Abstract: Systems and methods for tracking velocity information. One system includes an application execution server providing an application layer. The application execution server is configured to receive a request including metadata. The application execution server is also configured to generate and transmit a response to the request. The application execution server is also configured to enrich the metadata by structuring the metadata for further processing by a data processing layer, where the further processing includes determining velocity information associated with the metadata, and by supplementing the metadata with available historical velocity information. The application execution server is also configured to transmit the enriched metadata for further processing by the data processing layer.

Abstract: Embodiments described herein provide for structured command line input for application integration such that application programming interface (API) integration is simplified for end users. The embodiments described herein use OpenAPI specifications to map specification paths (or endpoints) to a command line interface (CLI) command structure automatically. Accordingly, the embodiments described herein enable an end user to run CLI commands within the end user's environment to accomplish application integration without the need for a technician to write configuration instructions for each type of user device. Additionally, the embodiments described herein enable efficient product integration at a larger scale as well as the ability to ad hoc add new solutions or applications based on, for example, a single line of CLI input.

Abstract: Methods and systems for providing configuration management using customized request headers. One system includes an electronic processor configured to receive, from a requesting device, a request including a customized request header, the customized request header including a custom configuration parameter. The electronic processor is also configured to perform a fraud analysis function based on the request. The electronic processor is also configured to generate a response including a customized response body based on the customized request header. The electronic processor is also configured to transmit the response to the requesting device, where the requesting device performs functionality based on information included in the customized response body.

Abstract: A system for generating a fraud risk score for a third party provider (TPP) transaction. The system includes a server including an electronic processor. The electronic processor is configured to determine a frequency-recency-monetary value feature, a reputation feature, and a rule feature for a TPP transaction, using the frequency-recency-monetary value feature, the reputation feature, and the rule feature as input for a machine learning model, execute the machine learning model to generate a blended score, and, when the blended score is above a second predetermined threshold, determine that the TPP transaction is fraudulent.

Abstract: A fraud prevention server and method. The fraud prevention server includes an electronic processor and a memory. The memory includes an online application origination (OAO) service. The electronic processor is configured to perform feature encoding on one or more categorical variables in a first matrix to generate one or more feature encoded categorical variables, generate a second matrix including the one or more feature encoded categorical variables, generate a feature encoded OAO model by training an OAO model with the second matrix, receive information regarding a submission of an online application on a device, determine a fraud score of the online application based on the information that is received and the feature encoded OAO model, the feature encoded OAO model being more precise than the OAO model, and control the client server to approve, hold, or deny the online application based on the fraud score that is determined.

Abstract: Devices, systems, and methods with behavioral one-time-passcode (OTP) generation. In one example, a server includes a memory and an electronic processor communicatively connected to the memory. The memory includes a behavioral one-time-passcode (OTP) program and a user profile repository. The electronic processor, when executing the behavioral OTP program, is configured to receive a one-time-passcode (OTP) request, generate a behavioral one-time-passcode (OTP) based on a user profile stored in the user profile repository in response to receiving the OTP request, and output the behavioral OTP that is generated.

Abstract: User identification with blended response from dual-layer identification service. In one embodiment, a server comprising an electronic processor configured to detect an access request by a user of a user interface device, retrieve a plurality of input profile records from an input profile record repository, perform an identification of the user with one or more passive biometrics models and the plurality of input profile records that are retrieved, generate an identification response and an additional identification request based on an outcome of the identification of the user, control the communication interface to transmit the additional identification request to the second server via the network, receive a second identification response from the second server, and generate a blended response by modifying one or more characteristics of the identification response with the second identification response, the blended response indicating the identification of the user.

Abstract: A fraud prevention server that includes an electronic processor and a memory. The memory includes an online application origination (OAO) service and a plurality of OAO models, each of the plurality of OAO models differentiates between a behavior of a normal user and a behavior of a nefarious actor during a submission of the online application on a device. When executing the OAO service, the electronic processor is configured to receive form data from a client server, determine a best OAO model from a plurality of OAO models with deep-learning, determine a fraud score of the online application based on the best OAO model, and control the client server to approve, hold, or deny the online application based on the fraud score that is determined.

Abstract: A system for utilizing behavioral features to authenticate a user entering login credentials. The system includes an electronic processor configured to receive a request to access a user account and compare behavioral features included in the request to behavioral features included in a user behavior profile associated with the user account. The electronic processor is also configured to, based on the comparison, generate one or more scores. The electronic processor is further configured to, for each of the one or more scores, compare the score to a predetermined threshold and, based on the comparison of the score to the predetermined threshold, adjust a match value. The electronic processor is also configured to compare the match value to one or more predetermined thresholds to determine whether the behavioral features included in the request to access the user account authenticates the user, does not authenticate the user, or is inconclusive.

Abstract: Systems and methods are provided for extending dialogue between a mobile device and a point-of-interaction (POI). One example computer-implemented method includes receiving, by a conduit server, from the POI, via a first connection between the conduit server and the POI, a request for an extended connection between the POI and the mobile device, and notifying a host server of the request. The method then includes receiving, from the mobile device, via a second connection between the conduit server and the mobile device, an identifier for the mobile device and pairing, based on the identifier, the first and second connections, to establish a wireless connection between the POI and the mobile device, via the conduit server. The method further includes submitting a wake-up call to the mobile device, whereby the mobile device publishes the identifier to establish a wireless connection directly between the POI and the mobile device.

