Visa International Service Association

Yuhang Wu

Hao Yang

Sunpreet Singh Arora

Yu-San Lin

Yanhong Wu

Michael Yeh

Bo Dong

Luan Nguyen

Wei Zhang

Mahdi Zamani

Chiranjeet Chetia

Peter Rindal

Srinivasan Raghuraman

Fei Wang

Shubham Agrawal

Hossein Hamooni

Yizhen Wang

Aravind Sankar

Linyun He

Ishita Bindlish

Sebastian Meiser

Panagiotis Chatzigiannis

Harshal Bhadreshkumar Shah

Andrew Beams

Methods and systems for performing federated private anomaly detection are disclosed. An anomaly detector computer can collaborate with an aggregator computer and an account management computer in order to train machine learning models, which can be used to classify events as not fraudulent or fraudulent. The anomaly detector computer can obliviously use private information (e.g., account flags and account flag values) held by the account management computer to train and use the machine learning models, such that the anomaly detector does not become aware of the account flags or account flags values. Such a system can be used, for example, for the detection and prevention of financial crime. The anomaly detector computer can use the account flag information possessed by the account management computer to identify fraudulent events performed by customers of the organization operating the account management computer.

Secure anomaly detection using federated learning

Provided are systems for determining adversarial examples that include at least one processor to determine a first additional input from a plurality of additional inputs based on a proximity of the first additional input to an initial input, determine a second additional input from the plurality of additional inputs based on a proximity of the second additional input to the first additional input, generate a first vector embedding, a second vector embedding and a third vector embedding based on the second additional input, generate a first relational embedding, a second relational embedding, and a third relational embedding based on the third vector embedding and the first vector embedding, concatenate the first relational embedding, the second relational embedding, and the third relational embedding to provide a concatenated version, and determine whether the first input is an adversarial example based on the concatenated version. Methods and computer program products are also provided.

System, method, and computer program product for determining adversarial examples

Systems, methods, and computer program products for multi-domain ensemble learning based on multivariate time sequence data are provided. A method may include receiving multivariate sequence data. At least a portion of the multivariate sequence data may be inputted into a plurality of anomaly detection models to generate a plurality of scores. The multivariate sequence data may be combined with the plurality of scores to generate combined intermediate data. The combined intermediate data may be inputted into a combined ensemble model to generate an output score. In response to determining that the output score satisfies a threshold, at least one of an alert may be communicated to a user device, the multivariate sequence data may be inputted into the feature-domain ensemble model to generate a feature importance vector, or at least one of a model-domain, a time-domain, a feature-domain, or the combined ensemble model may be updated.

System, method, and computer program product for multi-domain ensemble learning based on multivariate time sequence data

Disclosed are a system, method, and computer program product for user network activity anomaly detection. The method includes generating a multilayer graph from network resource data, and generating an adjacency matrix associated with each layer of the multilayer graph to produce a plurality of adjacency matrices. The method further includes assigning a weight to each adjacency matrix to produce a plurality of weights, and generating a merged single layer graph by merging the plurality of layers based on a weighted sum of the plurality of adjacency matrices using the plurality of weights. The method further includes generating a set of anomaly scores by generating, for each node in the merged single layer graph, an anomaly score. The method further includes determining a set of anomalous users based on the set of anomaly scores, detecting fraudulent network activity based on the set of anomalous users, and executing a fraud mitigation process.

System, method, and computer program product for user network activity anomaly detection

Training an adversarial perturbation detector comprises accessing a training set comprising an enrolled biometric sample xand a public biometric sample x of an enrolled user, and submitted biometric samples x' of a second user, the submitted biometric samples x′ comprising perturbed adversarial samples x′+Δx′. A transformation function k(⋅) is provided having learnable a parameter θ and a classifier having a learnable parameter σ. The training set is used to learn the parameters θ and σ by inputting the training set to the transformation function k(⋅). The transformation function k(⋅) generates transformed enrolled samples k(x), a transformed public biometric sample k(x), and a transformed adversarial sample k(x′+Δx′). The classifier classifies the transformed adversarial sample k(x′+Δx′) as a success or as a fail based on the transformed enrolled samples k(x). Based on a result of the classification, the learnable parameters θ and σ are updated.

