Paypal, Inc.

Arris Enterprises LLC

Arris Solutions, Inc.

Adam Cohen

Chunmao Ran

Avishay Meron

Itzik Levi

David Stein

Xing Wang

Kun Fu

Chuanyun Fang

Doron Hai-Reuven

Avihay Nathan

Matias Rotenberg

Anna Livshits-Rozenman

Yarden Raisken

Raz Alon

Oded Ben Haim

Amnon Jislin

Amit Eshet

Yuval Arie Bercovich

Alon Shafrir

Yaeli Cohen

Assav Bar Yaccov

Nir Radian

Edward Stein

Methods and systems are presented for classifying a particular user account as a fraudulent user account by analyzing links between the user account and two or more known fraudulent user accounts collectively. Attributes of the particular user account are compared against attributes of a plurality of known fraudulent accounts to determine that the particular user account has shared attributes with a first known fraudulent account and a second known fraudulent account. The shared attributes with the first known fraudulent account and the second known fraudulent account are analyzed collectively to determine a risk level for the particular user account. The risk level may indicate a likelihood that the particular user account corresponds to a fraudulent account.

Systems and methods for classifying accounts based on shared attributes with known fraudulent accounts

Placing an event into a particular cluster can allow various inferences about the event. A new payment transaction that looks similar to a previously identified cluster of mostly fraudulent payment transactions, for example, may be higher risk. The present disclosure includes structural data improvements to the way that online clustering of events (which may include web events and not just payment transactions) occurs. A new event can be classified into a particular segment very quickly using feature table searching, which can allow for better decision making when a short timeframe is required (e.g. transaction processing, online advertising, etc.).

Rapid online clustering

There are provided systems and methods for a dynamic value appended to cookie data for fraud detection and step-up authentication. A service provider, such as an electronic transaction processor for digital transactions, may utilize computer cookies for authentication and/or login for a user account. In order to further secure cookies from being compromised and used by malicious parties for fraudulent account access, the service provider may add or append a dynamic value that changes at each subsequent login to the computer cookie. The dynamic value may be used so that if a computer cookie is misappropriated, only one device may use the cookie once without the cookie updating and invalidating the cookie with another device or application on the device. Thereafter, when a login is requested, the dynamic value is matched to an expected value by the service provider when determining whether to authenticate the device.

Dynamic value appended to cookie data for fraud detection and step-up authentication

A computer system receives a goal for an environment, wherein the environment corresponds to at least one webpage. The computer system receives one or more classifiers corresponding to the environment, wherein the one or more classifiers provide information corresponding to a current webpage and information corresponding to one or more previous actions taken by a web crawler. The computer system identifies a recommended next action based on the one or more classifiers. The computer system transmits the recommended next action to the web crawler to cause the web crawler to perform the recommended next action.

Utilizing reinforcement learning for goal oriented website navigation

A method is provided that includes accessing, by a server provider server of a service provider, a database storing associations between network addresses and locations. Additionally, the method includes determining a subset of the database corresponding to a first network address, each association included in the subset corresponding to an association between the first network address and a respective location. The method also includes in response to determining that the subset of the database satisfies one or more clustering criteria, calculating a representative location corresponding to the first network address, and storing an association between the first network address and the representative location in a second database.

Calculating representative location information for network addresses

Machine learning techniques are used in combination with graph data structures to perform automated classification of accounts. Graphs may be constructed using a seed node and then expanded outward to second-degree nodes and third-degree nodes that are connected to a seed user account node via direct interaction between the accounts. Characterization information regarding the interaction between accounts can be stored in the graph (e.g., quantity of interactions, types of interactions) as well as other metrics and metadata. A classifier, using random forest or another technique, may be trained using a number of different graphs that can then be used to reach a determination as to whether a user account falls into one particular category or another. These techniques can identify accounts that may be violating terms of service, committing a security violation, and/or performing illegal actions in a way that is not ascertainable from human analysis.

Machine learning and security classification of user accounts

Various systems, mediums, and methods may involve a data engine with various components. For example, a system with the data engine may include a segmentation component, an asset preparation component, a clustering component, a variable generation component, and classification component. As such, the system may determine a number of assets associated with a number of activities of one or more accounts. Further, the system may determine various links associated with the number of assets. As such, the system may detect an attack and/or an attack trend associated with the one or more accounts based on the various links associated with the number assets. Further, the system may generate a notification that indicates the attack and/or the attack trend detected.

System security configurations based on assets associated with activities

Rapidly handling large data sets can be a challenge, particularly in situations where there are millions or even hundreds of millions of database records. Sometimes, however, a service level agreement necessitates that a service return a response to a query in a small amount of time. Database organization techniques can be used that reduce potentially large datasets to smaller groups (neighbors) based on uncommon but shared attributes, in various instances. Using a limited set of related records, queries can be answered using a focused approximation based on characteristics of various identified clusters of records in the set of related records. A particular record may also be associated with an existing cluster of records based on that record's similarities to records in the cluster.

Database optimization concepts in fast response environments

Growing community of inventors

Ramat Gan, Israel

Adam Cohen