Paypal, Inc.

Tomer Handelman

Itay Margolin

Iulian-Corneliu-Ran Locar

Avishay Meron

Shay Elbaz

Shuly Lev-Yehudi

Methods and systems are presented for imputing missing data items within a first dataset based on data associated with a second dataset that is the nearest neighbor of the first dataset. A first mapping model is configured to map data subsets corresponding to a first data source to first positions in a multi-dimensional space. A second mapping model is configured to map data subsets corresponding to a second data source to second positions in the multi-dimensional space. The first and second mapping models are trained together to reduce a distance between positions mapped by the first and second mapping models based on corresponding data subsets that belong to the same entity. A nearest neighbor dataset to the first dataset is identified based on the first and second mapping models. Data associated with the nearest neighbor dataset is used to impute the missing data items of the first dataset.

Deep mapping for imputing nulls

Techniques are disclosed relating to automatically determining whether an entity is malicious. In some embodiments, a server computer system generates a feature vector for an unknown website, where generating the feature vector includes preprocessing a plurality of structural features of the unknown website. In some embodiments, the system inputs the feature vector for the unknown website into a trained neural network. In some embodiments, the system applies a clustering algorithm to a signature vector for the unknown website and signature vectors for respective ones of a plurality of known websites output by the trained neural network. In some embodiments, the system determines, based on results of the clustering algorithm indicating similarities between signature vectors for the unknown website and one or more of the signature vectors for the plurality of known websites, whether the unknown website is suspicious. Determining whether the entity is suspicious may advantageously prevent malicious (fraudulent) activity.

Detecting suspicious entities

Techniques are disclosed relating to machine learning techniques for performing user authentication based on the manner in which a user interacts with a client device, including the use of Siamese networks to detect unauthorized use of a device and/or account. In some embodiments, a server system may receive a request to authorize a transaction associated with a user account. The request may include transaction details and, separate from those transaction details, interaction data indicative of a manner in which a requesting user interacts with a client device during a user session. The server system may apply a machine learning model to the interaction data to create an encoding value that is based on the manner in when the requesting user interacts with the client device during the user session. The server system may then compare the encoding value to a reference encoding value and, based on the comparison, determine whether to authorize the transaction.

Machine learning techniques for performing authentication based on a user's interaction with a client device

Methods and systems are presented for configuring a risk assessment engine to predict a risk of a user based on a topic classification across a set of unknown topics generated by a topic model. A risk determination system obtains a plurality of transactions previously conducted by a user. The risk determination system generates a risk document comprising a sequence of words that describe the plurality of transactions. A topic model is used to determine a topic classification for the user based on the sequence of words. The topic model comprises a natural language processor configured to classify the risk document to one or more topics based on the words within the risk document. The risk determination system configures the risk assessment engine to accept the topic classification as input value(s) for predicting a risk associated with the user.

Systems and methods for generating a machine learning model for risk determination

A system and method for generating automatic false positive estimations for website matching is described. Several sets of assets and Uniform Resource Locators (URLs) are aggregated. Each of the several sets of assets is searched across webpage content corresponding to the several URLs to determine matches between the sets of assets and webpage content. One or more false positive estimations is determined, where each of the one or more false positive estimations corresponds to the one or more matches. A combined score is generated based on the one or more false positive estimations.

Automatic false positive estimation for website matching

Methods and systems for identifying characteristics of a user (e.g., a seller) based on Natural Language Processing (NLP). Transaction data of buyers may be collected to generate a sequence paragraph of seller name information for each buyer. NLP techniques such as word2vec may be used to vectorize the seller name information to determine relationships between sellers. Industry information may be determined using the vectors. Reliability checks may be performed to determine whether the data is robust to label the determined data.

Identifying changes in user characteristics using natural language processing

Systems and methods are disclosed for managing data objects that include text content that are stored in a database. The management of text objects includes determining that a condition for a data object associated with a user has been satisfied. In response, a relevancy score for the data object is generated. The relevancy score is based on the text content of the data object and a density estimation model associated with the user. The density estimation is generated using a plurality of data objects that each include text content and that are associated with a plurality of users of a service associated with the data objects, and using a set of the plurality of data objects that are associated with the user. Irrelevancy actions or relevancy actions may be performed to the data object based on the relevancy score.

Text object management system

Descriptions of items are offered for sale by one or more merchants in an online marketplace. The online marketplace comprises a website hosted by a server. The descriptions are electronically scanned or otherwise accessed. The scanned descriptions are deconstructed into a plurality of N-grams. Each N-gram includes a combination of words appearing in the descriptions of items. The electronic scan and deconstruction are repeated over a plurality of predefined time periods. For each N-gram, a frequency of occurrence is monitored in each of the predefined time periods. Based on the monitoring, a determination is made that a first N-gram of the plurality of N-grams whose frequency of occurrence has exceeded a predefined threshold in one of the predefined time periods. Risks of transactions involving one or more items whose descriptions contain the first N-gram are evaluated.

Growing community of inventors

Ramat Gan, Israel

Tomer Handelman