Using an enrolled biometric dataset to detect adversarial examples in biometrics-based authentication system

Provided are methods that include determining a set of transaction related actions for an agent, selecting a first transaction related action from the set of transaction related actions for the agent based on a plurality of features associated with the agent, generating transaction data associated with a fraudulent transaction based on the first transaction related action, generating a feature vector, the feature vector including transaction data associated with the fraudulent transaction, providing the feature vector as an input to a fraud detection machine learning model. Methods may also include determining an output of the fraud detection machine learning model based on the feature vector as the input, and generating a fraudulent reward parameter for the first transaction related action based on the output of the fraud detection machine learning model. Systems and computer program products are also provided.

System, method, and computer program product for evaluating a fraud detection system

Described are a system, method, and computer program product for user network activity anomaly detection. The method includes receiving network resource data associated with network resource activity of a plurality of users and generating a plurality of layers of a multilayer graph from the network resource data. Each layer of the plurality of layers may include a plurality of nodes, which are associated with users, connected by a plurality of edges, which are representative of node interdependency. The method also includes generating a plurality of adjacency matrices from the plurality of layers and generating a merged single layer graph based on a weighted sum of the plurality of adjacency matrices. The method further includes generating anomaly scores for each node in the merged single layer graph and determining a set of anomalous users based on the anomaly scores.

Embodiments of the invention are directed to systems, methods, and devices for testing the security of a facial recognition system (FRS). A target image depicting a target person enrolled in the FRS and a tester image depicting a tester may be obtained. A plurality of transformed images may be generated from an image of the target person or the tester image. A processed tester image (e.g., one that is likely to cause the FRS to misclassify) may be identified using the plurality of transformed images, the tester image, and the target image. Data representing a light pattern can be generated using the processed tester image and the light pattern can be projected onto a second person. Another image may be captured of the second person with the light pattern as projected. This image may be provided to the FRS and a remedial action may be performed based on the corresponding output.

Evaluating the security of a facial recognition system using light projections

A computer-implemented method for improving security of a biometrics-based authentication system comprises receiving, by one or more servers, enrolled biometric samples of an enrolled user during an enrollment stage of the biometrics-based authentication system. Augmented biometric samples are created by adding learned perturbations to the enrolled biometric samples of the enrolled user. During a request for authentication, submitted biometric samples are received from a second user. The submitted biometric samples of the second user are compared to the enrolled biometric samples and to the augmented biometric samples of the enrolled user based on predefined metrics. Based on the comparison it is determined whether the submitted biometric samples of the second user have been modified to impersonate the enrolled user.

Methods for detecting insider threats are disclosed. A method includes collecting server access data and application access data, based on the server access data and the application access data, determining nearest neighbors of an employee, and based on the nearest neighbors of the employee, determining a peer group of the employee, determining an average rank distance (ARD) of the nearest neighbors based on a ranking of the nearest neighbors in a plurality of time periods, identifying ARD gaps between the nearest neighbors, and generating scores corresponding to the ARD gaps between the nearest neighbors. One or more employees are identified that represent an internal threat to an organization based on the scores corresponding to the ARD gaps.

Methods and systems for peer grouping in insider threat detection

A computer-implemented method is disclosed for training neural networks of a group recommender to provide item recommendations for ephemeral groups having group interaction sparsity. A preference encoder and aggregator generate user and group preference embeddings from user-item interactions, wherein the preference embeddings form a latent user-group latent embedding space. The neural preference encoder and the aggregator are trained by regularizing the latent user-group embedding space to overcome the group interaction sparsity by: i) maximizing user-group mutual information (MI) between the group embeddings and the user embeddings so that the group embeddings encode shared group member preferences, while regularizing the user embeddings to capture user social associations, and ii) contextually identifying informative group members and regularizing the corresponding group embeddings using a contextually weighted user loss value to contextually weight users' personal preferences in proportion to their user-group MI to reflect personal preferences of the identified informative group members.

Growing community of inventors

Foster City, CA, United States of America

Yuhang Wu