Paypal, Inc.

Solomon Kok How Teo

Quan Jin Ferdinand Tang

Yuzhen Zhuo

Hewen Wang

Zhe Chen

Mandar Ganaba Gaonkar

Omkumar Mahalingam

Kenneth Bradley Snyder

Jiyi Zhang

Shanshan Peng

Serafin Trujillo

Panpan Qi

Fei Pei

Methods and systems are presented for bot detection. A movement of a pointing device is tracked via a graphical user interface (GUI) of an application executable at a user device. Movement data associated with different locations of the pointing device within the GUI is obtained. The movement data is mapped to functional areas corresponding to a range of the different locations of the pointing device within the GUI over consecutive time intervals. At least one vector representing a sequence of movements for at least one trajectory of the pointing device through one or more of the functional areas and a duration the pointing device stays within each functional area is generated. At least one trained machine learning model is used to determine whether the sequence of movements of the pointing device was produced through human interaction with the pointing device by an actual user of the user device.

Two-sided machine learning framework for pointer movement-based bot detection

Techniques are disclosed relating to determining whether to authorize a requested action based on whether an entity is an automated computer. In some embodiments, a computer system tracks, at a user interface of a computing device, a sequence of pointer movements. The computer system maps, based on coordinate locations of pointer movements in the sequence, respective movements in the sequence to a plurality of functional areas. Based on the mapping, the computer system generates a movement graph and determines, based on the movement graph, whether an entity associated with the sequence of pointer movements is an automated computer. In response to receiving a request to authorize an action at the computing device, the computer system generates, based on the determining, an authorization decision for the action and transmits the authorization decision to the computing device. Determining whether the entity is an automated computer may advantageously prevent fraudulent activity.

Pointer movement modelling for entity classification

Systems and methods for user-agent anomaly detection are disclosed. In one embodiment, a user-agent string may be embedded into a numerical data vector representation using a sentence embedding algorithm (e.g., FastText). A predictive score may be calculated based on the numerical data vector representation and using a probability distribution function model that models a likelihood of occurrence of the observed user-agent based on patterns learned from historic payload data (e.g., a Gaussian Mixture Model). The predictive score may be compared to a threshold and, based on the comparison, it may be determined whether the user-agent is fraudulent.

User-agent anomaly detection using sentence embedding

Systems and methods for emulator detection are disclosed. In one embodiment, a user agent string may be embedded into a first numerical data vector representation. Hardware characteristics of a client device corresponding to the user agent may be embedded into a second numerical data vector representation. Based on the first numerical data vector representation of the user agent and the second numerical data vector representation of the hardware characteristics, and their consistency, the client device may be determined to be an emulator or a non-emulator device.

Emulator detection using user agent and device model learning

Growing community of inventors

Singapore, Singapore

Solomon Kok How Teo