120, the first user device may send the notification to the security system. For example, the first user device may send the notification to a host server of a network, which may send the notification to the security system.

As shown in FIG. 1C, and by reference number 125, the security system may determine that the account of the user of the first user device may be subject to an unauthorized access attempt. For example, the security system may process (e.g., parse) the notification to determine that the account may be subject to an unauthorized access attempt.

As shown by reference number 130, the security system may modify one or more security parameters associated with the account (e.g., based on determining that the account may be subject to the unauthorized access attempt). For example, the security system may cause an authentication credential reset procedure associated with the account to be initiated (e.g., prevent a current authentication credential from being used to access the account and send a message, such as an email, to an electronics communication account associated with the user that includes a URL address to reset the current authentication credential). As another example, the security system may cause a stepped-up authentication flag associated with the account to be set. In some implementations, when the stepped-up authentication flag is set, the user must provide different and/or additional authentication credentials to access the account.

In some implementations, after modifying the one or more security parameters associated with the account, the security system may send a message, such as an email, to an electronic messaging account associated with the user. The message may include information indicating modification of the one or more security parameters associated with the account and/or the particular information (e.g., to indicate a reason to the user for modification of the one or more security parameters associated with the account).

As shown in FIG. 1D, and by reference number 135, a particular user device, of the one or more user devices (e.g., the first through M^thuser devices), may send a request to the security system (e.g., after the one or more security parameters associated with the account have been modified). For example, the particular user device may send the request to the host server of the network, which may send the request to the security system. The request may be for access to the account (e.g., of the user of the first user device).

As shown in FIG. 1E, and by reference number 140, the security system may communicate with the particular user device (e.g., based on the modified one or more security parameters). For example, when the stepped-up authentication flag is set (e.g., as caused by the security system, described herein in relation to FIG. 1C), the security may communicate with the particular user device to obtain different and/or additional authentication credentials (e.g., than would be obtained if the stepped-up authentication flag were not set). Accordingly, as shown by reference number 145, the security system may grant or deny access to the account by the particular device (e.g., based on communicating with the particular device). For example, the security system may process (e.g., using one or more authentication techniques) the different and/or additional authentication credentials to make an authentication determination and may grant or deny access to the account based on the authentication determination. The security system may grant access to the account based on a positive authentication determination (e.g., the security system determined that the different and/or additional authentication credentials are valid) and/or may deny access to the account based on a negative authentication determination (e.g., the security system determined that the different and/or additional authentication credentials are invalid). Accordingly, when the security system grants access to the account, the particular user device is able to access and interact with the account. Alternatively, when the security system denies access to the account, the particular user device is unable to access and interact with the account.

As shown in FIG. 1F, the security system may determine (e.g., after modifying the one or more security parameters associated with the account, as described herein in relation to FIG. 1C), an amount of time that has elapsed since the one or more security parameters were modified. Accordingly, as shown by reference number 150, the security system may determine whether the amount of time satisfies (e.g., is greater than or equal to) a time threshold, which may be greater than or equal to 5 hours, 12 hours, a day, a week, or a month, among other examples. As shown by reference number 155, when the security system determines that the amount of time satisfies the time threshold, the security system may modify the one or more security parameters associated with the account (e.g., that were previously modified by the security system). For example, the security system may modify the one or more security parameters to have “original” values or settings (e.g., prior to modifying the one or more security parameters associated with the account, as described herein in relation to FIG. 1C). Alternatively, when the security system determines that the amount of time does not satisfy the time threshold, the security system may prevent modification of the one or more security parameters associated with the account.

As indicated above, FIGS. 1A-1F are provided as an example. In practice, there may be additional devices and/or networks, fewer devices and/or networks, different devices and/or networks, or differently arranged devices and/or networks than those shown in FIGS. 1A-1F. Furthermore, two or more devices shown in FIGS. 1A-1F may be implemented within a single device, or a single device shown in FIGS. 1A-1F may be implemented as multiple, distributed devices. Additionally, or alternatively, a set of devices (e.g., one or more devices) of one or more examples 100 may perform one or more functions described as being performed by another set of devices of one or more examples 100. For example, the user device may perform one or more functions described as being performed by the security system, or vice versa.

FIG. 2 is a diagram illustrating an example 200 of training and using a machine learning model in connection with processing an input stream of a user device to facilitate security associated with an account of a user of the user device. The machine learning model training and usage described herein may be performed using a machine learning system. The machine learning system may include or may be included in a computing device, a server, a cloud computing environment, or the like, such as the first user device and/or the security system described in more detail elsewhere herein.

As shown by reference number 205, a machine learning model may be trained using a set of observations. The set of observations may be obtained from training data (e.g., historical data), such as data gathered during one or more processes described herein. In some implementations, the machine learning system may receive the set of observations (e.g., as input) from the first user device and/or the security system, as described elsewhere herein.

