Abstract: Systems and methods for validating online activities through proof-of-work techniques are provided. In one example, a validating computing system receives a request for a proof-of-work instruction from a client device that has submitted an online activity request to an online server system. The validating computing system generates and transmits a proof-of-work instruction for solving a problem to the client device. The validating computing system further receives a response to the proof-of-work instruction from the client device. The validating computing system generates a validity decision based on whether the client device correctly solved the problem, and transmits, to the online server system, the validity decision for use in granting the online activity request to the online server system.

Abstract: An online security analysis system determines a categorical value in an online activity and also determines conversion factors that are associated with the categorical value. Based on the conversion factors, the online security analysis system identifies at least one aggregated value for a numerical feature that is associated with previous online activities for the categorical value. In addition, the online security analysis system generates an embedding vector that describes the aggregated value associated with the categorical value. The embedding vector is provided to an online activity analysis model that is trained to generate prediction data for the online activity, based on the aggregated values associated with the categorical value. The prediction data is transmitted to an online system for use in controlling access of a client device to a function of the online system.

Abstract: Certain aspects involve a system, computer-implemented method, and computer-readable medium for identifying attributes associated with a target entity such as a person. A hierarchical characterization system receives an attribute and a request for associated identity data. The system generates an identity graph that includes attribute nodes corresponding to respective attributes and online interaction nodes corresponding to respective online interactions. The system correlates at least a subset of the online interactions and at least a subset of the attributes with a particular entity. The system generates a report indicating an identity of the entity and a behavior of the entity based on the correlated online interactions and the correlated attributes.

Abstract: In an example of a method described herein, historical events occurring over a network are detected, and at least one of the historical events is associated with an observed value of a categorical variable. A numerical aggregate value representing the observed value is updated by applying an exponential smoothing function to (i) a prior numerical aggregate value representing prior historical events associated with the observed value and (ii) a count of the historical events associated with the observed value. An event occurring over the network is detected and is associated with the observed value. Features are extracted from the event, where the features include an encoded feature based on the numerical aggregate value to represent the observed value. A predictive model is applied to the features to determine a score representing likelihood of an outcome. Based on the score, access to a resource of the network is controlled.

Abstract: System and methods track events associated with web browser activity along with corresponding browser tab identifiers. A web page is loaded in a browser tab based on a request to a Uniform Resource Locator (URL). A time is identified, and it is determined that a predetermined time interval has elapsed. A storage mechanism is queried to determine whether an event log stored to the storage mechanism contains a stored tab identifier for the browser tab. If the tab identifier is not stored to the event log, then a tab identifier is stored to the event log, mapped to the time and the URL. If the event log contains the stored tab identifier for the tab, then the event log is updated to include the time mapped to the tab identifier. The URL may also be updated if applicable. The event log is transmitted to a server computer for further analysis.

Abstract: A method described herein involves various operations directed toward network security. The operations include accessing a traffic attribute describing a feature of network traffic. The operations further include determining a baseline distribution for the traffic attribute of a baseline set of transactions involving an online system over a baseline period and, additionally, determining an observed distribution for the traffic attribute of an observed set of transactions involving the online system over an observed period. Using the observed distribution and the baseline distribution, an attribute risk value for the traffic attribute is computed. The operations further include detecting that an anomaly exists in the traffic attribute of the observed set of transactions, based on the attribute risk value.

Abstract: A method described herein involves various operations directed toward network security. The operations include accessing transaction data describing network traffic associated with a web server during an interval. Based on a count of new transactions involving an online entity during the interval according to the transaction data, a short-term trend is determined for the online entity. The operations further include applying exponential smoothing to a history of transactions of the online entity to compute a long-term trend for the online entity. Based on a comparison between the short-term trend and the long-term trend for the online entity, an anomaly is detected with respect to the online entity in the network traffic associated with the web server. Responsive to detecting the anomaly, an access control is implemented between the online entity and the web server.

Abstract: A method described herein involves various operations directed toward network security. The operations include accessing a traffic attribute describing a feature of network traffic. The operations further include determining a baseline distribution for the traffic attribute of a baseline set of transactions involving an online system over a baseline period and, additionally, determining an observed distribution for the traffic attribute of an observed set of transactions involving the online system over an observed period. Using the observed distribution and the baseline distribution, an attribute risk value for the traffic attribute is computed. The operations further include detecting that an anomaly exists in the traffic attribute of the observed set of transactions, based on the attribute risk value.

Abstract: Systems and methods for storing information in a web browser by dynamically generating service worker codes are provided. In one example, an online system receives a request from a client device to store data included in the request in a service worker code. The online system modifies a source code of a particular service worker code to include the data to be stored and transmits the modified service worker code to the client device. The client device receives and stores the modified service worker code embedded with the data. The client device receives a request for a particular data associated with a web page and determines that the modified service worker code contains the requested particular data. The client device retrieves the requested particular data from the modified service worker code and updates the web page with the retrieved particular data.

