Paypal, Inc.

David Stein

Adam Cohen

Xing Wang

Chunmao Ran

Avishay Meron

Itzik Levi

Uri Arad

Avihay Nathan

Oded Argon

Lev Faivishevsky

Roi Lupo

Doron Hai-Reuven

Placing an event into a particular cluster can allow various inferences about the event. A new payment transaction that looks similar to a previously identified cluster of mostly fraudulent payment transactions, for example, may be higher risk. The present disclosure includes structural data improvements to the way that online clustering of events (which may include web events and not just payment transactions) occurs. A new event can be classified into a particular segment very quickly using feature table searching, which can allow for better decision making when a short timeframe is required (e.g. transaction processing, online advertising, etc.).

Rapid online clustering

Various systems, mediums, and methods may involve a data engine with various components. For example, a system with the data engine may include a segmentation component, an asset preparation component, a clustering component, a variable generation component, and classification component. As such, the system may determine a number of assets associated with a number of activities of one or more accounts. Further, the system may determine various links associated with the number of assets. As such, the system may detect an attack and/or an attack trend associated with the one or more accounts based on the various links associated with the number assets. Further, the system may generate a notification that indicates the attack and/or the attack trend detected.

System security configurations based on assets associated with activities

Methods and systems are disclosed for dynamic detection of geo-location spoofing by a networked device, such as fraudulent client connections to a server, in which the connection is made using an internet protocol (IP) tunneling as may be provided by a virtual private network (VPN) connection. A user of a client device may employ spoofing of IP-geo location mechanisms and IP classification for various reasons, such as gaining access to services that are not allowed in certain locations (e.g., certain movie and television content providers); browsing server data while maintaining a higher level of anonymity; and performing fraudulent actions on the server. Detecting a false geographic location (e.g. as indicated by IP address) is helpful for improving computer system security, and for evaluating whether access to particular digital resources should be provided.

Dynamic detection of geo-location obfuscation in of internet devices

Rapidly handling large data sets can be a challenge, particularly in situations where there are millions or even hundreds of millions of database records. Sometimes, however, a service level agreement necessitates that a service return a response to a query in a small amount of time. Database organization techniques can be used that reduce potentially large datasets to smaller groups (neighbors) based on uncommon but shared attributes, in various instances. Using a limited set of related records, queries can be answered using a focused approximation based on characteristics of various identified clusters of records in the set of related records. A particular record may also be associated with an existing cluster of records based on that record's similarities to records in the cluster.

Database optimization concepts in fast response environments

Methods and systems are disclosed for dynamic detection of fraudulent client connections to a server, in which, for example, the connection is made using an internet protocol (IP) tunneling technology such as networking on a virtual private network (VPN) and making the connection via a VPN tunnel in order to obfuscate the client IP address, in which a user of a client device may employ spoofing of IP-geo location mechanisms and IP classification on the server side. Such a user may have various motivations for obfuscating the client device's geo-location by using an IP tunnel when connecting to a server such as gaining access to services that are not allowed in certain locations (e.g., certain movie and television content providers); browsing server data while maintaining a higher level of anonymity; and performing fraudulent actions on the server.

Growing community of inventors

Even Yehuda, Israel

David Stein