Microsoft Technology Licensing, LLC

Jayaram N M Nanduri

Yuting Jia

Anand Ravindra Oka

Shoou-Jiun Wang

John Alan Beaver

Cezary Antoni Marcjan

Saliha Azzam

Harish Jayanti

Adam Feldman Reinhardt

Souren Aghajanyan

Xiaoguang Qi

Kiyoung Yang

Yung-Wen Liu

Nikhil Kothari

Danilo Landucci Benzatti

Rajasi Saha

Keith Robert Kinnan

Ram P Sunkara

Mohan Varthakavi

Jagannatha Raju Dantuluri

Ling-Ya Huang

Naganandhini Kohareswaran

Yaxiong Cai

Michael Y Moon

Einat Hazan

Anton Khokhlov

Huiying Mao

Shih-Chieh Su

Yini Zhang

Murali Krishna Manjunath

Hang Xu

Christopher J Mallery

Chad A Zanonie

This disclosure relates to systems and methods of risk detection in an electronic network. The method may include receiving a first portion of session context information for an interaction of an individual over a limited bandwidth network, the first portion including a session identifier for the interaction. The method may include retrieving a second portion of session context information for the interaction over a cloud data pipe using the session identifier, in response to receiving the first portion. The method may include accessing, a data structure representing connected knowledge of the individual. The method may include receiving, via a distributed system, security reputation data including aggregated information from a plurality of members. The method may include analyzing the session context information using the security reputation. The method may include generating a security risk score for the interaction based on the session context information, data structure, and the security reputation data.

Systems and methods of providing security in an electronic network

Different automatic tasks are facilitated via outlier detection in datasets using a Weighted Histogram-based Outlier Scoring (W-HBOS). An initial set of features is extracted from a processed dataset. The initial set of features is further filtered by applying robust statistics for size reduction. A second round of automatic feature selection is implemented based on maximum-entropy estimation so that a selected set of features that can give maximum possible information from different dimensions towards detecting anomalies are selected. The selected set of features are transformed to generate principal components that are provided to the W-HBOS-based model for outlier detection. A subset of outliers in one of the directions can be selected and reason codes are identified using back transformation for the execution of a desired automatic task.

Machine learning outlier detection using weighted histogram-based outlier scoring (W-HBOS)

Methods, systems, apparatuses, and computer program products are described for providing content recommendations to a requestor. In implementations, user event records associated with media items and content types may be stored, for instance, in an event catalog. A set of user scores may be generated based on a user-content score model and the user event records, where each generated user score represents an affinity between a user and a corresponding content type of the plurality of content types. A set of title scores may also be generated for a media item based on a title-content score model, where each generated title score represents an affinity between the media item and a corresponding content type. In response to a request, the sets of scores may be combined to generate a set of content recommendations to provide to the requestor.

Multi-content recommendation system combining user model, item model and real time signals

Cloud computing techniques utilizing distributed application execution are disclosed herein. One example technique includes receiving a command to launch an application, and in response, determining an execution location corresponding to a type of data consumed by individual components of the application. Upon determining that one of the components is to be executed in a local computing facility, the example technique includes transmitting, from a public computing facility to the local computing facility, a request to execute the one of the components in the local computing facility instead of the public computing facility. Upon being authorized by the local computing facility, data is requested and received from the one of the components executed at the local computing facility without having direct access from the public computing facility to a data source at the local computing facility.

Distributed application execution for cloud computing

Various device attributes associated with a current event may be obtained. Similarity metrics may be determined that indicate a degree of similarity between the device attributes that are associated with the current event and stored device attributes that are associated with previous events and previously created fuzzy device identifiers. A fuzzy device identifier may be assigned to the current event based at least in part on a comparison of the similarity metrics with a threshold. If none of the similarity metrics compare favorably with the threshold, then a new fuzzy device identifier may be created for the current event. However, if at least one of the similarity metrics compares favorably with the threshold, then the previously created fuzzy device identifier whose stored device attributes are most similar to the device attributes that are associated with the current event may be assigned to the current event.

Facilitating device fingerprinting through assignment of fuzzy device identifiers

Devices and methods for securing electronic transactions in a computing network are configured to receive a transaction, access transaction contextual data for the transaction, and apply one or more authentication decision rules to the transaction contextual data to determine initial authentication assessment information for the transaction. Further, aspects are configured to convert the initial authentication assessment information into a condensed authentication assessment indicator having an assessment value selected from a plurality of assessment values based on an assessment value definition, and transmit the condensed authentication assessment indicator. Also, aspects receive a transaction authentication decision based in part on the condensed authentication assessment indicator, and process or deny processing of the transaction based on the transaction authentication decision.

