Methods and systems for cyber threat detection using artificial intelligence models in data-sparse environments
Methods and systems comprising a first portion of a model that includes a model component that is trained to perform sentiment analysis based on training data for a plurality of users (e.g., what language, phrases, and/or responses the population at large uses). The first portion of the model also includes a model component that is trained to identify user intent based on the sentiment analysis that is specific to user groups. For example, the system first determines the likely context and/or meaning of communications of the user. The system then determines a likely intent of the user based on the likely context and/or meaning of communications (e.g., based on a correlation of the meaning of communications of the user and the intents of users corresponding to a user group of the user).
1 . A system for generating cyber incident responses using artificial intelligence models in data-sparse environments, the system comprising:
one or more processors; and
a non-transitory, computer-readable medium comprising instructions that, when executed by the one or more processors, cause operations comprising:
receiving user profile data, wherein the user profile data comprises electronically transmitted content that is generated by a user and a user characteristic for the user, and wherein the user characteristic comprises demographic information about the user;
generating, based on the user profile data, a first feature input;
inputting the first feature input into a first model component of an artificial intelligence model to generate a first output, wherein the first model component comprises a neural network that is trained to predict a plurality of user intents based on the user characteristic, and a respective probability for each of the plurality of user intents based on a semantic analysis;
receiving user interaction data, wherein the user interaction data comprises time series data indicating an interaction rate of the user with a user device as a function of time;
generating, based on the user interaction data, a second feature input;
inputting the second feature input into a second model component of the artificial intelligence model to generate a second output, wherein the second model component comprises a machine learning model that is trained to generate user engagement metrics for users based on interaction rates of users; and
determining a cyber incident probability based on the first output and the second output.
2 . A method for generating incident responses using artificial intelligence models in data-sparse environments, the method comprising:
receiving user profile data, wherein the user profile data comprises content generated by a user and a user characteristic for the user;
inputting the user profile data into a first model component of an artificial intelligence model to generate a first output, wherein the first model component comprises a neural network that is trained to predict a plurality of user intents based on the user characteristic, and a respective probability for each of the plurality of user intents based on a semantic analysis of the content;
receiving user interaction data, wherein the user interaction data comprises time series data indicating an interaction rate of the user with a user device as a function of time;
inputting the user interaction data into a second model component of the artificial intelligence model to generate a second output, wherein the second model component comprises a machine learning model that is trained to generate user engagement metrics for users based on interaction rates of users; and
generating for display, in a user interface, an incident response based on the first output and the second output.
3 . The method of claim 2 , further comprising:
determining a content characteristic for the content generated by the user; and
determining a content map for the content generated by the user comprising a vector array of values indicative of the content map and the content characteristic.
4 . The method of claim 2 , further comprising:
determining a first number of user interactions over a first time period;
determining a second number of user interactions over a second time period; and
determining the interaction rate based on the first number and the second number.
5 . The method of claim 2 , wherein generating for display the incident response based on the first output and the second output further comprises:
determining an incident probability based on the first output and the second output;
comparing the incident probability to a threshold incident probability;
in response to comparing the incident probability to the threshold incident probability, determining that the incident probability corresponds to the threshold incident probability; and
in response to determining that the incident probability corresponds to the threshold incident probability, determining to generate for display the incident response.
6 . The method of claim 2 , wherein generating for display the incident response based on the first output and the second output further comprises:
inputting the first output and the second output into a third model component, wherein the third model component is trained to determine types of incidents;
receiving a third output from the third model component;
determining a type of incident based on the third output; and
selecting the incident response from a plurality of incident responses based on the type.
7 . The method of claim 2 , wherein generating for display the incident response based on the first output and the second output further comprises:
inputting the second output into a third model component to generate a third output, wherein the third model component comprises multi-modal stacking; and
selecting the incident response from a plurality of incident responses based on the third output.
8 . The method of claim 2 , wherein generating for display the incident response based on the first output and the second output further comprises:
inputting the first output and the second output into a third model component, wherein the third model component is trained to determine weighted averages for inputs;
determining a third output based on a weighted average of the first output and the second output; and
selecting the incident response from a plurality of incident responses based on the third output.
9 . The method of claim 2 , wherein the first model component is trained on top of pre-trained word vectors for sentence-level classification tasks.
10 . The method of claim 2 , further comprising:
receiving training data, wherein the training data comprises user characteristics labeled with corresponding use intents; and
training the first model component based on the training data.
11 . The method of claim 2 , wherein the first output comprises a multi-class classification for the plurality of user intents, and wherein the respective probability for each of the plurality of user intents based on the semantic analysis of the content comprises a probability value between 0 and 1.
12 . A non-transitory, computer-readable medium comprising instructions that, when executed by one or more processors, cause operations comprising:
receiving user profile data, wherein the user profile data comprises content generated by a user and a user characteristic for the user;
inputting the user profile data into a first model component of an artificial intelligence model to generate a first output, wherein the first model component comprises a neural network that is trained to predict a plurality of user intents based on the user characteristic, and a respective probability for each of the plurality of user intents based on a semantic analysis of the content;
receiving user interaction data, wherein the user interaction data comprises time series data indicating an interaction rate of the user with a user device as a function of time;
inputting the user interaction data into a second model component of the artificial intelligence model to generate a second output, wherein the second model component comprises a machine learning model that is trained to generate user engagement metrics for users based on interaction rates of users; and
generating for display, in a user interface, a response based on the first output and the second output.
13 . The non-transitory, computer-readable medium of claim 12 , further comprising:
determining a content characteristic for the content generated by the user; and
determining a content map for the content generated by the user comprising a vector array of values indicative of the content map and the content characteristic.
14 . The non-transitory, computer-readable medium of claim 12 , wherein the instructions further cause operations comprising:
determining a first number of user interactions over a first time period;
determining a second number of user interactions over a second time period; and
determining the interaction rate based on the first number and the second number.
15 . The non-transitory, computer-readable medium of claim 12 , wherein generating for display the response based on the first output and the second output further comprises:
determining a probability based on the first output and the second output;
comparing the probability to a threshold probability;
in response to comparing the probability to the threshold probability, determining that the probability corresponds to the threshold probability; and
in response to determining that the probability corresponds to the threshold probability, determining to generate for display the response.
16 . The non-transitory, computer-readable medium of claim 12 , wherein generating for display the response based on the first output and the second output further comprises:
inputting the first output and the second output into a third model component, wherein the third model component is trained to determine types of incidents;
receiving a third output from the third model component;
determining a type of incident based on the third output; and
selecting the response from a plurality of responses based on the type.
17 . The non-transitory, computer-readable medium of claim 12 , wherein generating for display the response based on the first output and the second output further comprises:
inputting the second output into a third model component to generate a third output, wherein the third model component comprises multi-modal stacking; and
selecting the response from a plurality of responses based on the third output.
18 . The non-transitory, computer-readable medium of claim 12 , wherein generating for display the response based on the first output and the second output further comprises:
inputting the first output and the second output into a third model component, wherein the third model component is trained to determine weighted averages for inputs;
determining a third output based on a weighted average of the first output and the second output; and
selecting the response from a plurality of responses based on the third output.
19 . The non-transitory, computer-readable medium of claim 12 , wherein the first model component is trained on top of pre-trained word vectors for sentence-level classification tasks.
20 . The non-transitory, computer-readable medium of claim 12 , wherein the instructions further cause operations comprising:
receiving training data, wherein the training data comprises user characteristics labeled with corresponding use intents; and
training the first model component based on the training data.