US Patent 12028363 Detecting bad actors within information systems

A device that is configured to receive user activity information from a network device. The user activity information includes information about user interactions with the network device for a plurality of users. The device is further configured to input the user activity information into a machine learning model. The machine learning model is configured to receive user activity information and to output a set of bad actor candidates based on the user activity information. The set of bad actor candidates identifies one or more users from among the plurality of users. The device is further configured to receive the set of bad actor candidates from the machine learning model and to output the set of bad actor candidates.