As shown by reference number 210, the set of observations includes a feature set. The feature set may include a set of variables, and a variable may be referred to as a feature. A specific observation may include a set of variable values (or feature values) corresponding to the set of variables. In some implementations, the machine learning system may determine variables for a set of observations and/or variable values for a specific observation based on input received from the first user device and/or the security system. For example, the machine learning system may identify a feature set (e.g., one or more features and/or feature values) by extracting the feature set from structured data, by performing natural language processing to extract the feature set from unstructured data, and/or by receiving input from an operator.

As an example, a feature set for a set of observations may include a first feature of string 1, a second feature of string 2, a third feature of string 3, and so on (e.g., that are associated with an input stream). As shown, for a first observation, the first feature may have a value of “John”, the second feature may have a value of “W.”, the third feature may have a value of “Doe”, and so on. These features and feature values are provided as examples, and may differ in other examples. For example, the feature set may include one or more cryptographic values (e.g., that are associated with the input stream).

As shown by reference number 215, the set of observations may be associated with a target variable. The target variable may represent a variable having a numeric value, may represent a variable having a numeric value that falls within a range of values or has some discrete possible values, may represent a variable that is selectable from one of multiple options (e.g., one of multiples classes, classifications, or labels) and/or may represent a variable having a Boolean value. A target variable may be associated with a target variable value, and a target variable value may be specific to an observation. In example 200, the target variable is information identification, which has a value of personal information for the first observation.

The target variable may represent a value that a machine learning model is being trained to predict, and the feature set may represent the variables that are input to a trained machine learning model to predict a value for the target variable. The set of observations may include target variable values so that the machine learning model can be trained to recognize patterns in the feature set that lead to a target variable value. A machine learning model that is trained to predict a target variable value may be referred to as a supervised learning model.

In some implementations, the machine learning model may be trained on a set of observations that do not include a target variable. This may be referred to as an unsupervised learning model. In this case, the machine learning model may learn patterns from the set of observations without labeling or supervision, and may provide output that indicates such patterns, such as by using clustering and/or association to identify related groups of items within the set of observations.

As shown by reference number 220, the machine learning system may train a machine learning model using the set of observations and using one or more machine learning algorithms, such as a regression algorithm, a decision tree algorithm, a neural network algorithm, a k-nearest neighbor algorithm, a support vector machine algorithm, or the like. After training, the machine learning system may store the machine learning model as a trained machine learning model 225 to be used to analyze new observations.

As shown by reference number 230, the machine learning system may apply the trained machine learning model 225 to a new observation, such as by receiving a new observation and inputting the new observation to the trained machine learning model 225. As shown, the new observation may include a first feature of “@bcdef1234$” as an example. The machine learning system may apply the trained machine learning model 225 to the new observation to generate an output (e.g., a result). The type of output may depend on the type of machine learning model and/or the type of machine learning task being performed. For example, the output may include a predicted value of a target variable, such as when supervised learning is employed. Additionally, or alternatively, the output may include information that identifies a cluster to which the new observation belongs and/or information that indicates a degree of similarity between the new observation and one or more other observations, such as when unsupervised learning is employed.

As an example, the trained machine learning model 225 may predict a value of authentication credential for the target variable of information identification for the new observation, as shown by reference number 235. Based on this prediction, the machine learning system may provide a first recommendation, may provide output for determination of a first recommendation, may perform a first automated action, and/or may cause a first automated action to be performed (e.g., by instructing another device to perform the automated action), among other examples. The first recommendation may include, for example, a recommendation to notify the security system of the predicted value. The first automated action may include, for example, sending a notification that includes the predicted value to the security system.

In some implementations, the trained machine learning model 225 may classify (e.g., cluster) the new observation in a cluster, as shown by reference number 240. The observations within a cluster may have a threshold degree of similarity. As an example, if the machine learning system classifies the new observation in a first cluster (e.g., authentication credentials), then the machine learning system may provide a first recommendation, such as the first recommendation described above. Additionally, or alternatively, the machine learning system may perform a first automated action and/or may cause a first automated action to be performed (e.g., by instructing another device to perform the automated action) based on classifying the new observation in the first cluster, such as the first automated action described above.

As another example, if the machine learning system were to classify the new observation in a second cluster (e.g., potentially malicious URL addresses), then the machine learning system may provide a second recommendation (e.g., that is the same as or different from the first recommendation) and/or may perform or cause performance of a second automated action (e.g., that is the same as different from the first action).

In some implementations, the recommendation and/or the automated action associated with the new observation may be based on a target variable value having a particular label (e.g., classification or categorization), may be based on whether a target variable value satisfies one or more threshold (e.g., whether the target variable value is greater than a threshold, is less than a threshold, is equal to a threshold, falls within a range of threshold values, or the like), and/or may be based on a cluster in which the new observation is classified.

In this way, the machine learning system may apply a rigorous and automated process to determine whether an input stream includes particular information. The machine learning system enables recognition and/or identification of tens, hundreds, thousands, or millions of features and/or feature values for tens, hundreds, thousands, or millions of observations, thereby increasing accuracy and consistency and reducing delay associated with determining whether an input stream includes particular information relative to requiring computing resources to be allocated for tens, hundreds, or thousands of operators to manually determine whether an input stream includes particular information using the features or feature values.

