Paypal, Inc.

Blake Morgan Butler

Bradley Wardman

Kevin Tyers

Nathan Robert Pratt

Jakub Burgis

Nicole Harris

Raoul Christopher Johnson

Meethil Vijay Yadav

Jakub Ceiran Burgis

Nate Robert Pratt

Systems and methods for detecting malicious clients through inspecting application properties are described. These may include requesting application properties from a client application, receiving a digital fingerprint from the client device, determining whether the digital fingerprint indicates that the client application is likely a malicious client, and taking a mitigation action based on determining that the client application is likely a malicious client.

Systems and methods for malicious client detection through property analysis

Systems and methods for providing a threat intelligence system include a system provider device that downloads, through communication over a network and from one or more targeted websites, a plurality of images of a first environment. Based on an OCR process, the system provider device may extract a set of textual data corresponding to a subset of images of the plurality of images, where the subset of images depict text. The system provider device stores the set of textual data in an indexed and searchable database. The system provider device assigns a threat assessment score to each image based on the set of textual data, and the threat assessment score may be updated based on comparison of the set of textual data with other sets of textual data. Based on the threat assessment score being greater than a threshold value, the system provider device may generate a security alert.

Threat intelligence system

There are provided systems and methods for an automated device data retrieval and analysis platform. A service provider server invokes an instance of an application in a remote processing environment using device data associated with the application and sends a control message that prompts the instance to send a request to a web server for a process script that invokes a process executable in the remote processing environment. The service provider server obtains traffic data a behavior of application data based on an interaction between the instance and the web server, and determines features of the application in a native state from the behavior of the application data. The server generates a data profile of the application that indicates the features in the native state and provides the data profile to a remote engine to detect potential malicious activity associated with the application from the detection operation.

Automated device data retrieval and analysis platform

Methods and systems are presented for dynamically adjusting a risk classification of a risk source based on classifications of one or more other risk sources. The risk engine may first classify a first risk source as a first risk type based on an initial analysis of the first risk source. Subsequent to classifying the first risk source as the first risk type, the risk engine may determine that a second risk source is associated with a second risk type. Based on the determination that the second risk source is associated with the second risk type, the risk engine may re-classify the first risk source as the second risk type. The risk engine may then use the reclassification of the first risk source to improve network security of an online service provider.

Multi-dimensional drift nuance intelligence threat engine

Methods, systems, and computer program products for performing passive and active identity verification in association with online communications. For example, a computer-implemented method may include receiving one or more electronic messages associated with a user account, analyzing the electronic messages based on a plurality of identity verification profiles associated with the user account, generating an identity trust score associated with the electronic messages based on the analyzing, determining whether to issue a security challenge in response to the electronic messages based on the generated identity trust score, and issuing the security challenge in response to the electronic messages based on the determining.

Passive and active identity verification for online communications

Methods and systems are presented for providing enriched technical security data to a risk engine of an online service provider, and for adjusting security settings based on the enriched data. The enriched security data may be generated by recursively deriving additional security information from an initial security data input. The initial security data input may be associated with a risk source, such as a person or a device that submits an electronic request to the online service provider. Based on the initial security data input, the risk engine may recursively derive additional security information that enriches the initial security data input. The risk engine may then use the derived security information as well as the initial security data input to assess a risk level of the risk source, and then adjust a security setting of the online service provider based on the assessed risk level of the risk source.

Deep intelligence context engine

Methods and systems for implementing keyboard linked authentication challenges are described. A visual representation of a first string of characters is provided for display on a client computing device. In response to the providing the visual representation for display, several keystrokes on the client computing device that produces a second string of characters are received. A determination that the second string of characters matches the first string of characters is made. A determination that no unauthorized keystrokes are included in the detected plurality of keystrokes is further made. Access is provided to the client computing device upon determining that the second string of characters matches the first string of characters, and determining that no unauthorized keystrokes are included in the detected plurality of keystrokes.

System and method for implementing keyboard linked authentication challenges

Techniques are disclosed relating to detecting that a client system is an emulated computer system based on its computational performance of one or more challenge problems. In some embodiments, a server computer system may receive, from a client system, a request to access a web service. The server computer system may determine reported technical features of the client system and select a particular challenge problem to provide to the client system. The server computer system may determine an expected response time of the particular challenge problem for the client system. The server computer system may receive a challenge response from the client system that includes a proposed solution to the particular challenge problem. The server computer system may then determine whether to authorize the request based on a measured response time by the client system and the expected response time of the particular challenge problem for the client system.

Detection of emulated computer systems using variable difficulty challenges

Methods, systems, and computer program products for providing high-yielding detection of remote abusive content are disclosed. A computer-implemented method may include generating a graphical user interface allowing users to submit a web link for analysis to determine whether the web link is associated with malicious content, receiving the web link from the user via the graphical user interface, sending the web link to a plurality of distributed server machines to allow each of the distributed server machines to test the web link, generating a plurality of test user profiles to test the web link, testing the web link by each of the distributed server machines using one or more of the test user profiles, receiving a test result for the web link from each of the distributed server machines, and displaying a report comprising the test results for the web link to the user via the graphical user interface.

Growing community of inventors

Scottsdale, AZ, United States of America

Blake Morgan Butler