Detection of operational threats using artificial intelligence

1. A system comprising:

one or more data processors; and

a non-transitory computer readable storage medium containing instructions which, when executed on the one or more data processors, cause the one or more data processors to perform actions including:

detecting receipt of a first set of resource requests, wherein each resource request of the first set of resource requests was received from a user device of a plurality of user devices, wherein resource requests correspond to a claim on an insurance policy and include:

an identification of a requested resource, the requested resource being a particular amount of payment for one or more previous medical-service events; and

authorization-supporting data for receiving the requested resource, wherein the authorization-supporting data includes one or more characterizing parameters that characterize the one or more previous medical-service events;

for each resource request of the first set of resource requests:

retrieving, from a data source or data structure that is separate from the plurality of user devices from which the first set of resource requests were received, augmenting data by executing a database look-up using a particular characterizing parameter of the one or more characterizing parameters included in the resource request, wherein identifies an entity that performed the one or more previous medical-service events identified by the resource request, and wherein the augmenting data includes an identification of one or more additional resource requests that are associated with a same entity; and

generating a representation of the resource request that includes a set of key-value pairs, wherein each of at least some of the set of key-value pairs includes a value extracted from or derived from the resource request;

training a machine-learning model using the representations of the first set of resource requests and augmenting-based data that includes or is derived from the augmenting data, wherein the trained machine-learning model includes a dependency between one or more first keys identified in the set of key-value pairs and an output;

receiving a second set of resource requests after the first set of resource requests, wherein each resource request of the second set of resource requests was received from a user device of the plurality of user devices, and wherein each resource request of the second set of resource requests does not include an authorization output;

processing, for each resource request of the second set of resource requests, a representation of the resource request using the trained machine-learning model to generate an authorization output;

identifying, based on a population analysis of the authorization outputs, one or more identifiers to flag for inhibition of resource access, wherein the one or more identifiers do not correspond to the one or more first keys;

detecting that a new resource request includes an identifier of the one or more identifiers, wherein the new resource request identifies a particular resource and corresponds to a particular medical-service provider; and

generating a new authorization output for the new resource request, wherein release of the new authorization output results in inhibiting the particular medical-service provider from access the particular resource.

2. The system of claim 1 , wherein the actions further include, for each resource request of the set of resource requests, determining whether access to the requested resource was authorized based on predefined access criteria;

wherein training of the machine-learning model is further based on indications of whether corresponding access to the requested resources were determined to be authorized.

3. The system of claim 1 , wherein, for a resource request of the at least one of the set of resource requests, the augmenting data includes one or more statistics generated based on multiple previously processed resource requests, wherein each of the multiple previously processed resource requests includes at least one of the one or more charactering parameters included in the resource request.

4. The system of claim 1 , wherein, for a resource request of the at least one of the set of resource requests, the augmenting data includes a threshold for a stereotyped request pattern corresponding to the one or more previous medical-service events or a series of previous medical-service events that includes the one or more previous medical-service events.

5. The system of claim 1 , wherein, for each other resource request of a subset of the other set of resource requests, the authorization output indicates that access to a given resource requested in the other resource request is to be inhibited, and wherein the actions further include:

inhibiting, for each other resource request of the other set of resource requests, access to the given resource by queuing the other resource request for additional processing and information retrieval.

6. The system of claim 1 , wherein the training the machine-learning model is further based on the augmenting data retrieved for the set of resource requests.

7. The system of claim 1 , wherein training the machine-learning model includes generating a set of components, wherein each component of the set of components includes a set of weights corresponding to keys in the set of key-value pairs generated for the set of resource requests.

8. The system of claim 1 , wherein processing, for each other resource request in the other set of resource requests, the other representation of the other resource request includes assigning the other resource request to one of multiple clusters, wherein each of the multiple clusters is associated with a different authorization output.

9. The system of claim 1 , wherein, for each other resource request in the other set of resource requests, processing the other representation of the other resource request is further based on the augmenting data.

10. A computer-implemented method comprising:

detecting receipt of a first set of resource requests, wherein each resource request of the first set of resource requests was received from a user device of a plurality of user devices, wherein resource requests correspond to a claim on an insurance policy and include:

an identification of a requested resource, the requested resource being a particular amount of payment for one or more previous medical-service events; and

authorization-supporting data for receiving the requested resource, wherein the authorization-supporting data includes one or more characterizing parameters that characterize the one or more previous medical-service events;

for each resource request of the set of resource requests:

retrieving, from a data source or data structure that is separate from the plurality of user devices from which the first set of resource requests were received, augmenting data by executing a database look-up using a particular characterizing parameter of the one or more characterizing parameters included in the resource request, wherein the augmenting data identifies an entity that performed the one or more previous medical-service events identified by the resource request, and wherein the augmenting data includes an identification of one or more additional resource requests that are associated with a same entity; and

generating a representation of the resource request that includes a set of key-value pairs, wherein each of at least some of the set of key-value pairs includes a value extracted from or derived from the resource request;

