Intuit, Inc.

Or Basson

Yehezkel Shraga Resheff

Noah Eyal Altman

Yair Horesh

Aviv Ben Arie

Shir Meir Lador

Miriam Hanna Manevitz

Liat Ben Porat Roda

Hagai Fine

This disclosure relates to systems and methods for identifying fraudulent email addresses associated with an electronic payment service. In some implementations, a computing device receives an email with a prefix having a number of characters and characterized by a prefix length indicative of the number of characters in the prefix. The computing device identifies each of a number of bigrams is identified within the prefix, and determines a row and column distance for each bigram between two consecutive characters of the bigram as positioned on a keyboard. The computing device calculates a Euclidean distance between the two consecutive characters of the bigram based on the row and column distances, and determines a normalized distance based on the prefix length and an average of the Euclidean distances calculated for the number of bigrams in the prefix. The normalized distance is compared with a value to classify the email as suspicious or as not suspicious.

Detecting fraud by calculating email address prefix mean keyboard distances using machine learning optimization

A plurality of graph snapshots for a plurality of consecutive periodic time samples maps between connected components in consecutive graph snapshots and describes at least one feature of each connected component. A recursively-built tree tracks an evolution of one of the connected components through the plurality of graph snapshots, the tree including a root node representing the connected component at a final one of the consecutive periodic time samples and a plurality of leaf nodes branching from the root node. A plurality of paths is extracted from the tree by traversing the tree from the root node to respective ones of the plurality of leaf nodes. Each path contains data describing an evolution of a respective one of the connected components through time as indicated by evolution of the at least one feature of the respective one of the connected components. Each of the plurality of paths is converted into a respective numerical vector of a plurality of numerical vectors that may be used as inputs to a time series anomaly detection algorithm.

Feature extraction and time series anomaly detection over dynamic graphs

Techniques for monitoring for fraudulent login attempts to remote services through an application. The method generally includes receiving a request to connect an application to a remote service. A login attempt counter tracking a number of attempts by a user to connect the application to one or more remote services is incremented. Based on determining that the login attempt counter is less than a maximum number of login attempts predicted to correspond to legitimate login activity in the application, the first username is compared to a second username included in a previous request. A distance is calculated between the first username and the second username, and one or more actions are taken to process the request based on determining whether the calculated distance exceeds a maximum predicted distance between usernames in successive requests that corresponds to legitimate login activity.

Method and system for monitoring for and blocking fraudulent attempts to log into remote services using list validation attacks

Growing community of inventors

Tel Aviv, Israel

Or Basson