Adaptive code construct generation for detecting identifiers in messages
A method and related system for generating new rules and patterns to detect identifiers includes operations to obtain a first set of messages comprising a set of identifiers and determining a labeled set of messages associated with a target identifier of the set of identifiers based on detected matches between the target identifier and text extracted from the first set of messages with a first construct. The method further includes determining a characterizing value based on the labeled set of messages and determining whether the set of characterizing values satisfies a set of criteria. The operations further include performing a search for the target identifier in a database of messages to retrieve a set of matching messages based on a result indicating that the set of characterizing values satisfies the set of criteria. The operations further include generating a second construct based on the set of matching messages.
1 . A system for facilitating dynamic detection of electronic messages corresponding to a target via model generation of identifier detection constructs triggered by incoming message structure drift over time, the system comprising one or more processors and one or more media storing program instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
in connection with a series of at least 10,000 incoming electronic messages, comprising identifiers corresponding with different platforms, that are obtained during a day, executing prestored construct program code associated with a target identifier of the identifiers on the series of at least 10,000 incoming electronic messages, wherein text segments matching the target identifier are extracted from the executing of the prestored construct program code to detect matching electronic messages corresponding to a match between the target identifier and the extracted text segments;
in response to an identifier composition change threshold being satisfied by a target-identifier-associated characterizing value derived from a ratio of a count of the matching electronic messages and a count of the series of incoming electronic messages, inputting a set of matching electronic messages matching the target identifier into a large language model to generate new model-generated construct program code;
executing the new model-generated construct program code on an additional series of at least 10,000 incoming electronic messages, wherein additional text segments matching the target identifier are extracted from the executing of the new model-generated construct program code to detect additional matching electronic messages corresponding to a match between the target identifier and the extracted additional text segments; and
storing, in an electronic database, an updated labeled set of electronic messages comprising the additional matching electronic messages and associated with the target identifier.
2 . The system of claim 1 , wherein the large language model comprises a transformer neural network trained on message-structured data and negative indications of constructs indicating a construct generation failure.
3 . The system of claim 1 , wherein the large language model combines outputs of multiple sub-models of the large language model, that are respectively trained on different message sources or platform types, to generate the new model-generated construct program code.
4 . The system of claim 1 , wherein executing the prestored construct program code associated with the target identifier comprises executing the prestored construct program code to apply a plurality of constructs to the series of at least 10,0000 incoming electronic messages, the executing of the prestored construct program code extracting matching text segments that each match the target identifier despite at least one of the matching text segments being extracted using a first construct and at least another one of the matching text segments being extracted using a second construct different from the first construct.
5 . A method comprising:
in connection with a first set of incoming electronic messages comprising identifiers corresponding with different platforms, executing first construct code associated with a target identifier of the identifiers on the first set of incoming electronic messages, wherein text segments matching the target identifier are extracted from the executing of the first construct code to detect matching electronic messages corresponding to a match between the target identifier and the extracted text segments;
based on an identifier composition change threshold being satisfied by a target-identifier-associated characterizing value derived from a ratio of a count of the matching electronic messages and a count of the first set of incoming electronic messages, inputting representations of a set of matching electronic messages corresponding to the target identifier into a machine learning model to generate second construct code;
executing the second construct code on a second set of incoming electronic messages, wherein additional text segments matching the target identifier are extracted from the executing of the second construct code to detect additional matching electronic messages corresponding to a match between the target identifier and the extracted additional text segments; and
storing, in an electronic database, an updated labeled set of electronic messages comprising the additional matching electronic messages and associated with the target identifier.
6 . The method of claim 5 , wherein the machine learning model comprises a language model including a transformer neural network trained on message-structured data and negative indications of constructs indicating a construct generation failure.
7 . The method of claim 5 , wherein the identifier composition change threshold comprises a rate-of-change value indicating a difference between (i) the ratio of the count of the matching electronic messages and the count of the first set of incoming electronic messages and (ii) a prior ratio associated with the target identifier.
8 . The method of claim 5 , wherein the machine learning model combines outputs of multiple sub-models of the machine learning model, that are respectively trained on different message sources or platform types, to generate the second construct code.
9 . The method of claim 5 , wherein the identifier composition change threshold is satisfied when the ratio of the count of the matching electronic messages to the count of the first set of incoming electronic messages is less than a predefined threshold value.
10 . The method of claim 5 , wherein the second construct code comprises tokenizing code configured to tokenize content of the second set of incoming electronic messages prior to detecting matches between the target identifier and the extracted additional text.
11 . The method of claim 5 , further comprising training the machine learning model with a training dataset comprising regular expressions and training messages associated with the regular expressions.
12 . The method of claim 5 , wherein executing the first construct code associated with the target identifier comprises executing the first construct code to apply a plurality of constructs to the first set of incoming electronic messages, the executing of the first construct code extracting matching text segments that each match the target identifier despite at least one of the matching text segments being extracted using a first construct and at least another one of the matching text segments being extracted using a second construct different from the first construct.
13 . One or more non-transitory machine-readable media storing instructions that, when executed by one or more processors, perform operations comprising:
in connection with a first set of incoming electronic messages comprising identifiers corresponding with different platforms, executing first construct code associated with a target identifier of the identifiers on the first set of incoming electronic messages, wherein text segments matching the target identifier are extracted from the executing of the first construct code to detect matching electronic messages corresponding to a match between the target identifier and the extracted text segments;
based on an identifier composition change threshold being satisfied by a target-identifier-associated characterizing value derived from a ratio of a count of the matching electronic messages and a count of the first set of incoming electronic messages, inputting representations of a set of matching electronic messages corresponding to the target identifier into a machine learning model to generate second construct code;
executing the second construct code on a second set of incoming electronic messages, wherein additional text segments matching the target identifier are extracted from the executing of the second construct code to detect additional matching electronic messages corresponding to a match between the target identifier and the extracted additional text segments; and
storing, in an electronic database, an updated labeled set of electronic messages comprising the additional matching electronic messages and associated with the target identifier.
14 . The one or more non-transitory machine-readable media of claim 13 , wherein the machine learning model comprises a language model including a transformer neural network trained on message-structured data and negative indications of constructs indicating a construct generation failure.
15 . The one or more non-transitory machine-readable media of claim 13 , wherein the identifier composition change threshold comprises a rate-of-change value indicating a difference between (i) the ratio of the count of the matching electronic messages and the count of the first set of incoming electronic messages and (ii) a prior ratio associated with the target identifier.
16 . The one or more non-transitory machine-readable media of claim 13 , wherein the machine learning model combines outputs of multiple sub-models of the machine learning model, that are respectively trained on different message sources or platform types, to generate the second construct code.
17 . The one or more non-transitory machine-readable media of claim 13 , wherein the identifier composition change threshold is satisfied when the ratio of the count of the matching electronic messages to the count of the first set of incoming electronic messages is less than a predefined threshold value.
18 . The one or more non-transitory machine-readable media of claim 13 , wherein the second construct code comprises tokenizing code configured to tokenize content of the second set of incoming electronic messages prior to detecting matches between the target identifier and the extracted additional text.
19 . The one or more non-transitory machine-readable media of claim 13 , further comprising training the machine learning model with a training dataset comprising regular expressions and training messages associated with the regular expressions.
20 . The one or more non-transitory machine-readable media of claim 13 , wherein executing the first construct code associated with the target identifier comprises executing the first construct code to apply a plurality of constructs to the first set of incoming electronic messages, the executing of the first construct code extracting matching text segments that each match the target identifier despite at least one of the matching text segments being extracted using a first construct and at least another one of the matching text segments being extracted using a second construct different from the first construct.