activity within a tenant environment;

generating, using a machine-learning (ML) model, a probability grade for one or more disruption alerts, wherein the probability grade indicates a likelihood that the potential malicious activity is actually malicious;

determining a disruption classification for each of the plurality of disruption alerts based on the probability grade; and

generating a quality grade for the one or more disruptors based on the disruption classification of the one or more disruption alerts of the plurality of disruption alerts.

8 . The method of claim 7 , wherein:

determining the disruption classification for each of the plurality of disruption alerts comprises:

determining a first disruption classification for a first subset of disruption alerts; and

determining a second disruption classification for a second subset of disruption alerts, wherein:

the first disruption classification indicates that the first subset of disruption alerts corresponds to a valid disruption;

the second disruption classification indicates that the second subset of disruption alerts corresponds to an invalid disruption; and

the plurality of disruption alerts comprises the first subset of disruption alerts and the second subset of disruption alerts; and

generating the quality grade for the one or more disruptors based on the disruption classification of the one or more disruption alerts of the plurality of disruption alerts further comprises:

generating a disruptor signal-to-noise ratio (SNR) estimation for each of the one or more disruptors based on the first disruption classification and the second disruption classification.

9 . The method of claim 7 , wherein determining the disruption classification for each of the plurality of disruption alerts based on the probability grade comprises:

comparing each of the plurality of disruption alerts to a first threshold;

determining a first disruption classification for a first subset of disruption alerts based on the first subset of disruption alerts exceed the first threshold;

comparing each of the plurality of disruption alerts a second threshold;

determining a second disruption classification for a second subset of disruption alerts based on the second subset of disruption alerts failing to meet the second threshold; and

determining a third disruption classification for a third subset of disruption alerts, wherein the third subset of disruption alerts fail to meet the first threshold and exceed the second threshold,

wherein the plurality of disruption alerts comprises the first subset of disruption alerts, the second subset of disruption alerts, and the third subset of disruption alerts.

10 . The method of claim 7 , wherein the method further comprises:

training the ML model on a training dataset based on historical disruption alerts, wherein the training dataset comprises:

a plurality of disruption alert features;

a plurality of alert responses;

testing the ML model on an inference dataset, wherein the inference dataset is different from the training dataset; and

modifying one or more parameters of the ML model based on testing on the inference dataset.

11 . The method of claim 7 , wherein the one or more disruptors comprise a first disruptor and generating the quality grade for the one or more disruptors based on the disruption classification of the one or more disruption alerts of the plurality of disruption alerts further comprises:

determining a disruptor signal-to-noise ratio (SNR) estimation range for the first disruptor, wherein the disruptor SNR estimation range comprises a disruptor SNR lower bound and a disruptor SNR upper bound.

12 . The method of claim 7 , wherein:

generating, by the ML model, the probability grade for each of the plurality of disruption alerts comprises:

submitting the plurality of disruption alerts to a first ML model; and

receiving, from the first ML model a first plurality of probability grades, wherein each of the first plurality of probability grades corresponds to a respective disruption alert of the plurality of disruption alerts; and

determining the disruption classification for each of the plurality of disruption alerts comprises:

determining an unknown disruption classification for a subset of disruption alerts based on a subset of probability grades corresponding to the subset of disruption alerts, wherein the plurality of disruption alerts comprises the subset of disruption alerts; and the first plurality of probability grades comprises the subset of probability grades; and

determining a second plurality of probability grades for a disruption alert in the subset of disruption alerts; and

determining the disruption classification for each of the plurality of disruption alerts based on the first plurality of probability grades and the second plurality of probability grades.

13 . The method of claim 7 , wherein the method comprises:

generating a final verdict for each of the one or more disruptors based on the quality grade of a respective disruptor.

14 . The method of claim 7 , wherein generating the quality grade for the one or more disruptors based on the disruption classification of the one or more disruption alerts comprises:

determining a confidence contribution for the one or more disruption alerts in each of the disruption classification;

generating a contribution summation for each of the disruption classifications based on the confidence contributions for the one or more disruption alerts in each respective disruption classification; and

determining the quality grade for each of the one or more disruptors based on the contribution summation for each disruption classification.