Systems and methods for authenticating an electronic transaction

Cloud computing techniques utilizing distributed application execution are disclosed herein. One example technique includes receiving a command to launch an application, and in response, determining an execution location corresponding to a type of data consumed by individual components of the application. Upon determining that one of the components is to be executed in a local computing facility, the example technique includes transmitting, from a cloud computing facility to the local computing facility, a request to execute the one of the components in the local computing facility instead of the cloud computing facility. Upon being authorized by the local computing facility, data is requested and received from the one of the components executed at the local computing facility without having direct access from the cloud computing facility to a data source at the local computing facility.

Risk scores are generated by systems that use features or inputs from the current transactions, some summary statistics like velocity and some statistics calculated in batch mode which traverse hierarchical classification levels of entities, including classified attribute levels of known transactions, to identify neighborhoods of related entities and related transactions. Corresponding records of transaction information are extracted from or are otherwise generated from neighborhoods of the related transactions associated with the defined neighborhoods of entities/transactions. These records of transaction information are then used by a consortium risk engine to generate composite risk scores associated with information from multiple merchants/entities and that were only identified by traversing the hierarchical classification of the entities and/or the corresponding transactions, which are at least tangentially related to the new transaction(s), and which may be the basis for approving or denying the new transaction(s) and/or sending the new transaction(s) for manual review.

Knowledge neighbourhoods for evaluating business events

Methods, systems, apparatuses, and computer program products are provided for a two-phase technique for generating content recommendations. In a first phase, a baseline recommender is configured to generate a baseline content recommendation using one or more content recommendation models, such as a Smart Adaptive Recommendations (SAR) model, Factorization Machine (FM) or Matrix Factorization (MF) models, collaborative filtering models, and/or any other machine-learning models or techniques. In a second phase, a personalized recommender implements a vector combiner configured to combine profile vectors, content vectors, and the baseline content recommendations to generate combined user vectors. A model generator may train a machine-learning model using the combined user vectors and training data comprising actual interaction behavior of the users, which may be then applied to identify a content recommendation for a particular user.

Personalization enhanced recommendation models

Systems and methods provide a customer engagement platform experimentation framework. Experiments are created to determine which variation of a particular promotion (i.e., an experiment) is most effective. Initially, users are split into buckets that define whether a particular user is in a control group or a treatment group for a particular experiment. Users are assigned into buckets differently for unrelated experiments and similarly for related experiments. This ensures the users are in either the control group or the treatment group for all related experiments. Key performance indicators (KPIs) of users that experienced the experiment are compared with KPIs of users that did not experience the experiment. An assessment of the experiment can then be provided based on the compared KPIs.

Customer engagement platform experimentation framework

Examples described herein generally relate to a computer device including a memory, and at least one processor configured to process a transaction. The computer device receives customer transaction information. The computer device evaluates the customer transaction information to determine a risk score for the transaction. The computer device assigns the transaction, based on the risk score, to one of a plurality of stratums including at least a first stratum and a second stratum. The computer device selects a merchant identifier (MID) from at least a first MID associated with the first stratum and a second MID associated with the second stratum based on at least the assigned stratum and a target chargeback rate for at least one of the first MID or the second MID. The computer device transmits the transaction information and the selected MID to an issuing bank.

Track bank chargeback sensitivity using disproportional risk level sampling design

Embodiments disclosed herein are related to computing systems and methods for determining a risk score for a plurality of data transactions. In the embodiments, a first risk score module may receive data transactions. The first risk score module may then determine a first risk score for each of the data transactions. A second risk score module that is different from the first risk score module may receive each of the first risk scores determined by the first risk score module as an input. The second risk score module may determine a second risk score based in part on the input first risk scores for each of the data transactions. The second risk scores may specify if each of the data transactions is to be approved or rejected by the computing system.

Long-term short-term cascade modeling for fraud detection

Embodiments disclosed herein are related determining a risk score for one or more data transactions. Current data transactions that are associated with one or more current attributes are received. Stored data transactions associated with stored attributes are accessed. A plurality of the stored attributes are selected. A first sliding window and a second sliding window are selected. A duration of the second sliding window is longer than a duration of the first sliding window and encompasses the duration of first sliding window. Risk information for those stored data transactions that are associated with the plurality of attributes is determined. The risk information is determined during the duration of both the first and second sliding windows and is indicative of a level fraud that is occurring. The determined risk information and the current attributes are used to generate a risk score for the current data transactions. The current data transactions are approved or rejected based on the risk score.

Growing community of inventors

Issaquah, WA, United States of America

Jayaram N M Nanduri