As indicated above, FIG. 2 is provided as an example. Other examples may differ from what is described in connection with FIG. 2.

FIG. 3 is a diagram of an example environment 300 in which systems and/or methods described herein may be implemented. As shown in FIG. 3, environment 300 may include a security system 301, which may include one or more elements of and/or may execute within a cloud computing system 302. The cloud computing system 302 may include one or more elements 303-213, as described in more detail below. As further shown in FIG. 3, environment 300 may include a network 320, a host server 330, and/or one or more user devices 340. Devices and/or elements of environment 300 may interconnect via wired connections and/or wireless connections.

The cloud computing system 302 includes computing hardware 303, a resource management component 304, a host operating system (OS) 305, and/or one or more virtual computing systems 306. The cloud computing system 302 may execute on, for example, an Amazon Web Services platform, a Microsoft Azure platform, or a Snowflake platform. The resource management component 304 may perform virtualization (e.g., abstraction) of computing hardware 303 to create the one or more virtual computing systems 306. Using virtualization, the resource management component 304 enables a single computing device (e.g., a computer or a server) to operate like multiple computing devices, such as by creating multiple isolated virtual computing systems 306 from computing hardware 303 of the single computing device. In this way, computing hardware 303 can operate more efficiently, with lower power consumption, higher reliability, higher availability, higher utilization, greater flexibility, and lower cost than using separate computing devices.

Computing hardware 303 includes hardware and corresponding resources from one or more computing devices. For example, computing hardware 303 may include hardware from a single computing device (e.g., a single server) or from multiple computing devices (e.g., multiple servers), such as multiple computing devices in one or more data centers. As shown, computing hardware 303 may include one or more processors 307, one or more memories 308, one or more storage components 309, and/or one or more networking components 310. Examples of a processor, a memory, a storage component, and a networking component (e.g., a communication component) are described elsewhere herein.

The resource management component 304 includes a virtualization application (e.g., executing on hardware, such as computing hardware 303) capable of virtualizing computing hardware 303 to start, stop, and/or manage one or more virtual computing systems 306. For example, the resource management component 304 may include a hypervisor (e.g., a bare-metal or Type 1 hypervisor, a hosted or Type 3 hypervisor, or another type of hypervisor) or a virtual machine monitor, such as when the virtual computing systems 306 are virtual machines 311. Additionally, or alternatively, the resource management component 304 may include a container manager, such as when the virtual computing systems 306 are containers 312. In some implementations, the resource management component 304 executes within and/or in coordination with a host operating system 305.

A virtual computing system 306 includes a virtual environment that enables cloud-based execution of operations and/or processes described herein using computing hardware 303. As shown, a virtual computing system 306 may include a virtual machine 311, a container 312, or a hybrid environment 313 that includes a virtual machine and a container, among other examples. A virtual computing system 306 may execute one or more applications using a file system that includes binary files, software libraries, and/or other resources required to execute applications on a guest operating system (e.g., within the virtual computing system 306) or the host operating system 305.

Although the security system 301 may include one or more elements 303-213 of the cloud computing system 302, may execute within the cloud computing system 302, and/or may be hosted within the cloud computing system 302, in some implementations, the security system 301 may not be cloud-based (e.g., may be implemented outside of a cloud computing system) or may be partially cloud-based. For example, the security system 301 may include one or more devices that are not part of the cloud computing system 302, such as device 400 of FIG. 4, which may include a standalone server or another type of computing device. The security system 301 may perform one or more operations and/or processes described in more detail elsewhere herein.

Network 320 includes one or more wired and/or wireless networks. For example, network 320 may include a cellular network, a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a private network, the Internet, and/or a combination of these or other types of networks. The network 320 enables communication among the devices of environment 300.

The host server 330 includes one or more devices capable of receiving, generating, storing, processing, providing, and/or routing information associated with an input stream of the user device 340 and/or facilitating security associated with an account of a user of the user device 340, as described elsewhere herein. The host server 330 may include a communication device and/or a computing device, such as a server device. For example, the host server 330 may include a server, such as an application server, a web server, a proxy server, a virtual server (e.g., executing on computing hardware), or a server in a cloud computing system. In some implementations, the host server 330 includes computing hardware used in a cloud computing environment.

The user device 340 includes one or more devices capable of receiving, generating, storing, processing, and/or providing information associated with an input stream of the user device 340 and/or facilitating security associated with an account of a user of the user device 340, as described elsewhere herein. The user device 340 may include a communication device and/or a computing device. For example, the user device 340 may include a wireless communication device, a mobile phone, a user equipment, a laptop computer, a tablet computer, a desktop computer, a gaming console, a set-top box, a wearable communication device (e.g., a smart wristwatch, a pair of smart eyeglasses, a head mounted display, or a virtual reality headset), or a similar type of device.

The number and arrangement of devices and networks shown in FIG. 3 are provided as an example. In practice, there may be additional devices and/or networks, fewer devices and/or networks, different devices and/or networks, or differently arranged devices and/or networks than those shown in FIG. 3. Furthermore, two or more devices shown in FIG.