Visa International Service Association

Oath Inc.

Telenav Gmbh

Aerohive Networks, Inc.

Yahoo Ad Tech LLC

Adeia Semiconductor Bonding Technologies Inc.

Extreme Networks, Inc.

Yahoo Assets LLC

Verizon Media Inc.

Visa International Service Application

Adeia Semiconductor Technologies LLC

Liang Wang

Wei Zhang

Yan Zheng

Michael Yeh

Hao Yang

Matthew Stuart Gast

Junpeng Wang

Angus Xianen Qiu

Liang Peng

Chun Han

Zhongfang Zhuang

Xianen Qiu

Xiaobo Dong

Cyprian Emeka Uzoh

Rajesh Katkar

Kuang-chih Lee

Liang Gou

Yong Kang

Jianlong Zhang

Shengjun Pan

Adam Michael Conway

Robert Brian Christensen

Quan Lu

Dhruv Gelda

Javid Ebrahimi

Shubham Jain

Prince Osei Aboagye

Mengting Gu

Yuwei Wang

Javier A DeLaCruz

Charles Gerard Woychik

Guilian Gao

Gaius Gillman Fountain, Jr

Shaowu Huang

Aliasgar Mumtaz Husain

Chiranjeet Chetia

Minghua Xu

Junwei Pan

Ruichen Wang

Shi Cao

Yan Han

Datong Chen

Arjun Shrinath

Roshni Ann Samuel

Robert Christensen

Jaime Morales, Jr

Teppo Veikko Salonen

Harishkumar Sundarji Majithiya

Zhen Xia

Andrew Malachy McGloin

Jiarui Sun

Qi Dai

Haoyu Li

Peng Yan

Musen Wen

Sangil Lee

The present teaching generally relates to identifying fraudulent content provider-user device pairs. In one embodiment, an initial user risk value and an initial content provider risk value may be determined. A first functional representation of a user risk value may be generated based on the initial user risk value and relational data. A second functional representation of a content provider risk value may be generated based on the initial content provider risk value and the relational data. A converged user risk value and a converged content provider risk value associated with the first and second representations converging may be determined. A pair risk value may be determined based on the converged user risk value and the converged content provider risk value. A fraudulent label may then be applied to interaction events detected by the content provider from the user in response to the risk pair value satisfying a condition.

Method and system for detecting fraudulent user-content provider pairs

Provided is a method for normalizing embeddings for cross-embedding alignment. The method may include applying mean centering to the at least one embedding set, applying spectral normalization to the at least one embedding set, and/or applying length normalization to the at least one embedding set. Spectral normalization may include decomposing the at least one embedding set, determining an average singular value of the at least one embedding set, determining a respective substitute singular value for each respective singular value of a diagonal matrix, and/or replacing the at least one embedding set with a product of the at least one embedding set, a right singular vector, and an inverse of the substitute diagonal matrix. The mean centering, spectral normalization, and/or length normalization may be iteratively repeated for a configurable number of iterations. A system and computer program product are also disclosed.

Method, system, and computer program product for normalizing embeddings for cross-embedding alignment

Provided is a system for analyzing features associated with entities using an embedding tree, the system including at least one processor programmed or configured to receive a dataset associated with a plurality of entities, wherein the dataset comprises a plurality of data instances for a plurality of entities. The processor may be programmed or configured to generate at least two embeddings based on the dataset and determine split criteria for partitioning an embedding space of at least one embedding tree associated with the dataset based on feature data associated with an entity and embedding data associated with the at least two embeddings. The processor may be programmed or configured to generate at least one embedding tree having a plurality of nodes based on the split criteria. Methods and computer program products are also provided.

System, method, and computer program product for feature analysis using an embedding tree

Provided is a method for detecting group activities in a network. The method may include receiving interaction data associated with a plurality of interactions. For each account identifier associated with at least one interaction, a value may be determined for each of a first set of categories, and a vector may be generated based on the value for each category. The length of each vector may be determined. At least one relational graph may be generated based on the interaction data. Each relational graph may be associated with a respective category of a second set of categories. At least one cluster of nodes may be determined based on the relational graph(s). A score for each cluster may be determined based on the length of the vector associated with the account identifier of each node of the cluster of nodes. A system and computer program product are also disclosed.

Method, system, and computer program product for detecting group activities in a network

Described are a system, method, and computer program product for dynamic node classification in temporal-based machine learning classification models. The method includes receiving graph data of a discrete time dynamic graph including graph snapshots, and node classifications associated with all nodes in the discrete time dynamic graph. The method includes converting the discrete time dynamic graph to a time-augmented spatio-temporal graph and generating an adjacency matrix based on a temporal walk of the time-augmented spatio-temporal graph. The method includes generating an adaptive information transition matrix based on the adjacency matrix and determining feature vectors based on the nodes and the node attribute matrix of each graph snapshot. The method includes generating and propagating initial node representations across information propagation layers using the adaptive information transition matrix and classifying a node of the discrete time dynamic graph subsequent to the first time period based on final node representations.

System, method, and computer program product for dynamic node classification in temporal-based machine learning classification models

Embodiments for training a recommendation system to provide merchant recommendations comprise receiving, by a processor, raw merchant embeddings and raw user embeddings generated from payment transaction records, wherein the raw merchant embeddings include a plurality of embedded features. A generative adversarial network (GAN) is trained to generate modified merchant embeddings from the raw merchant embeddings, where the modified embeddings remove a location feature. Subsequent to training and responsive to receiving a request for merchant recommendations in the target location for the target user, the GAN and a trained preference model are used to generate a list of merchant rankings based on a new set of modified merchant embeddings, past preferences of a target user, and the target location to recommend merchants in the target location.

