Abstract: Techniques are disclosed relating to automatically determining whether an entity is malicious. In some embodiments, a server computer system generates a feature vector for an unknown website, where generating the feature vector includes preprocessing a plurality of structural features of the unknown website. In some embodiments, the system inputs the feature vector for the unknown website into a trained neural network. In some embodiments, the system applies a clustering algorithm to a signature vector for the unknown website and signature vectors for respective ones of a plurality of known websites output by the trained neural network. In some embodiments, the system determines, based on results of the clustering algorithm indicating similarities between signature vectors for the unknown website and one or more of the signature vectors for the plurality of known websites, whether the unknown website is suspicious.

Abstract: Methods and systems are presented for imputing missing data items within a first dataset based on data associated with a second dataset that is the nearest neighbor of the first dataset. A first mapping model is configured to map data subsets corresponding to a first data source to first positions in a multi-dimensional space. A second mapping model is configured to map data subsets corresponding to a second data source to second positions in the multi-dimensional space. The first and second mapping models are trained together to reduce a distance between positions mapped by the first and second mapping models based on corresponding data subsets that belong to the same entity. A nearest neighbor dataset to the first dataset is identified based on the first and second mapping models. Data associated with the nearest neighbor dataset is used to impute the missing data items of the first dataset.

Abstract: Techniques are disclosed relating to automatically determining whether an entity is malicious. In some embodiments, a server computer system generates a feature vector for an unknown website, where generating the feature vector includes preprocessing a plurality of structural features of the unknown website. In some embodiments, the system inputs the feature vector for the unknown website into a trained neural network. In some embodiments, the system applies a clustering algorithm to a signature vector for the unknown website and signature vectors for respective ones of a plurality of known websites output by the trained neural network. In some embodiments, the system determines, based on results of the clustering algorithm indicating similarities between signature vectors for the unknown website and one or more of the signature vectors for the plurality of known websites, whether the unknown website is suspicious.

Abstract: Techniques are disclosed relating to automatically determining whether an entity is malicious. In some embodiments, a server computer system generates a feature vector for an unknown website, where generating the feature vector includes preprocessing a plurality of structural features of the unknown website. In some embodiments, the system inputs the feature vector for the unknown website into a trained neural network. In some embodiments, the system applies a clustering algorithm to a signature vector for the unknown website and signature vectors for respective ones of a plurality of known websites output by the trained neural network. In some embodiments, the system determines, based on results of the clustering algorithm indicating similarities between signature vectors for the unknown website and one or more of the signature vectors for the plurality of known websites, whether the unknown website is suspicious.

Abstract: Methods and systems are presented for imputing missing data items within a first dataset based on data associated with a second dataset that is the nearest neighbor of the first dataset. A first mapping model is configured to map data subsets corresponding to a first data source to first positions in a multi-dimensional space. A second mapping model is configured to map data subsets corresponding to a second data source to second positions in the multi-dimensional space. The first and second mapping models are trained together to reduce a distance between positions mapped by the first and second mapping models based on corresponding data subsets that belong to the same entity. A nearest neighbor dataset to the first dataset is identified based on the first and second mapping models. Data associated with the nearest neighbor dataset is used to impute the missing data items of the first dataset.

Abstract: Techniques are disclosed relating to machine learning techniques for performing user authentication based on the manner in which a user interacts with a client device, including the use of Siamese networks to detect unauthorized use of a device and/or account. In some embodiments, a server system may receive a request to authorize a transaction associated with a user account. The request may include transaction details and, separate from those transaction details, interaction data indicative of a manner in which a requesting user interacts with a client device during a user session. The server system may apply a machine learning model to the interaction data to create an encoding value that is based on the manner in when the requesting user interacts with the client device during the user session. The server system may then compare the encoding value to a reference encoding value and, based on the comparison, determine whether to authorize the transaction.

Abstract: Methods and systems are presented for configuring a risk assessment engine to predict a risk of a user based on a topic classification across a set of unknown topics generated by a topic model. A risk determination system obtains a plurality of transactions previously conducted by a user. The risk determination system generates a risk document comprising a sequence of words that describe the plurality of transactions. A topic model is used to determine a topic classification for the user based on the sequence of words. The topic model comprises a natural language processor configured to classify the risk document to one or more topics based on the words within the risk document. The risk determination system configures the risk assessment engine to accept the topic classification as input value(s) for predicting a risk associated with the user.

Abstract: A system and method for generating automatic false positive estimations for website matching is described. Several sets of assets and Uniform Resource Locators (URLs) are aggregated. Each of the several sets of assets is searched across webpage content corresponding to the several URLs to determine matches between the sets of assets and webpage content. One or more false positive estimations is determined, where each of the one or more false positive estimations corresponds to the one or more matches. A combined score is generated based on the one or more false positive estimations.

Abstract: Methods and systems for identifying characteristics of a user (e.g., a seller) based on Natural Language Processing (NLP). Transaction data of buyers may be collected to generate a sequence paragraph of seller name information for each buyer. NLP techniques such as word2vec may be used to vectorize the seller name information to determine relationships between sellers. Industry information may be determined using the vectors. Reliability checks may be performed to determine whether the data is robust to label the determined data.