15 . A non-transitory computer readable storage media comprising processor-executable instructions configured to cause one or more processors to:

determine a plurality of disruption alerts associated with one or more disruptors, wherein a disruption alert of the plurality of disruption alerts indicates potential malicious activity within a tenant environment;

generate a probability grade for one or more disruption alerts of the plurality of disruption alerts, wherein the probability grade indicates a likelihood that the potential malicious activity is actually malicious;

determine a disruption classification for each of the plurality of disruption alerts based on the probability grade;

determine a disruptor signal-to-noise ratio (SNR) estimation for the one or more disruptors based on the disruption classification of the one or more disruption alerts; and

generate a quality grade for the one or more disruptors based on the disruptor SNR estimation of the one or more disruptors of the plurality of disruption alerts.

16 . The non-transitory computer readable storage media of claim 15 , wherein:

the processor-executable instructions to determine the disruption classification for each of the plurality of disruption alerts cause the one or more processors to further execute processor-executable instructions stored in the computer readable storage media to:

determine a first disruption classification for a first subset of disruption alerts; and

determine a second disruption classification for a second subset of disruption alerts, wherein:

the first disruption classification indicates that the first subset of disruption alerts corresponds to a valid disruption;

the second disruption classification indicates that the second subset of disruption alerts corresponds to an invalid disruption; and

the plurality of disruption alerts comprises the first subset of disruption alerts and the second subset of disruption alerts; and

the processor-executable instructions to generate the quality grade for the one or more disruptors based on the disruptor SNR estimation of the one or more disruptors cause the one or more processors to further execute processor-executable instructions stored in the computer readable storage media to:

generate the quality grade for the one or more disruptors based on the first disruption classification and the second disruption classification.

17 . The non-transitory computer readable storage media of claim 15 , wherein the processor-executable instructions to determine the disruption classification for each of the plurality of disruption alerts cause the one or more processors to further execute processor-executable instructions stored in the computer readable storage media to:

determine a first disruption classification for a first subset of disruption alerts based on the first subset of disruption alerts exceeding a first threshold;

determine a second disruption classification for a second subset of disruption alerts based on the second subset of disruption alerts failing to meet a second threshold; and

determine a third disruption classification for a third subset of disruption alerts, wherein the third subset of disruption alerts fail to meet the first threshold and exceed the second threshold:

wherein the plurality of disruption alerts comprises the first subset of disruption alerts, the second subset of disruption alerts, and the third subset of disruption alerts.

18 . The non-transitory computer readable storage media of claim 15 , wherein the processor-executable instructions to determine the disruption classification for each of the plurality of disruption alerts cause the one or more processors to further execute processor-executable instructions stored in the computer readable storage media to:

determine an unknown disruption classification for a subset of disruption alerts based on the probability grades for the one or more disruption alerts in the subset of disruption alerts, wherein the plurality of disruption alerts comprises the subset of disruption alerts; and the; and

receive, from a plurality of machine learning (ML) models, a plurality of iteration probability grades for the subset of disruption alerts, wherein each ML model of the plurality of ML model generates a respective iteration probability grade based on the subset of disruption alerts.

19 . The non-transitory computer readable storage media of claim 15 , wherein the processor-executable instructions, cause the one or more processors to further execute processor-executable instructions stored in the computer readable storage media to:

train a machine learning (ML) model on a training dataset based on historical disruption alerts, wherein the training dataset comprises:

a plurality of disruption alert features; and

a plurality of alert responses;

test the ML model on an inference dataset, wherein the inference dataset is different from the training dataset; and

determine a threshold range for the disruption classification based on testing on the inference dataset.

20 . The non-transitory computer readable storage media of claim 15 , wherein the processor-executable instructions to determine the disruptor SNR for the one or more disruptors based on the disruption classification of the one or more disruption alerts cause the one or more processors to further execute processor-executable instructions stored in the computer readable storage media to:

determine a disruptor signal-to-noise ratio (SNR) estimation range for the one or more disruptors, wherein the disruptor SNR estimation range comprises a disruptor SNR lower bound and a disruptor SNR upper bound; and

generate a final verdict for each of the one or more disruptors based on the SNR estimation range.