training a machine-learning model using the representations of the first set of resource requests and augmenting-based data that includes or is derived from the augmenting data, wherein the trained machine-learning model includes a dependency between one or more first keys identified in the set of key-value pairs and an output;

receiving a second set of resource requests after the first set of resource requests, wherein each resource request of the second set of resource requests was received from a user device of the plurality of user devices, and wherein each resource request of the second set of resource requests does not include an authorization output;

processing, for each resource request of the second set of resource requests, a representation of the resource request using the trained machine-learning model to generate an authorization output;

identifying, based on a population analysis of the authorization outputs, one or more identifiers to flag for inhibition of resource access, wherein the one or more identifiers do not correspond to the one or more first keys;

detecting that a new resource request includes an identifier of the one or more identifiers, wherein the new resource request identifies a particular resource and corresponds to a particular medical-service provider; and

generating a new authorization output for the new resource request, wherein release of the new authorization output results in inhibiting the particular medical-service provider from access the particular resource.

11. The computer-implemented method of claim 10 , further comprising, for each resource request of the set of resource requests, determining whether access to the requested resource was authorized based on predefined access criteria;

wherein training of the machine-learning model is further based on indications of whether corresponding access to the requested resources were determined to be authorized.

12. The computer-implemented method of claim 10 , wherein, for a resource request of the at least one of the set of resource requests, the augmenting data includes one or more statistics generated based on multiple previously processed resource requests, wherein each of the multiple previously processed resource requests includes at least one of the one or more charactering parameters included in the resource request.

13. The computer-implemented method of claim 10 , wherein, for a resource request of the at least one of the set of resource requests, the augmenting data includes a threshold for a stereotyped request pattern corresponding to the one or more previous medical-service events or a series of previous medical-service events that includes the one or more previous medical-service events.

14. The computer-implemented method of claim 10 , wherein, for each other resource request of a subset of the other set of resource requests, the authorization output indicates that access to a given resource requested in the other resource request is to be inhibited, and wherein the method further includes:

inhibiting, for each other resource request of the other set of resource requests, access to the given resource by queuing the other resource request for additional processing and information retrieval.

15. The computer-implemented method of claim 10 , wherein the training the machine-learning model is further based on the augmenting data retrieved for the set of resource requests.

16. The computer-implemented method of claim 10 , wherein training the machine-learning model includes generating a set of components, wherein each component of the set of components includes a set of weights corresponding to keys in the set of key-value pairs generated for the set of resource requests.

17. The computer-implemented method of claim 10 , wherein processing, for each other resource request in the other set of resource requests, the other representation of the other resource request includes assigning the other resource request to one of multiple clusters, wherein each of the multiple clusters is defined based on at least part of the one or more parameters and is associated with a different authorization output.

18. The computer-implemented method of claim 10 , wherein, for each other resource request in the other set of resource requests, processing the other representation of the other resource request is further based on the augmenting data.

19. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause one or more data processors to perform actions including:

detecting receipt of a first set of resource requests, wherein each resource request of the first set of resource requests was received from a user device of a plurality of user devices, wherein resource requests correspond to a claim on an insurance policy and include:

an identification of a requested resource, the requested resource being a particular amount of payment for one or more previous medical-service events; and

authorization-supporting data for receiving the requested resource, wherein the authorization-supporting data includes one or more characterizing parameters that characterize the one or more previous medical-service events;

for each resource request of the first set of resource requests:

retrieving, from a data source or data structure that is separate from the plurality of user devices from which the first set of resource requests were received, augmenting data by executing a database look-up using a particular characterizing parameter of the one or more characterizing parameters included in the resource request, wherein the augmenting data identifies an entity that performed the one or more previous medical-service events identified by the resource request, and wherein the augmenting data includes an identification of one or more additional resource requests that are associated with a same entity; and

generating a representation of the resource request that includes a set of key-value pairs, wherein each of at least some of the set of key-value pairs includes a value extracted from or derived from the resource request;

training a machine-learning model using the representations of the first set of resource requests and augmenting-based data that includes or is derived from the augmenting data, wherein the trained machine-learning model includes a dependency between one or more first keys identified in the set of key-value pairs and an output;

receiving a second set of resource requests after the first set of resource requests, wherein each resource request of the second set of resource requests was received from a user device of the plurality of user devices, and wherein each resource request of the second set of resource requests does not include an authorization output;

processing, for each resource request of the second set of resource requests, a representation of the resource request using the trained machine-learning model to generate an authorization output;

identifying, based on a population analysis of the authorization outputs, one or more identifiers to flag for inhibition of resource access, wherein the one or more identifiers do not correspond to the one or more first keys;

detecting that a new resource request includes an identifier of the one or more identifiers, wherein the new resource request identifies a particular resource and corresponds to a particular medical-service provider; and

generating a new authorization output for the new resource request, wherein release of the new authorization output results in inhibiting the particular medical-service provider from access the particular resource.

20. The computer-program product of claim 19 , further comprising, for each resource request of the set of resource requests, determining whether access to the requested resource was authorized based on predefined access criteria;

wherein training of the machine-learning model is further based on indications of whether corresponding access to the requested resources were determined to be authorized.