Automated generation of adaptive policies from organizational data for detection of risk-related events

1. A method, comprising:

extracting a plurality of features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises one or more of a discrete value of the given feature and a range of values for the given feature;

obtaining a probability of occurrence associated with each data value based on the organization data;

identifying, using at least one processing device, a plurality of candidate anomalous data values based on the probabilities of occurrence;

determining, using at least one processing device, an intervention rate for a plurality of combinations of the candidate anomalous data values;

automatically generating, using at least one processing device, one or more policies for the organization using one or more of the combinations of candidate anomalous data values based on a corresponding intervention rate, wherein the one or more policies are used to detect one or more risk-related events associated with user transactions of the organization;

initiating, based on the one or more policies, a generation of at least one authentication challenge for at least one of the user transactions; and

transitioning from the one or more generated policies to a risk engine based on estimated risk detection rates of the risk engine and the one or more generated policies, wherein the risk engine is trained using a supervised machine learning technique.

2. The method of claim 1 , further comprising the step of combining two or more of the identified features into a multi-dimensional feature.

3. The method of claim 1 , further comprising the step of discretizing one or more continuous features into said range of values for the one or more continuous features.

4. The method of claim 1 , wherein the identifying step further comprises the step of comparing the probabilities of occurrence to a predefined anomaly threshold.

5. The method of claim 1 , wherein the generating step further comprises the step of selecting a given combination of candidate anomalous data values when the corresponding intervention rate satisfies a predefined intervention rate threshold.

6. The method of claim 1 , wherein the generating step further comprises the step of selecting a combination of the candidate anomalous data values having a smallest number of features.

7. The method of claim 1 , further comprising the step of assessing a performance of the one or more generated policies.

8. A system, comprising:

a memory; and

at least one processing device, coupled to the memory, operative to implement the following steps:

obtaining a plurality of features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises one or more of a discrete value of the given feature and a range of values for the given feature;

obtaining a probability of occurrence associated with each data value based on the organization data;

identifying a plurality of candidate anomalous data values based on the probabilities of occurrence;

determining an intervention rate for a plurality of combinations of the candidate anomalous data values;

automatically generating one or more policies for the organization using one or more of the combinations of candidate anomalous data values based on a corresponding intervention rate, wherein the one or more policies are used to detect one or more risk-related events associated with user transactions of the organization;

initiating, based on the one or more policies, a generation of at least one authentication challenge for at least one of the user transactions; and

transitioning from the one or more generated policies to a risk engine based on estimated risk detection rates of the risk engine and the one or more generated policies, wherein the risk engine is trained using a supervised machine learning technique.

9. The system of claim 8 , wherein the identifying step further comprises the step of comparing the probabilities of occurrence to a predefined anomaly threshold.

10. The system of claim 8 , wherein the generating step further comprises the step of selecting a given combination of candidate anomalous data values when the corresponding intervention rate satisfies a predefined intervention rate threshold.

11. The system of claim 8 , wherein the generating step further comprises the step of selecting a combination of the candidate anomalous data values having a smallest number of features.

12. The system of claim 8 , further comprising the step of assessing a performance of the one or more generated policies.

13. A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

extracting a plurality of features identified in organization data of an organization for a risk analysis, wherein a given feature comprises a plurality of data values, wherein each data value for the given feature comprises one or more of a discrete value of the given feature and a range of values for the given feature;

obtaining a probability of occurrence associated with each data value based on the organization data;

identifying a plurality of candidate anomalous data values based on the probabilities of occurrence;

determining an intervention rate for a plurality of combinations of the candidate anomalous data values;

automatically generating one or more policies for the organization using one or more of the combinations of candidate anomalous data values based on a corresponding intervention rate, wherein the one or more policies are used to detect one or more risk-related events associated with user transactions of the organization;

initiating, based on the one or more policies, a generation of at least one authentication challenge for at least one of the user transactions; and

transitioning from the one or more generated policies to a risk engine based on estimated risk detection rates of the risk engine and the one or more generated policies, wherein the risk engine is trained using a supervised machine learning technique.

14. The computer program product of claim 13 , wherein the identifying step further comprises the step of comparing the probabilities of occurrence to a predefined anomaly threshold.

15. The computer program product of claim 13 , wherein the generating step further comprises the step of selecting a given combination of candidate anomalous data values when the corresponding intervention rate satisfies a predefined intervention rate threshold.

16. The computer program product of claim 13 , wherein the generating step further comprises the step of selecting a combination of the candidate anomalous data values having a smallest number of features.

17. The computer program product of claim 13 , further comprising the step of assessing a performance of the one or more generated policies.

18. The method of claim 1 , further comprising the step of initiating, based on the risk engine, a generation of at least one additional authentication challenge for at least another one of the user transactions.

19. The method of claim 1 , wherein said transitioning comprises setting a ratio of authentication challenges generated based on the one or more policies for the user transactions to authentical challenges generated based on the risk engine for the user transactions.

20. The method of claim 1 , wherein said transitioning comprises gradually increasing the percentage of the authentication challenges generated based on the risk engine relative to the authentication challenges based on the one or more policies.