Intuit, Inc.

Noah Eyal Altman

Yair Horesh

Yehezkel Shraga Resheff

Shimon Shahar

Liron Hayman

Shir Meir Lador

Noa Haas

Yaakov Tayeb

Tzvika Barenholz

Or Basson

Yaron Sheffer

Gleb Keselman

Uri Lapidot

Yonantan Ben-Simhon

Asaf Brill

Rineke Van Noort

Yael Hochma

This disclosure relates to systems and methods for identifying fraudulent email addresses associated with an electronic payment service. In some implementations, a computing device receives an email with a prefix having a number of characters and characterized by a prefix length indicative of the number of characters in the prefix. The computing device identifies each of a number of bigrams is identified within the prefix, and determines a row and column distance for each bigram between two consecutive characters of the bigram as positioned on a keyboard. The computing device calculates a Euclidean distance between the two consecutive characters of the bigram based on the row and column distances, and determines a normalized distance based on the prefix length and an average of the Euclidean distances calculated for the number of bigrams in the prefix. The normalized distance is compared with a value to classify the email as suspicious or as not suspicious.

Detecting fraud by calculating email address prefix mean keyboard distances using machine learning optimization

Certain aspects of the present disclosure provide techniques for generating a metric, include receiving a rule defining one or more text strings; determining a set of transactions based on a user attribute; determining a first subset of transactions; determining a second subset of transactions; generating a first categorical distribution based on each transaction of the first subset of transactions being associated with a transaction description containing at least one text string of the one or more text strings; calculating a first unity metric based on the first categorical distribution; generating a second categorical distribution based on each transaction of the second subset of transactions being associated with a transaction description that does not contain a text string of the one or more text strings; calculating a second unity metric based on the second categorical distribution; determining a reliability metric for the rule; and providing the reliability metric.

Automated categorization of data by generating unity and reliability metrics

An entry validation system executed by a processor, may compare an entry into a user interface (UI) field with at least one range of valid entries. The at least one range of valid entries may be generated by a machine learning (ML) system by clustering known valid data using a clustering algorithm producing a lowest number of clusters that absorbs all of the known valid data within the clusters. In response to the comparing, the entry validation system may provide a determination of validity or invalidity to an application displaying the UI field. The determination of validity may cause the entry to be processed by the application, and the determination of invalidity may cause the application to reject the entry.

Automatic entry validation using density based clustering

The present disclosure provides techniques for detecting and correcting outliers in categories of transactions. One example method includes receiving electronic transaction data indicative of one or more current transactions, wherein the one or more current transactions are associated with a user of a software application, identifying, for each transaction of the one or more transactions, a category using a first machine learning model, computing a distribution for each category of a plurality of categories of the user, identifying, a particular category of the user as an anomalous category, based on the distribution for the particular category of the user and corresponding distributions for the particular category of other users, and updating a category assigned to one or more transactions such that a delta between a value relating to the anomalous category of the user and corresponding values relating to the particular category of the other users is reduced.

Detecting and correcting outliers in categories of transactions

Certain aspects of the present disclosure provide techniques for detecting errors in account numbers. One example method generally includes receiving, from a user device, an entered number associated with a user and determining, based on a first portion of the entered number, an entity associated with the entered number. The method further includes obtaining, from an account number database, a plurality of account numbers associated with the entity and generating, from the plurality of account numbers, an account number matrix. The method further includes attempting to solve a multiplication equation of the account number matrix, wherein a solution of the multiplication equation is a vector of constants, upon determining a solution to the multiplication equation, determining whether the entered vector is a valid number for the entity and upon determining the entered vector is a valid number for the entity, storing the entered number in the account number database.

Identifying checksum mechanisms using linear equations

Techniques for monitoring for fraudulent login attempts to remote services through an application. The method generally includes receiving a request to connect an application to a remote service. A login attempt counter tracking a number of attempts by a user to connect the application to one or more remote services is incremented. Based on determining that the login attempt counter is less than a maximum number of login attempts predicted to correspond to legitimate login activity in the application, the first username is compared to a second username included in a previous request. A distance is calculated between the first username and the second username, and one or more actions are taken to process the request based on determining whether the calculated distance exceeds a maximum predicted distance between usernames in successive requests that corresponds to legitimate login activity.

Method and system for monitoring for and blocking fraudulent attempts to log into remote services using list validation attacks

A method that involves receiving a set of first log records. The set of first log records are duplicated using key operation pairs to generate a set of second log records from the set of first log records. The set of second log records are duplicated using a second set of intervals to generate a set of third log records from the set of second log records. The set of third log records are aggregated using the second set of intervals to generate a set of aggregated log records. The set of aggregated log records includes an aggregated log record comprising a number indicating a number of events from the set of first log records that have the key, that have the operation, and that occurred during an interval of the second set of intervals. The operation is identified by comparing the aggregated log record to a server log record.

Systems and methods for log aggregation

A method for increasing computer network security. A first request to attach a first user account for a software program to an external secure account is received. The first request includes a first set of user credentials for accessing the external secure account and a first unverified email address, the external secure account controlled by a second external computer. After receiving the first request, features having metrics is received. The metrics describe at least creation of the first user account and include at least the first unverified email address. A machine learning model processing the features calculates a probability score that the first request is fraudulent. The probability score is compared to a threshold to form a comparison result. A security action is performed with respect to attaching the first user account to the external secure account in response to the comparison result.

Machine learning detection of fraudulent validation of financial institution credentials

A method for detecting an unauthorized activity on a computer system involves obtaining current time stamps for a first type of access event related to the computer system, determining a current count of the first type of access event using the current time stamps, and predicting an expected count of the first type of access event using a current count of time stamps and a predictive model. The method further involves obtaining an actual count of the first type of access event, executing a first comparison of the actual count with the expected count, determining, based on a test comprising the first comparison, that the unauthorized access to the computer system occurred, and issuing an alert indicating the unauthorized activity occurred.

Growing community of inventors

Hod Hasharon, Israel

Noah Eyal Altman