Event data of a first entity is accessed. The first entity has been flagged as having a predefined status. The event data corresponds to a plurality of events involving the first entity that occurred within a predefined first time period. Based on the accessing of the event data, behavioral data of the first entity is generated. The behavioral data is formatted as a data sequence. A machine learning model is trained using the behavioral data of the first entity as training data. Using the trained machine learning model, a determination is made as to whether a second entity has the predefined status.