Abstract: An anomaly detection system that includes a database and a server. The server is connected to the database. The server is configured to identify anomalous web traffic for a certain time period based on one or more client keys from the certain time period. The client key(s) includes at least two characteristics related to web traffic data. The server includes a processing unit and a memory. The server is configured to receive the web traffic data from the database, calculate a z-score metric for the client key, calculate a change rate metric for the client key, calculate a failure metric for the client key, determine an anomaly score based on the z-score metric, the change rate metric, and the failure metric, and determine that the certain time period is an anomalous time period based on the anomaly score.

Abstract: A system for determining a fraud risk score associated with a transaction. The system includes a server including an electronic processor. The electronic processor is configured to determine a plurality of rules based on a plurality of transactions over time and extract one or more features of the transaction. The electronic processor is also configured to select, based on the plurality of rules, a plurality of fraud risk features Each non-categorical fraud risk feature selected is associated with a fraud risk feature value and each categorical fraud risk feature selected is associated with a categorical variable value. The electronic processor is configured to determine, for each categorical fraud risk feature, a fraud risk feature value. The electronic processor is also configured to determine the fraud risk score based on the one or more of the transformed fraud risk feature values.

Abstract: Systems, methods, devices, and computer readable media related to fraud detection. Fraud detection is achieved using a flexible scripting language and syntax that simplifies the generation of fraud detection rules. The rules are structured as conditional IF-THEN statements that include data objects referred to as Anchors and Add-Ons. The Anchors and Add-Ons used to generate the rules also correspond to a distinct data path for the retrieval data from any of a variety of data sources. The retrieval of data from the various data sources is optimized based on data dependencies within the rules. By knowing the data dependencies of each rule and utilizing parallelization of rule execution, the retrievals of data from the data sources is achieved efficiently so the rules can be executed quickly.

Abstract: A universal device identifier (UDID) service with adjusted attribute distances. In one embodiment, a server includes an electronic processor and a memory storing the UDID service. The electronic processor is configured to receive an identification request regarding a currently-observed device having a first set of device attributes, retrieve any previously-observed devices, determine whether one or more devices are found from retrieving the any of the previously-observed devices, determine all changed device attributes for each device of the one or more devices that are found relative to the first set of device attributes, generate an adjusted attribute distance corresponding to the all changed device attributes for the each device, retrieve a universal device identifier (UDID) of a closest device having a lowest adjusted attribute distance among all adjusted attribute distances that are generated, and assign the UDID of the closest device to the currently-observed device.

Abstract: Systems and methods for tracking velocity information. One system includes an application execution server providing an application layer. The application execution server is configured to receive a request including metadata. The application execution server is also configured to generate and transmit a response to the request. The application execution server is also configured to enrich the metadata by structuring the metadata for further processing by a data processing layer, where the further processing includes determining velocity information associated with the metadata, and by supplementing the metadata with available historical velocity information. The application execution server is also configured to transmit the enriched metadata for further processing by the data processing layer.

Abstract: Systems, methods, devices, and computer readable media related to fraud detection. Fraud detection is achieved using a flexible scripting language and syntax that simplifies the generation of fraud detection rules. The rules are structured as conditional IF-THEN statements that include data objects referred to as Anchors and Add-Ons. The Anchors and Add-Ons used to generate the rules also correspond to a distinct data path for the retrieval data from any of a variety of data sources. The generated rules with distinct data paths are then converted using a transpiler from the scripting language into native language source code (e.g., PHP, Java, etc.) for deployment in a particular environment. The rules are then executed in real-time in the environment to detect potential fraudulent activity.

Abstract: Methods and systems for providing distributed GeoIP information updating. One method includes receiving, with a data processing server, an update event associated with an update to an active version of GeoIP information, the active version of the GeoIP information is actively accessible by an application execution server for request enrichment. The method also includes generating, with the data processing server, an updated version of the GeoIP information according to the update. The method also includes replacing, with the data processing server, the active version with the updated version in storage, where, in response to storing the updated version, the updated version is actively accessible by the application server for request enrichment.

Abstract: Methods and systems for request orchestration. One system includes an electronic processor configured to receive a request including request metadata and identify a data attribute associated with the request. The electronic processor is also configured to determine an execution plan for enriching the request metadata based on the data attribute. The electronic processor is also configured to execute an application function according to the execution plan to enrich the request metadata. The electronic processor is also configured to evaluate the enriched request metadata. The electronic processor is also configured to generate and transmit a response to the request based on the evaluation of the enriched request metadata.

Abstract: Methods and systems for providing distributed user agent information updating. One system includes a data processing server configured to receive an update event associated with an update to an active version of user agent information. The active version of the user agent information is actively accessible for request enrichment. The data processing server is also configured to generate an updated version of the user agent information according to the update and replace the active version with the updated version in storage. In response to the storage of the updated version, the updated version is actively accessible for request enrichment.

Abstract: Methods and systems for providing distributed evaluation list updating. One system includes a data processing server. The data processing server receiving a request event associated with an update to an active evaluation list version. The active evaluation list version is actively accessible for request validation. The data processing server also generates an updated evaluation list version according to the update associated with the request event. After generating the updated evaluation list version, the data processing server replaces the active evaluation list version with the updated evaluation list version in storage, where, in response to storing the updated evaluation list version, the updated evaluation list version is actively accessible for request validation.