Paypal, Inc.

Raoul Christopher Johnson

Jakub Burgis

Muhammad Saad

Ran Sun

David Tolpin

Adam Oest

Omri Moshe Lahav

Bradley Wardman

Meethil Vijay Yadav

Blake Morgan Butler

Eric Nunes

Michael Dymshits

Andrew Marshall

Christopher Harkness

Penghui Zhang

Michael Weideman

Sai Raghavendra Maddhuri Venkata Subramaniya

Methods and systems for digital hot wallet protection are provided. A payment channel is established via a Layer-2 network of a cryptocurrency blockchain for transferring a cryptocurrency balance from a first digital wallet of a service provider to a second digital wallet of a trusted entity over a plurality of commitment transactions. A transaction receipt for each commitment transaction is transmitted to the trusted entity via a secure communication channel previously established between the service provider and the trusted entity outside of the Layer-2 network. A transaction log of the service provider is modified so that it no longer represents the current transaction state of the payment channel. Responsive to detecting a breach of the first wallet, a transaction is broadcast to a Layer-1 network of the blockchain for transferring the total cryptocurrency balance from the first wallet to the second wallet.

Hot wallet protection using a layer-2 blockchain network

Methods and systems are presented for cross-entity fraud mitigation. A refund request for a transaction between a first entity and a second entity is received via a network from a device of the first entity. A transaction history associated with an account of the first entity with a service provider is obtained. From the obtained transaction history, metadata relating to previous refund requests processed for previous transactions associated with the account of the first entity is extracted. The extracted metadata is evaluated to determine a risk score for the refund request received for the transaction, where the risk score indicating a risk of fraud associated with the refund request. A decision on authorization of the refund request is generated for the transaction, based on the risk score. A notification of the decision is transmitted via the network to a device of the second entity.

Cross-entity refund fraud mitigation

Methods and systems are presented for providing a framework for facilitating time-sensitive cryptocurrency transactions for users. When a request for processing a time-sensitive cryptocurrency transaction using funds from a cryptocurrency wallet is received from a user, a transaction system first verifies whether the cryptocurrency wallet has a balance to cover the cryptocurrency transaction. The transaction system also verifies the ownership of the cryptocurrency wallet based on an asynchronous method. The user generates verification data without any input from the transaction system, and based on a private key associated with the cryptocurrency wallet, a generator function, and a user-generated value. Without knowing the user-generated value, the transaction system verifies the ownership of the cryptocurrency wallet based on the verification data, and processes the transaction for the user.

Facilitating cryptocurrency-based transactions with time constraint

Aspects of the present disclosure involve systems, methods, devices, and the like for generating compact tree representations applicable to machine learning. In one embodiment, a system is introduced that can retrieve a decision tree structure to generate a compact tree representation model. The compact tree representation model may come in the form of a matrix design to maintain the relationships expressed by the decision tree structure.

System and method for compact tree representation for machine learning

Techniques are disclosed relating to methods that include a process, executing on a computer system, receiving a request to access a website, and altering the request to include one or more characteristics of anti-malware scanners. The method further includes the process sending the altered request to the website, and receiving a response to the altered request. The method also includes the process detecting whether the received response utilizes one of a known set of anti-malware cloaking techniques, and providing, based on the detecting, an output indicative of an outcome of the altered request.

Neutralizing evasion techniques of malicious websites

There are provided systems and methods for a machine learning model for probabilistic anomaly detection in streaming device data. A server obtains a plurality of features associated with a user interaction between a user device and the server. The server selects a combination of features from the plurality of features, where the combination of features comprises features having a variance of expected values that exceeds a threshold variance. The server selects a prediction engine to process the combination of features with a corresponding non-parametric statistical model of a plurality of non-parametric statistical models and to generate a prediction indicating a likelihood that the combination of features represents an anomaly corresponding to fraudulent activity. The server issues a remedial action to the user device through an application programming interface with a remedial action engine based on the prediction for applying the remedial action on the user interaction.

Probabilistic anomaly detection in streaming device data

Methods and systems are presented for tracking activities that occur off of a first layer blockchain in in a second layer network built on the first layer blockchain. In one embodiment, a computer system determines that a transfer of cryptocurrency from a first node to a second node has transpired in the second layer network based on querying channel capacities in the second layer network. The computer system determines a first public address for the first node based on information associated with a first channel that connects the computer system and the first node in the second layer network, and determines a second public address for the second node based on information associated with a second channel that connects the computer system and the second node in the second layer network. The first public address and the second public address are used to monitor activity in the first layer blockchain.

