International Business Machines Corporation

Noga Agmon

Andrey Finkelshtein

Eitan Menahem

Itay Hazan

Bar Haim

Yehonatan Bitton

Matan Levi

Anton Puzanov

Shimon Benusovich

Mechanisms are provided for detecting fraudulent user flows associated with a website. User flow data, representing an interaction by a user with content of a website, is received and converted to a vector representation that represents a time series transition from one portion of website content to another of the website. The vector representation is input to a trained sequential machine learning computer model which generates a classification of the vector representation. A determination as to whether or not the user flow data represents a fraudulent user flow is made based on the classification. An output is generated that indicates whether or not the user flow is a fraudulent user flow based on the detection.

Detecting fraudulent user flows

An example system includes a processor to receive mouse event data of a session. The processor is to split the mouse event data of the session into mouse event n-grams. The processor is to extract features from the mouse event n-grams. The processor is to send the extracted features to a trained machine learning model. The processor is to receive an output decision from the trained machine learning model.

Machine learning model trained using features extracted from n-grams of mouse event data

Techniques for verifying the identity of users transferring between devices are disclosed. An example method includes receiving device usage data by monitoring user-device interactions of a first set of users interacting with a first device and a second set of users interacting with a second device. The method also includes extracting features from the data and aggregating feature samples from the user-device interactions for first set of users and the second set of users. The method also includes generating a score for each feature based on an analysis the feature samples. The feature score indicates a degree to which the first set of feature samples and the second set of feature samples differentiate between the devices. The method also includes identifying features as transferrable if the score is below a specified threshold, and generating a new behavior model by modifying existing user behavior data according to the transferrable features.

Behavioral biometrics verification adaptation for cross devices

A machine learning clustering process is trained. Web pages of a website are clustered. User flow data associated with a first browsing session at the website is obtained. The user flow data includes a plurality of web page identifiers (e.g., URLs). A web page record for each of the web page identifiers is generated. Each web page record includes words of the corresponding web page identifier. Clusters of web page identifiers previously output from the trained machine learning clustering process are received. For each of the web page records, a cluster of web page identifiers is identified by mapping the web page record to one of the clusters of web page identifiers using the machine learning clustering process. A directed graph representative of the first browsing session is constructed. One or more nodes of the directed graph are the identified clusters of web page identifiers.

Clustering web page addresses for website analysis

A method for quantifying a similarity between a target dataset and multiple source datasets and identifying one or more source datasets that are most similar to the target dataset is provided. The method includes receiving, at a computing system, source datasets relating to a source domain and a target dataset relating to a target domain of interest. Each dataset is arranged in a tabular format including columns and rows, and the source datasets and the target dataset include a same feature space. The method also includes pre-processing, via a processor of the computing system, each source-target dataset pair to remove non-intersecting columns. The method further includes calculating at least two of a dataset similarity score, a row similarity score, and a column similarity score for each source-target dataset pair, and summarizing the calculated similarity scores to identify one or more source datasets that are most similar to the target dataset.

Growing community of inventors

Giv′at-Shmuel, Israel

Noga Agmon