Unsupervised embeddings disentanglement using a gan for merchant recommendations

The system and method may assess the merchant risk level on a more continuous scale rather than a binary categorization. It may produce a continuous risk score proportional to the likelihood of a merchant being risky, effectively addressing the issue of shades of gray encountered by the traditional blacklisting approach. The continuous risk score feature provides greater flexibility as it allows the payment network to make dynamic pricing decisions (known as interchange optimization) based on the merchant risk level. Using collective intelligence from transactions across the payment network, the system and method may be able to assess the merchant risk level with high accuracy. The system and method may be particularly beneficial to small merchants with low transaction volume as even a few fraudulent transactions can easily put them in the high-risk merchant category. Further, the system and method may help payment processing networks make better decision on cross-border transactions.

Method and system for assessing the reputation of a merchant

Described are a system, method, and computer program product for multivariate event prediction using multi-stream recurrent neural networks. The method includes receiving event data from a sample time period and generating feature vectors for each subperiod of each day. The method also includes providing the feature vectors as inputs to a set of first recurrent neural network (RNN) models and generating first outputs for each RNN node. The method further includes merging the first outputs for each same subperiod to form aggregated time-series layers. The method further includes providing the aggregated time-series layers as an input to a second RNN model and generating final outputs for each RNN node of the second RNN model.

System, method, and computer program product for multivariate event prediction using multi-stream recurrent neural networks

The present teaching relates to a fraud detecting system and method for providing protection against fraudulent advertisement requests. Upon receiving a request for an advertisement, the system extracts an identifier, associated with a source from which the request originates, included in the request. The system determines whether the extracted identifier is included in a list of designated identifiers, and when the identifier is included in the list, the system denies the request for the advertisement. When the identifier is not included in the list of designated identifiers, the system provides the advertisement in response to the request, and extracts a set of features from the request and other requests that originate from the source to determine whether the identifier associated with the source is to be included in the list of designated identifiers based on the set of features in accordance with one or more models.

Method and system for detecting fraudulent advertisement activity

A system, method, and computer program product for incorporating knowledge from more complex models in simpler models. A method may include obtaining first training data associated with a first set of features and second training data associated with a second set of features different than the first set of features; training a first model based on the first training data and the second training data; and training a second model, using a loss function that depends on an output of an intermediate layer of the first model and an output of the second model, based on the second training data.

System, method, and computer program product for incorporating knowledge from more complex models in simpler models

A method, system, and computer program product is provided for embedding compression and reconstruction. The method includes receiving embedding vector data comprising a plurality of embedding vectors. A beta-variational autoencoder is trained based on the embedding vector data and a loss equation. The method includes determining a respective entropy of a respective mean and a respective variance of each respective dimension of a plurality of dimensions. A first subset of the plurality of dimensions is determined based on the respective entropy of the respective mean and the respective variance for each respective dimension of the plurality of dimensions. A second subset of the plurality of dimensions is discarded based on the respective entropy of the respective mean and the respective variance for each respective dimension of the plurality of dimensions. The method includes generating a compressed representation of the embedding vector data based on the first subset of dimensions.

Method, system, and computer program product for embedding compression and regularization

Provided is a system for analyzing a multivariate time series that includes at least one processor programmed or configured to receive a time series of historical data points, determine a historical time period, determine a contemporary time period, determine a first time series of data points associated with a historical transaction metric from the historical time period, determine a second time series of data points associated with a historical target transaction metric from the historical time period, determine a third time series of data points associated with a contemporary transaction metric from the contemporary time period, and generate a machine learning model, wherein the machine learning model is configured to provide an output that comprises a predicted time series of data points associated with a contemporary target transaction metric. Methods and computer program products are also provided.

System, method, and computer program product for analyzing multivariate time series using a convolutional Fourier network

A method of determining fraud includes: receiving a transaction request associated with a first payment transaction between a merchant and a user from a merchant system; generating a first risk score based on the transaction request and a first set pot of transaction data received prior to the transaction request; processing a transaction request approval based on the first risk score not satisfying a first threshold; receiving a risk score request associated with the first payment transaction, where the risk score request is received after the transaction request has been approved; generating a second risk score based on a second set of transaction data received after the first risk score is determined; and automatically classifying the first payment transaction as potentially fraudulent in response to determining that the second risk score satisfies a second threshold.

System, method, and computer program product for determining fraud

One or more computing devices, systems, and/or methods for assessing riskiness of a domain are provided. For example, a content request is received from a content provider service that hosts a website associated with a domain. The content request is evaluated to identify request features. Feature scores are assigned to the request features using labeled feature data. The feature scores are aggregated to generate a content request risk score corresponding to a riskiness of the content request corresponding to fraud, such as domain spoofing. The content request risk score along with other content request risk scores of content requests associated with the content provider service are aggregated to create a content provider risk score corresponding to a riskiness of the content provider service, such as a risk of the domain being fraudulent. The content provider risk score is used to either block or process the content request.

Systems and methods for assessing riskiness of a domain

Growing community of inventors

San Jose, CA, United States of America

Liang Wang