Laundering detection in second layer networks

A method for generating a smart protocol includes providing, by a server computer system, a user interface to one or more of a plurality of users. The server computer system may receive, via the user interface, input specifying terms corresponding to a smart protocol that is to be deployed on a particular blockchain platform. The specified terms may include the plurality of users associated with the smart protocol and a web resource to be used to identify one or more external data. An execution of the smart protocol may be based on a value of the external data. Based on the specified terms, the server computer system may generate, without further input from the plurality of users, the smart protocol. The server computer system may deploy the smart protocol to the particular blockchain platform.

Interface for constructing smart protocols for execution on blockchain platforms

Methods and systems for digital hot wallet protection are provided. A payment channel is established via a Layer-2 network of a cryptocurrency blockchain for transferring a cryptocurrency balance from a first digital wallet of a service provider to a second digital wallet of a trusted entity over a plurality of commitment transactions. A transaction receipt for each commitment transaction is transmitted to the trusted entity via a secure communication channel previously established between the service provider and the trusted entity outside of the Layer-2 network. A transaction log of the service provider is modified so that it no longer represents the current transaction state of the payment channel Responsive to detecting a breach of the first wallet, a transaction is broadcast to a Layer-1 network of the blockchain for transferring the total cryptocurrency balance from the first wallet to the second wallet.

Methods and systems for fictitious account generation on detection of account takeover conditions are described. A login attempt may be detected and determined to indicate fraud, such as when the login attempt is accompanied by many failed login attempts or is from an untrusted or known malicious endpoint. A fictitious account may be generated, which may include falsified account data and may limit account functionality to prevent unauthorized and fraudulent use of the account. The computing device that performs the login attempt may be routed and permitted to log in to the fictitious account, where the service provider or another computing entity may then monitor activity and usage of the fictitious account by the potentially malicious party. The fictitious account may be maintained so that other actors using the account may access the account and their activity also monitored.

Fictitious account generation on detection of account takeover conditions

There are provided systems and methods for a voice vector framework that authenticates user interactions. A service provider server receives user interaction data having audio data that is associated with an interaction between a user device and the service provider server. The server extracts user attributes from the audio data and obtains user account information associated with the user device. The server selects a classifier that corresponds to a select combination of features based on the user account information and applies the classifier to the user attributes. The server generates a voice vector that includes multiple scores indicating likelihoods that a respective user attribute corresponds to an attribute of the select combination of features. The server compares the voice vector to a baseline vector corresponding to a predetermined combination of features and sends a notification to an agent device with an indication of whether the user device is verified.

Voice vector framework for authenticating user interactions

There are provided systems and methods for an automated device data retrieval and analysis platform. A service provider server invokes an instance of an application in a remote processing environment using device data associated with the application and sends a control message that prompts the instance to send a request to a web server for a process script that invokes a process executable in the remote processing environment. The service provider server obtains traffic data a behavior of application data based on an interaction between the instance and the web server, and determines features of the application in a native state from the behavior of the application data. The server generates a data profile of the application that indicates the features in the native state and provides the data profile to a remote engine to detect potential malicious activity associated with the application from the detection operation.

Automated device data retrieval and analysis platform

Methods and systems for using cloned accounts to track attacks on user accounts are described. A user login attempt is detected for a user account from a client computing device. A determination is made that the user is not a legitimate user. The user is routed to a cloned user account. An analysis of the interaction between the user and the cloned user account is performed.

Using cloned accounts to track attacks on user accounts

There are provided systems and methods for actionable insight into user interaction data. A service provider server can access user interaction data associated with an interaction between a first communication device and the service provider server, and generates feature representations of the user interaction data, in which the feature representations respectively correspond to extracted features that include textual data features or audio data features. The service provider server can determine an intent of the interaction from the feature representations using a machine learning-trained classifier, in which the intent corresponds to a first actionable insight category. The interaction is mapped to a first cluster based on the intent, and the service provider server issues a remedial action for the interaction based on the mapping of the interaction to the first cluster, in which the remedial action is associated with a particular type of activity in the first actionable insight category.

Growing community of inventors

San Jose, CA, United States of America

Raoul Christopher Johnson