Patent ID: 11956278
Assignee: TEKION CORP
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 9:
10. A non-transitory computer-readable storage medium storing executable code for identifying suspicious entries in a document management system, the code when executed by a computer processor causes the computer processor to perform steps including:
storing, by the document management system, a document including a plurality of entries of an entity associated with the document, each entry from the plurality of entries describing an activity at the entity at a given date and the entry added to the document by a respective employee of the entity;
storing, by the document management system, a security policy associated with the document, the security policy including one or more security rules defining attributes of suspicious entries in the document, a suspicious entry indicative of an activity at the entity described by the suspicious entry being potentially malicious, wherein the document management system is a machine learned model trained to generate at least one of the one or more security rules associated with the document;
receiving, by the document management system, a request by an employee of the entity to add a candidate entry to the document, the candidate entry describing an activity related to an object located at the entity and including a plurality of fields and a value for each of the plurality of fields that are associated with the activity described by the candidate entry, wherein at least one value for one of the plurality of fields is provided by the employee of the entity in the request by the employee to add the candidate entry to the document;
classifying, by the document management system, the candidate entry as suspicious based on a comparison of a plurality of attributes of the candidate entry and the security policy prior to the candidate entry that is included in the request from the employee being added to the document or being rejected from being added to the document;
automatically adding the candidate entry to the document responsive to the candidate entry being classified as suspicious despite the candidate entry being classified as suspicious;
transmitting an alert that the candidate entry classified as suspicious was added to the document;
receiving feedback on the classification of the candidate entry as suspicious, the feedback indicative of whether the classification is valid or invalid;
retraining the document management system that is the machine learned model based on the received feedback; and
generating, by the retrained document management system, one or more additional security rules associated with the document.