Paypal, Inc.

George Chen Kaidi

Sreeram Vasudevan

Li Hua Lim

Kim Dung Bui

Vipul Jain

Deepak Buddha

Jiaming Li

Van Hoang Nguyen

Quan Anh Nguyen

Bipin Kesapur

Antony Amalraj Morais

Phoram Kirtikumar Mehta

Parag Deepak Rao

Rajasekaran Radhakrishnan

Ryan Moses Cayamanda

Chamara Gihan De Silva Sunna Deniyage

Ashwin Ganesh

An example method includes receiving a request for a transaction; associating the request with a user; receiving, from the user, identification information; retrieving, from a database, first stored authentication information associated with the user; retrieving, from a distributed ledger, second stored authentication information associated with the user; and determining that the received authentication information matches the first stored authentication details and the second stored authentication details and, in response, outputting, by the computing system, a proof of authentication to enable the transaction.

Selection of electronic transaction processing channel and multi-factor user authentication

A method according to the present disclosure may include receiving, from a user device, an update associated with a document, generating an update log event based on the update, appending metadata to the update log event, the metadata indicative of a property of the update, storing the update log event with at least one other log event to generate a plurality of log events, receiving an indication of a type of compression, labelling metadata of each of the plurality of log events based on the indicated type of compression, and compressing the plurality of log events based on the labels.

Extensive-dimensional solutions for data lineage

Techniques are disclosed relating to automatically generating and analyzing database queries. In various embodiments, a database inquiry assistance system maintains a first machine learning model trained using query history data for a database and a second machine learning model using analysis history for the database. In an embodiment, the system receives from a user system a request for an inquiry into data stored in the database and identifies a sequence of queries for responding to the request, where identifying the sequence of queries includes applying the second machine learning model to the request. The system generates corresponding database query code for implementing one or more of the queries in the sequence of queries, where generating the corresponding database query code includes applying the first machine learning model to descriptors of one or more of the queries, and sends a plan identifying the sequence of queries to the user system.

Automated database query generation and analysis

Computing system defenses to rotating IP addresses by malicious entities during computing attacks are disclosed. An online entity may utilize a framework having computing operations for detecting and protecting from computing attacks using IP address rotation through multiple IP addresses to hide the malicious conduct. The threat detection system and framework may perform processes that indicate whether IP addresses are correlated and being used in the same computing operations, which may be malicious or fraudulent. If correlated, the framework may further determine that the IP addresses are being used to perpetrate the same or similar computing attack from a malicious actor. The framework may the execute one or more processes to protect from the computing attack that uses the rotation of IP addresses, including IP address blocking, manual challenges, and changing status code identifiers for webpage access requests.

Computing system defenses to rotating IP addresses during computing attacks

There are provided systems and methods for detecting malicious email addresses using email metadata indicators. Digital accounts may be attacked by malicious computing processes or other actions that attempt to compromise the security of accounts and/or perform account takeovers. To increase security of the accounts and account data, the service provider may interface with a digital address and/or identifier provider, such as an email provider to request metadata indications of addresses. The metadata indicator may include a score associated with whether the address is compromised or being used for fraudulent purposes. This score may be based on usages of the address over a period of time, connections of the address, and other activities. The indicator may be used to determine whether to allow data changes to the account's data.

Detecting malicious email addresses using email metadata indicators

There are provided systems and methods for configurable storage resource usage through a multi-phase data processing pipeline for data storage efficiency. A service provider may provide online digital computing services, such as electronic transaction processing, account, and the like through online platforms and digital content that may be loaded and served on webpages and through applications of the service provider. The service provider may process and serve data, which may be stored in various data storages and databases of the service provider. The service provider may configure and optimize storage resource usage by processing data through a multi-phased processing pipeline that analyzes the data for reductions in data storage size, duplications, and/or storage times to convert data into a more efficient structure. This may include converting the data to smaller data pieces, deduplicating the same or similar data, or limiting storage in resource intensive data stores.

Configurable storage resource usage through a multi-phase data processing pipeline for data storage efficiency

There are provided systems and methods for automated adjustment of security alert components in networked computing systems. An entity, such as an electronic transaction processor for digital transactions, may utilize threat detection within a security information and event management system. The threat detection may implement one or more processes to tune security alerts automatically, which can be done prior to deployment. A security alert may be broken into modular components, which may be run progressively, in increasing sampling numbers, against a set of computing logs to identify hits. The hits are compared to an expected proportion for each modular component to determine whether the modular component is providing proper results. Further, threat detection may utilize a system to obtain justifications for potentially malicious behavior to eliminate false positives. This may be done automatically when detecting suspicious activities.

