Visa International Service Association

Yu-San Lin

Hao Yang

Yuhang Wu

Michael Yeh

Fei Wang

Bo Dong

Chiranjeet Chetia

Yanhong Wu

Hossein Hamooni

Maryam Moosaei

Shubham Agrawal

Huiyuan Chen

Lan Wang

Linyun He

Ishita Bindlish

Systems, methods, and computer program products for multi-domain ensemble learning based on multivariate time sequence data are provided. A method may include receiving multivariate sequence data. At least a portion of the multivariate sequence data may be inputted into a plurality of anomaly detection models to generate a plurality of scores. The multivariate sequence data may be combined with the plurality of scores to generate combined intermediate data. The combined intermediate data may be inputted into a combined ensemble model to generate an output score. In response to determining that the output score satisfies a threshold, at least one of an alert may be communicated to a user device, the multivariate sequence data may be inputted into the feature-domain ensemble model to generate a feature importance vector, or at least one of a model-domain, a time-domain, a feature-domain, or the combined ensemble model may be updated.

System, method, and computer program product for multi-domain ensemble learning based on multivariate time sequence data

Disclosed are a system, method, and computer program product for user network activity anomaly detection. The method includes generating a multilayer graph from network resource data, and generating an adjacency matrix associated with each layer of the multilayer graph to produce a plurality of adjacency matrices. The method further includes assigning a weight to each adjacency matrix to produce a plurality of weights, and generating a merged single layer graph by merging the plurality of layers based on a weighted sum of the plurality of adjacency matrices using the plurality of weights. The method further includes generating a set of anomaly scores by generating, for each node in the merged single layer graph, an anomaly score. The method further includes determining a set of anomalous users based on the set of anomaly scores, detecting fraudulent network activity based on the set of anomalous users, and executing a fraud mitigation process.

System, method, and computer program product for user network activity anomaly detection

Systems, methods, and computer program products for predicting user preference of items in an image process image data associated with a single image with a first branch of a neural network to produce an image embedding, the single image including a set of multiple items; process a user identifier of a user with a second branch of the neural network to produce a user embedding; concatenate the image embedding with the user embedding to produce a concatenated embedding; process the concatenated embedding with the neural network to produce a joint embedding; and generate a user preference score for the set of multiple items from the neural network based on the joint embedding, the user preference score including a prediction of whether the user prefers the set of multiple items.

System, method, and computer program product for predicting user preference of items in an image

A method includes receiving a first data set comprising embeddings of first and second types, generating a fixed adjacency matrix from the first dataset, and applying a first stochastic binary mask to the fixed adjacency matrix to obtain a first subgraph of the fixed adjacency matrix. The method also includes processing the first subgraph through a first layer of a graph convolutional network (GCN) to obtain a first embedding matrix, and applying a second stochastic binary mask to the fixed adjacency matrix to obtain a second subgraph of the fixed adjacency matrix. The method includes processing the first embedding matrix and the second subgraph through a second layer of the GCN to obtain a second embedding matrix, and then determining a plurality of gradients of a loss function, and modifying the first stochastic binary mask and the second stochastic binary mask using at least one of the plurality of gradients.

Structured graph convolutional networks with stochastic masks for network embeddings

Described are a system, method, and computer program product for user network activity anomaly detection. The method includes receiving network resource data associated with network resource activity of a plurality of users and generating a plurality of layers of a multilayer graph from the network resource data. Each layer of the plurality of layers may include a plurality of nodes, which are associated with users, connected by a plurality of edges, which are representative of node interdependency. The method also includes generating a plurality of adjacency matrices from the plurality of layers and generating a merged single layer graph based on a weighted sum of the plurality of adjacency matrices. The method further includes generating anomaly scores for each node in the merged single layer graph and determining a set of anomalous users based on the anomaly scores.

Methods for detecting insider threats are disclosed. A method includes collecting server access data and application access data, based on the server access data and the application access data, determining nearest neighbors of an employee, and based on the nearest neighbors of the employee, determining a peer group of the employee, determining an average rank distance (ARD) of the nearest neighbors based on a ranking of the nearest neighbors in a plurality of time periods, identifying ARD gaps between the nearest neighbors, and generating scores corresponding to the ARD gaps between the nearest neighbors. One or more employees are identified that represent an internal threat to an organization based on the scores corresponding to the ARD gaps.

Growing community of inventors

Mountain View, CA, United States of America

Yu-San Lin