US 11,811,805 B1
Detecting fraud by correlating user behavior biometrics with other data sources
Gleb Esman, San Francisco, CA (US); and Oleg Izmerly, Redmond, WA (US)
Assigned to SPLUNK INC., San Francisco, CA (US)
Filed by SPLUNK INC., San Francisco, CA (US)
Filed on Jan. 29, 2021, as Appl. No. 17/162,906.
Application 17/162,906 is a continuation of application No. 15/731,104, filed on Apr. 17, 2017, granted, now 11,102,225.
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/00 (2013.01); H04L 9/40 (2022.01); G06N 20/00 (2019.01); G06F 16/951 (2019.01); G06N 5/025 (2023.01); G06N 3/082 (2023.01); G06N 3/045 (2023.01)
CPC H04L 63/1425 (2013.01) [G06F 16/951 (2019.01); G06N 3/045 (2023.01); G06N 3/082 (2013.01); G06N 5/025 (2013.01); G06N 20/00 (2019.01); H04L 63/1433 (2013.01)] 21 Claims
OG exemplary drawing
 
1. A computer-implemented method, comprising:
receiving a first set of cursor movement data associated with one or more cursor movements of a cursor that are acquired by a client device during a first period;
generating, based on the first set of cursor movement data, a first two-dimensional image that includes a set of encoded lines corresponding to distinct portions of the first set of cursor movement data; and
training, based on the first two-dimensional image, a first neural network to generate a trained first neural network that classifies two-dimensional image inputs, wherein:
the trained first neural network processes, via one or more model weights, a first input two-dimensional image to generate a first score that, in combination with data associated with a client device, indicates a first likelihood of fraudulent activity, wherein the data associated with the client device includes at least one of a screen resolution of the client device, an internet protocol (IP) address of the client device, a media access control (MAC) address of the client device, or a type of web browser implemented by the client device,
processing the first two-dimensional image causes the first neural network to modify the one or more model weights to generate one or more modified model weights, wherein the one or more modified model weights improve detection accuracy of the first neural network relative to the one or more model weights, and
the trained first neural network processes, via one or more model weights, a second input two-dimensional image to generate a second score that indicates a second likelihood of fraudulent activity and is different than the first score.