Automated adjustment of security alert components in networked computing systems

Methods and systems are presented for providing a data control framework that enables storing, sharing, and transferring of data in a secure manner. Data files stored in data repositories are scanned. Content associated with different section of each data file is analyzed, and each section is tagged with a sensitivity level based on the content and a subject matter derived for the data file. Each data file is also assigned to a clearance classification based on an expected viewer of the data file. When sections from a first data file is being transferred to a second data file, a data control mechanism is triggered. If a particular section from the first data file is incompatible with the second data file, the data control mechanism may prevent the particular section from being transferred to the second data file, while allowing the remaining sections being transferred to the second data file.

Dynamic and modular data classification engine

Systems and methods for security engine audit rules to prevent incorrect network address blocking are disclosed. An entity such as a service provider may determine network traffic logs caused or generated by malicious web traffic and network communications, such as during a computing attack by a bad actor. The service provider may implement automated blocking controllers, which use detection rules to detect the malicious network traffic, and thereafter generate a network address blocklist that is distributed to devices, components, and servers of the service provider for network address blocking. To ensure the integrity of the detection rules, audit rules and a dynamic exclusion macro may be executed to detect when a detection rule is behaving abnormally and/or leading to anomalous results. If a detection rule is not properly blocking network addresses, the rule may be removed from execution until recovery.

Security engine audit rules to prevent incorrect network address blocking

There are provided systems and methods for injecting computing code for detection of malicious computing attacks during suspicious device behavior. A service provider, such as an electronic transaction processor for digital transactions, may detect activities of a computing device when using computing services. The service provider may determine that those activities are suspicious or high risk. In order to determine if the computing device is being used by a malicious user, such as to perform an automated computing attack against the service provider, the service provider may determine one or more probes that may be inserted to a corresponding user interface displayable by the computing device. The probe may attempt to differentiate between real human users and automated and/or malicious users. Computing code for the probe may be injected into the computing code for the user interface and may be provided when the user interface is output.

Malicious computing attacks during suspicious device behavior

Systems and methods for defending against emoji domain web address phishing are disclosed. A system may provide computer system security in various instances in which a web address includes an emoji character, which can be rendered as a graphical icon on a user system, and which may cause user confusion leading to a possible computer security breach. The system receives a web address as an input to a web browser. The system processes the received web address to remove any emoji characters present in the received web address. The system compares the processed web address to the received web address and determines whether the processed web address matches the received web address. Various actions are performed to prevent successful phishing attempts against users based on whether the processed web address matches the received web address.

Defense against emoji domain web addresses

There are provided systems and methods for split one-time password digits for secure transmissions to selected devices. Authentication credentials and one-time password operations by a service provider, such as an electronic transaction processor for digital transactions, may be compromised by malicious computing attacks or other actions that compromise the security of data and communications. To increase security of the data within a communication and authentication operations, a split one-time password system may be implemented. A user may preset a number of known digits for a one-time password with a profile and/or account. When multifactor authentication is required, randomized digits may be generated using a hash algorithm and may be transmitted to the user with instructions for completion of the one-time password. The user may be required to specifically enter the known digits with the randomized digits to properly pass the multifactor authentication.

Split one-time password digits for secure transmissions to selected devices

Techniques are discussed for grouping access requests made to a computer system using a log of access requests that includes a plurality of log entries of that include (a) a plurality of traffic indicators of the corresponding access request and/or (b) a plurality of identity indicators of a respective remote computer system that made the corresponding access request. The plurality of log entries is analyzed using a plurality of network analysis rules that are useable to group log entries according to traffic and/or identity indicators. Based on the analyzing, a plurality of groups of log entries are identified, and each group of log entries is assigned a corresponding common actor identifier (common actor ID). The determination of whether to grant a particular access request uses one or more assigned common actor IDs.

Evaluating access requests using assigned common actor identifiers

Systems and techniques for providing security data points from an electronic message are presented. A system can determine a first interne protocol (IP) address of a computing device in response to a user of the computing device opening an email sent to an email address corresponding to a particular electronic account of the user, the email comprising an IP address tracking mechanism. The system can also compare the first IP address with one or more second IP addresses corresponding to one or more electronic accesses of the particular electronic account. Furthermore, the system can determine if an account access anomaly exists in regard to the particular electronic account based on a result of the comparing. The system can also implement a security measure impacting an ability of the particular electronic account to conduct one or more transactions in response to the account access anomaly existing for the particular electronic account.

Security data points from an electronic message

Techniques are disclosed for mitigating network-based attacks, brute-force attacks, enumeration account takeover type attacks, and generally attacks that might result in unauthorized access to user accounts, denial-of-service, loss of functionality to users, etc. Authenticating a user at an end-point of a network may occur using an activator. In some instances, an authentication module (e.g. on a server) receives and validates a key activator. If the key activator is valid, the authentication module is activated. After the authentication module is activated, the authentication module may receive and authenticate a security credential, such as a password, that is associated with the user. If the authentication module receives the security credential without being activated, the authentication module may not authenticate the security credential, even if the security credential is a valid credential. A same user interface may be provided that receives both the key activator and the security credential, in some embodiments.

Growing community of inventors

Singapore, Singapore

George Chen Kaidi