Paypal, Inc.

Zhe Chen

Quan Jin Ferdinand Tang

Hewen Wang

Yuzhen Zhuo

Mandar Ganaba Gaonkar

Solomon Kok How Teo

Omkumar Mahalingam

Kenneth Bradley Snyder

Jiyi Zhang

Shanshan Peng

Rushik Navinbhai Upadhyay

Xiaodong Yu

Van Hoang Nguyen

Jiazheng Zhang

Francesco Gelli

Hong Qian

Runmin Wen

Serafin Trujillo

Panpan Qi

Fei Pei

Amit Nahata

Systems/techniques for facilitating context-enhanced category classification are provided. In various embodiments, a system can access a first textual description of a product or service. In various aspects, the system can identify, via execution of named entity recognition, one or more keywords in the first textual description. In various instances, the system can access, from a set of queryable databases, one or more second textual descriptions that respectively correspond to the one or more keywords. In various cases, the system can generate, via execution of word embedding, a first numerical representation of the first textual description and one or more second numerical representations of the one or more second textual descriptions. In various aspects, the system can identify, via execution of a machine learning classifier, a category label for the product or service, based on the first numerical representation and the one or more second numerical representations.

Context-enhanced category classification to generate product category labels used to conduct electronic transactions based on regulatory restrictions

Methods and systems are presented for bot detection. A movement of a pointing device is tracked via a graphical user interface (GUI) of an application executable at a user device. Movement data associated with different locations of the pointing device within the GUI is obtained. The movement data is mapped to functional areas corresponding to a range of the different locations of the pointing device within the GUI over consecutive time intervals. At least one vector representing a sequence of movements for at least one trajectory of the pointing device through one or more of the functional areas and a duration the pointing device stays within each functional area is generated. At least one trained machine learning model is used to determine whether the sequence of movements of the pointing device was produced through human interaction with the pointing device by an actual user of the user device.

Two-sided machine learning framework for pointer movement-based bot detection

Systems and/or techniques for facilitating image forgery detection via pixel-metadata consistency analysis are provided. In various embodiments, a system can receive an electronic image from a client device. In various cases, the system can obtain a pixel vector and/or an image metadata vector that correspond to the electronic image. In various aspects, the system can determine whether the electronic image is authentic or forged, based on analyzing the pixel vector and the image metadata vector via at least one machine learning model.

Image forgery detection via pixel-metadata consistency analysis

Techniques are disclosed relating to determining whether to authorize a requested action based on whether an entity is an automated computer. In some embodiments, a computer system tracks, at a user interface of a computing device, a sequence of pointer movements. The computer system maps, based on coordinate locations of pointer movements in the sequence, respective movements in the sequence to a plurality of functional areas. Based on the mapping, the computer system generates a movement graph and determines, based on the movement graph, whether an entity associated with the sequence of pointer movements is an automated computer. In response to receiving a request to authorize an action at the computing device, the computer system generates, based on the determining, an authorization decision for the action and transmits the authorization decision to the computing device. Determining whether the entity is an automated computer may advantageously prevent fraudulent activity.

Pointer movement modelling for entity classification

Systems and methods for user-agent anomaly detection are disclosed. In one embodiment, a user-agent string may be embedded into a numerical data vector representation using a sentence embedding algorithm (e.g., FastText). A predictive score may be calculated based on the numerical data vector representation and using a probability distribution function model that models a likelihood of occurrence of the observed user-agent based on patterns learned from historic payload data (e.g., a Gaussian Mixture Model). The predictive score may be compared to a threshold and, based on the comparison, it may be determined whether the user-agent is fraudulent.

User-agent anomaly detection using sentence embedding

Systems and methods for emulator detection are disclosed. In one embodiment, a user agent string may be embedded into a first numerical data vector representation. Hardware characteristics of a client device corresponding to the user agent may be embedded into a second numerical data vector representation. Based on the first numerical data vector representation of the user agent and the second numerical data vector representation of the hardware characteristics, and their consistency, the client device may be determined to be an emulator or a non-emulator device.

Emulator detection using user agent and device model learning

Methods and systems are presented for generating a device fingerprint based on data obtained from one or more sensors on a device. A plurality of data points corresponding to sensor readings are obtained from the one or more sensors on the device. A set of time-domain features and a set of frequency-domain features are extracted from the plurality of data points and inputted to a neural network trained using a triplet network. A device fingerprint that may be used to identify the device is obtained from the neural network.

System and method for fingerprinting a device based on sensor data

A computer system receives a first set of information that describes a set of transactions between pairs of user accounts of a service and a second set of information that specifies attribute values for user accounts of the service that are recipient user accounts within the set of transactions. Using the first set of information and the second set of information, the computer system generates an augmented graph model of the transactions and attribute values. By applying modularity maximization to the augmented graph model, the computer system determines a plurality of subsets of recipient user accounts.

Determining subsets of accounts using a model of transactions

Systems and methods for detecting network anomalies are described. These may include determining burst scores for external network resources, determining burst scores for internal network resources, and using the burst scores to construct a burst graph where the edges are weighted by the number of connections between each resource. The graph is then analyzed by a graph convolutional neural network to identify patterns from which anomalous network traffic can be detected and from which corrective action can be taken. These techniques can allow for better detection and mitigation of abusive network traffic, improve computer network security, and provide more robust access to networked computer resources.

Systems and methods for network anomaly detection and resolution

Techniques are disclosed for determining predictions from a graph of a network dataset. The graph of the network dataset may include nodes describing entities and edges describing connections or links between the entities. Predictions may be made using a dual-path convolution network that considers both node connectivity and node topology. Node topology includes assessment of similarities in topology roles between nodes in the graph, even nodes that reside in different parts of the graph. The node connectivity and node topology in the dual-path convolution may be aligned using a multi-head attention network. Outputs from previous layers of the multi-head attention network may be provided as inputs to subsequent layers of the dual-path convolution to mutually reinforce the convolutions determining node connectivity and node topology toward alignment.

Growing community of inventors

Singapore, Singapore

Zhe Chen