Abstract: A method described herein involves various operations directed toward network security. The operations include accessing transaction data describing network traffic associated with a web server during an interval. Based on a count of new transactions involving an online entity during the interval according to the transaction data, a short-term trend is determined for the online entity. The operations further include applying exponential smoothing to a history of transactions of the online entity to compute a long-term trend for the online entity. Based on a comparison between the short-term trend and the long-term trend for the online entity, an anomaly is detected with respect to the online entity in the network traffic associated with the web server. Responsive to detecting the anomaly, an access control is implemented between the online entity and the web server.

Abstract: Online entities oftentimes desire to ascertain information about their audience members. To determine information about audience members and their activities, online transactions including information about transactions performed by audience members are collected. One or more audience analysis processes are applied to the online transactions to determine the collection of online transactions performed by a given audience member. With an accurate assignment of online transaction to the audience member, the audience member and associated transactions may be classified as a legitimate or illegitimate.

Abstract: A method and system for graphical enumeration. The method includes creating an ordered set of vertices for a graph such that each vertex is associated with a corresponding index, and wherein each vertex in the ordered set of vertices includes information. A plurality of keys is created for defining the information. A plurality of lists of vertices is created, each of which is associated with a corresponding key such that vertices in a corresponding list include information associated with the corresponding key. For a first list of vertices, a least valued index is determined from a group of associated vertices based on vertices in the first list and vertices pointed to by the vertices in the first list. Also, all associated vertices are pointed to a root vertex associated with the least valued index.

Abstract: An online machine data collection and archiving process generates a machine data profile of a customer computer accessing a transaction form of a merchant web site and links the machine data profile and a transaction record with customer identifying information using a unique transaction identification string. The process preferably captures parameters typically communicated as a part of web accesses, such as an IP address, an HTTP header, and cookie information. The process additionally causes the customer computer to process self-identification routines by processing coding within the merchant transaction form, the self-identification routines yielding further profile parameters. The process further includes a routine for bypassing an intervening proxy to the merchant web site to reveal the true IP address of the customer computer.

Abstract: A method and system for graphical enumeration. The method includes creating an ordered set of vertices for a graph such that each vertex is associated with a corresponding index, and wherein each vertex in the ordered set of vertices includes information. A plurality of keys is created for defining the information. A plurality of lists of vertices is created, each of which is associated with a corresponding key such that vertices in a corresponding list include information associated with the corresponding key. For a first list of vertices, a least valued index is determined from a group of associated vertices based on vertices in the first list and vertices pointed to by the vertices in the first list. Also, all associated vertices are pointed to a root vertex associated with the least valued index.

Abstract: A system establishes virtual DNS servers that are supported by a DNS server. Target IP addresses are assigned for the virtual DNS servers. Network capable devices are uniquely assigned to the virtual DNS servers for domain name resolution. Each network capable device accesses the communication network through a corresponding network device associated with a corresponding source IP address. A client's service plan is assigned to a first network capable device used by the client. The service plan is implemented through a DNS request under a session established between the first network capable device and its assigned first virtual DNS server. The session is uniquely identified by a first source IP address of a first network device used by the first network capable device to access the communication network and a first target IP address of the first virtual DNS server.

Abstract: Online entities oftentimes desire to ascertain information about their audience members. To determine information about audience members and their activities, online transactions including information about transactions performed by audience members are collected. One or more audience analysis processes are applied to the online transactions to determine the collection of online transactions performed by a given audience member. With an accurate assignment of online transaction to the audience member, the audience member and associated transactions may be classified as a legitimate or illegitimate.

Abstract: A system and method for providing, as a service over a computer network (especially a packet-switched computer network) to a body of merchants connected to the computer network, verification of consumer identification based on data provided over the computer network by scanning devices attached to the computers operated by consumers.

Abstract: An online machine data collection and archiving process generates a machine data profile of a customer computer accessing a transaction form of a merchant web site and links the machine data profile and a transaction record with customer identifying information using a unique transaction identification string. The process preferably captures parameters typically communicated as a part of web accesses, such as an IP address, an HTTP header, and cookie information. The process additionally causes the customer computer to process self-identification routines by processing coding within the merchant transaction form, the self-identification routines yielding further profile parameters. The process further includes a routine for bypassing an intervening proxy to the merchant web site to reveal the true IP address of the customer computer.

Abstract: A method and system for graphical enumeration. The method includes creating an ordered set of vertices for a graph such that each vertex is associated with a corresponding index, and wherein each vertex in the ordered set of vertices includes information. A plurality of keys is created for defining the information. A plurality of lists of vertices is created, each of which is associated with a corresponding key such that vertices in a corresponding list include information associated with the corresponding key. For a first list of vertices, a least valued index is determined from a group of associated vertices based on vertices in the first list and vertices pointed to by the vertices in the first list. Also, all associated vertices are pointed to a root vertex associated with the least valued index.

Abstract: A system establishes virtual DNS servers that are supported by a DNS server. Target IP addresses are assigned for the virtual DNS servers. Network capable devices are uniquely assigned to the virtual DNS servers for domain name resolution. Each network capable device accesses the communication network through a corresponding network device associated with a corresponding source IP address. A client's service plan is assigned to a first network capable device used by the client. The service plan is implemented through a DNS request under a session established between the first network capable device and its assigned first virtual DNS server. The session is uniquely identified by a first source IP address of a first network device used by the first network capable device to access the communication network and a first target IP address of the first virtual DNS server.