Abstract: Techniques are disclosed that relate to predicting whether a computer-based interaction is being performed by a computer bot. A computer system may receive information describing exhibited user-presence indicators of different types that are associated with the computer-based interaction, including user-presence indicators indicative of whether the computer-based interaction is being performed by a computer bot. The computer system performs a first embedding operation to create a unified embedding that unifies the exhibited user-presence indicators into a single embedding that is representative of an aggregation of the exhibited user-presence indicators. The computer system performs a second embedding operation to create a difference embedding that is representative of a set of differences between expected user-presence indicators for the computer-based interaction and the exhibited user-presence indicators.

Abstract: Methods and systems are presented for bot detection. A movement of a pointing device is tracked via a graphical user interface (GUI) of an application executable at a user device. Movement data associated with different locations of the pointing device within the GUI is obtained. The movement data is mapped to functional areas corresponding to a range of the different locations of the pointing device within the GUI over consecutive time intervals. At least one vector representing a sequence of movements for at least one trajectory of the pointing device through one or more of the functional areas and a duration the pointing device stays within each functional area is generated. At least one trained machine learning model is used to determine whether the sequence of movements of the pointing device was produced through human interaction with the pointing device by an actual user of the user device.

Abstract: Techniques are disclosed relating to determining whether to authorize a requested action based on whether an entity is an automated computer. In some embodiments, a computer system tracks, at a user interface of a computing device, a sequence of pointer movements. The computer system maps, based on coordinate locations of pointer movements in the sequence, respective movements in the sequence to a plurality of functional areas. Based on the mapping, the computer system generates a movement graph and determines, based on the movement graph, whether an entity associated with the sequence of pointer movements is an automated computer. In response to receiving a request to authorize an action at the computing device, the computer system generates, based on the determining, an authorization decision for the action and transmits the authorization decision to the computing device. Determining whether the entity is an automated computer may advantageously prevent fraudulent activity.

Abstract: Methods and systems are presented for bot detection. A movement of a pointing device is tracked via a graphical user interface (GUI) of an application executable at a user device. Movement data associated with different locations of the pointing device within the GUI is obtained. The movement data is mapped to functional areas corresponding to a range of the different locations of the pointing device within the GUI over consecutive time intervals. At least one vector representing a sequence of movements for at least one trajectory of the pointing device through one or more of the functional areas and a duration the pointing device stays within each functional area is generated. At least one trained machine learning model is used to determine whether the sequence of movements of the pointing device was produced through human interaction with the pointing device by an actual user of the user device.

Abstract: Systems and methods for user-agent anomaly detection are disclosed. In one embodiment, a user-agent string may be embedded into a numerical data vector representation using a sentence embedding algorithm (e.g., FastText). A predictive score may be calculated based on the numerical data vector representation and using a probability distribution function model that models a likelihood of occurrence of the observed user-agent based on patterns learned from historic payload data (e.g., a Gaussian Mixture Model). The predictive score may be compared to a threshold and, based on the comparison, it may be determined whether the user-agent is fraudulent.

Abstract: Systems and methods for emulator detection are disclosed. In one embodiment, a user agent string may be embedded into a first numerical data vector representation. Hardware characteristics of a client device corresponding to the user agent may be embedded into a second numerical data vector representation. Based on the first numerical data vector representation of the user agent and the second numerical data vector representation of the hardware characteristics, and their consistency, the client device may be determined to be an emulator or a non-emulator device.

Abstract: Techniques are disclosed relating to determining whether to authorize a requested action based on whether an entity is an automated computer. In some embodiments, a computer system tracks, at a user interface of a computing device, a sequence of pointer movements. The computer system maps, based on coordinate locations of pointer movements in the sequence, respective movements in the sequence to a plurality of functional areas. Based on the mapping, the computer system generates a movement graph and determines, based on the movement graph, whether an entity associated with the sequence of pointer movements is an automated computer. In response to receiving a request to authorize an action at the computing device, the computer system generates, based on the determining, an authorization decision for the action and transmits the authorization decision to the computing device. Determining whether the entity is an automated computer may advantageously prevent fraudulent activity.

Abstract: Systems and methods for emulator detection are disclosed. In one embodiment, a user agent string may be embedded into a first numerical data vector representation. Hardware characteristics of a client device corresponding to the user agent may be embedded into a second numerical data vector representation. Based on the first numerical data vector representation of the user agent and the second numerical data vector representation of the hardware characteristics, and their consistency, the client device may be determined to be an emulator or a non-emulator device.

Abstract: Techniques are disclosed relating to transaction authorization. In some embodiments, a server computer system receives and caches browsing information for a device of a user, where the browsing information relates to a transaction service. The server computer system may then receive a request to authorize one or more transactions via the transaction service. The server computer system may evaluate the cached browsing information to determine whether the user is attempting to perform multiple concurrent transactions via the transaction service. Based on the evaluating, the server computer system may determine whether to authorize the one or more transactions. In some embodiments, the disclosed techniques may advantageously prevent or reduce authorization of duplicate transactions that are concurrently attempted by a user.

Abstract: Systems and methods for user-agent anomaly detection are disclosed. In one embodiment, a user-agent string may be embedded into a numerical data vector representation using a sentence embedding algorithm (e.g., FastText). A predictive score may be calculated based on the numerical data vector representation and using a probability distribution function model that models a likelihood of occurrence of the observed user-agent based on patterns learned from historic payload data (e.g., a Gaussian Mixture Model). The predictive score may be compared to a threshold and, based on the comparison, it may be determined whether the user-agent is fraudulent.

Abstract: Techniques are disclosed relating to transaction authorization. In some embodiments, a server computer system receives and caches browsing information for a device of a user, where the browsing information relates to a transaction service. The server computer system may then receive a request to authorize one or more transactions via the transaction service. The server computer system may evaluate the cached browsing information to determine whether the user is attempting to perform multiple concurrent transactions via the transaction service. Based on the evaluating, the server computer system may determine whether to authorize the one or more transactions. In some embodiments, the disclosed techniques may advantageously prevent or reduce authorization of duplicate transactions that are concurrently attempted by a user.