Abstract: Systems and methods are disclosed for managing data objects that include text content that are stored in a database. The management of text objects includes determining that a condition for a data object associated with a user has been satisfied. In response, a relevancy score for the data object is generated. The relevancy score is based on the text content of the data object and a density estimation model associated with the user. The density estimation is generated using a plurality of data objects that each include text content and that are associated with a plurality of users of a service associated with the data objects, and using a set of the plurality of data objects that are associated with the user. Irrelevancy actions or relevancy actions may be performed to the data object based on the relevancy score.

Abstract: Methods and systems are presented for imputing missing data items within a first dataset based on data associated with a second dataset that is the nearest neighbor of the first dataset. A first mapping model is configured to map data subsets corresponding to a first data source to first positions in a multi-dimensional space. A second mapping model is configured to map data subsets corresponding to a second data source to second positions in the multi-dimensional space. The first and second mapping models are trained together to reduce a distance between positions mapped by the first and second mapping models based on corresponding data subsets that belong to the same entity. A nearest neighbor dataset to the first dataset is identified based on the first and second mapping models. Data associated with the nearest neighbor dataset is used to impute the missing data items of the first dataset.

Abstract: Methods and systems are presented for identifying different users who share a user account with an online service provider and dynamically processing transactions for the user account differently based on which user initiates the transaction request. In some embodiments, an account decomposition system may decompose the user account into distinct users who share the user account. The account decomposition system may identify different users who are sharing a user account by analyzing past transactions associated with the user account and different user devices that were used to conduct the past transactions. The account decomposition system may determine different user profiles for the different users, and may use the different user profiles to process incoming transaction requests initiated by different users of the user account.

Abstract: Systems and methods are disclosed for managing data objects that include text content that are stored in a database. The management of text objects includes determining that a condition for a data object associated with a user has been satisfied. In response, a relevancy score for the data object is generated. The relevancy score is based on the text content of the data object and a density estimation model associated with the user. The density estimation is generated using a plurality of data objects that each include text content and that are associated with a plurality of users of a service associated with the data objects, and using a set of the plurality of data objects that are associated with the user. Irrelevancy actions or relevancy actions may be performed to the data object based on the relevancy score.

Abstract: Techniques are disclosed relating to machine learning techniques for performing user authentication based on the manner in which a user interacts with a client device, including the use of Siamese networks to detect unauthorized use of a device and/or account. In some embodiments, a server system may receive a request to authorize a transaction associated with a user account. The request may include transaction details and, separate from those transaction details, interaction data indicative of a manner in which a requesting user interacts with a client device during a user session. The server system may apply a machine learning model to the interaction data to create an encoding value that is based on the manner in when the requesting user interacts with the client device during the user session. The server system may then compare the encoding value to a reference encoding value and, based on the comparison, determine whether to authorize the transaction.

Abstract: Methods and systems are presented for configuring a risk assessment engine to predict a risk of a user based on a topic classification across a set of unknown topics generated by a topic model. A risk determination system obtains a plurality of transactions previously conducted by a user. The risk determination system generates a risk document comprising a sequence of words that describe the plurality of transactions. A topic model is used to determine a topic classification for the user based on the sequence of words. The topic model comprises a natural language processor configured to classify the risk document to one or more topics based on the words within the risk document. The risk determination system configures the risk assessment engine to accept the topic classification as input value(s) for predicting a risk associated with the user.

Abstract: Methods and systems for identifying characteristics of a user (e.g., a seller) based on Natural Language Processing (NLP). Transaction data of buyers may be collected to generate a sequence paragraph of seller name information for each buyer. NLP techniques such as word2vec may be used to vectorize the seller name information to determine relationships between sellers. Industry information may be determined using the vectors. Reliability checks may be performed to determine whether the data is robust to label the determined data.

Abstract: Descriptions of items are offered for sale by one or more merchants in an online marketplace. The online marketplace comprises a website hosted by a server. The descriptions are electronically scanned or otherwise accessed. The scanned descriptions are deconstructed into a plurality of N-grams. Each N-gram includes a combination of words appearing in the descriptions of items. The electronic scan and deconstruction are repeated over a plurality of predefined time periods. For each N-gram, a frequency of occurrence is monitored in each of the predefined time periods. Based on the monitoring, a determination is made that a first N-gram of the plurality of N-grams whose frequency of occurrence has exceeded a predefined threshold in one of the predefined time periods. Risks of transactions involving one or more items whose descriptions contain the first N-gram are evaluated.

Abstract: A system and method for generating automatic false positive estimations for website matching is described. Several sets of assets and Uniform Resource Locators (URLs) are aggregated. Each of the several sets of assets is searched across webpage content corresponding to the several URLs to determine matches between the sets of assets and webpage content. One or more false positive estimations is determined, where each of the one or more false positive estimations corresponds to the one or more matches. A combined score is generated based on the one or more false positive estimations.

Abstract: Descriptions of items are offered for sale by one or more merchants in an online marketplace. The online marketplace comprises a website hosted by a server. The descriptions are electronically scanned or otherwise accessed. The scanned descriptions are deconstructed into a plurality of N-grams. Each N-gram includes a combination of words appearing in the descriptions of items. The electronic scan and deconstruction are repeated over a plurality of predefined time periods. For each N-gram, a frequency of occurrence is monitored in each of the predefined time periods. Based on the monitoring, a determination is made that a first N-gram of the plurality of N-grams whose frequency of occurrence has exceeded a predefined threshold in one of the predefined time periods. Risks of transactions involving one or more items whose descriptions contain the first N-gram are evaluated.