Paypal, Inc.

Mandar Ganaba Gaonkar

Yuzhen Zhuo

Quan Jin Ferdinand Tang

Hewen Wang

Zhe Chen

Solomon Kok How Teo

Omkumar Mahalingam

Kenneth Bradley Snyder

Serafin Trujillo

Jiyi Zhang

Shanshan Peng

Changching Chi

Anand Sengamalai

Panpan Qi

Fei Pei

Methods and systems are presented for bot detection. A movement of a pointing device is tracked via a graphical user interface (GUI) of an application executable at a user device. Movement data associated with different locations of the pointing device within the GUI is obtained. The movement data is mapped to functional areas corresponding to a range of the different locations of the pointing device within the GUI over consecutive time intervals. At least one vector representing a sequence of movements for at least one trajectory of the pointing device through one or more of the functional areas and a duration the pointing device stays within each functional area is generated. At least one trained machine learning model is used to determine whether the sequence of movements of the pointing device was produced through human interaction with the pointing device by an actual user of the user device.

Two-sided machine learning framework for pointer movement-based bot detection

Techniques are disclosed relating to determining whether to authorize a requested action based on whether an entity is an automated computer. In some embodiments, a computer system tracks, at a user interface of a computing device, a sequence of pointer movements. The computer system maps, based on coordinate locations of pointer movements in the sequence, respective movements in the sequence to a plurality of functional areas. Based on the mapping, the computer system generates a movement graph and determines, based on the movement graph, whether an entity associated with the sequence of pointer movements is an automated computer. In response to receiving a request to authorize an action at the computing device, the computer system generates, based on the determining, an authorization decision for the action and transmits the authorization decision to the computing device. Determining whether the entity is an automated computer may advantageously prevent fraudulent activity.

Pointer movement modelling for entity classification

Systems and methods for user-agent anomaly detection are disclosed. In one embodiment, a user-agent string may be embedded into a numerical data vector representation using a sentence embedding algorithm (e.g., FastText). A predictive score may be calculated based on the numerical data vector representation and using a probability distribution function model that models a likelihood of occurrence of the observed user-agent based on patterns learned from historic payload data (e.g., a Gaussian Mixture Model). The predictive score may be compared to a threshold and, based on the comparison, it may be determined whether the user-agent is fraudulent.

User-agent anomaly detection using sentence embedding

Systems and methods for emulator detection are disclosed. In one embodiment, a user agent string may be embedded into a first numerical data vector representation. Hardware characteristics of a client device corresponding to the user agent may be embedded into a second numerical data vector representation. Based on the first numerical data vector representation of the user agent and the second numerical data vector representation of the hardware characteristics, and their consistency, the client device may be determined to be an emulator or a non-emulator device.

Emulator detection using user agent and device model learning

Techniques are disclosed relating to transaction authorization. In some embodiments, a server computer system receives and caches browsing information for a device of a user, where the browsing information relates to a transaction service. The server computer system may then receive a request to authorize one or more transactions via the transaction service. The server computer system may evaluate the cached browsing information to determine whether the user is attempting to perform multiple concurrent transactions via the transaction service. Based on the evaluating, the server computer system may determine whether to authorize the one or more transactions. In some embodiments, the disclosed techniques may advantageously prevent or reduce authorization of duplicate transactions that are concurrently attempted by a user.

Duplicate concurrent transaction detection

Growing community of inventors

San Jose, CA, United States of America

Mandar Ganaba Gaonkar