Multiple input neural networks for detecting fraud
Embodiments of the present invention set forth a technique for predicting fraud based on multiple inputs including user behavior biometric data along with one or more other parameters associated with the user. The technique includes receiving cursor movement data generated via a client device. The technique further includes generating a image based on the cursor movement data. The technique further includes receiving client parameters generated via the client device. The technique further includes analyzing the image and the client parameters based on a model to generate a prediction result, where the model is generated based on second cursor movement data and a second set of client parameters associated with a first group of one or more users. The technique further includes determining, based on the prediction result, that a user of the client device is not a member of the first group.
1. A computer-implemented method, comprising:
receiving first cursor movement data representing one or more cursor movements captured via a client device, wherein the first cursor movement data comprises coordinates of a cursor during the one or more cursor movements and at least one of a speed of the cursor or a direction of the cursor at each of the coordinates;
generating a visual depiction of the coordinates of the cursor, including a plurality of image parameters, the plurality of image parameters comprising at least a first image parameter that encodes the speed of the cursor, and a second image parameter that encodes the direction of the cursor;
receiving a first set of client parameters that are associated with the client device;
analyzing the visual depiction and the first set of client parameters using a machine learning model to generate a prediction result, wherein the machine learning model is trained based on second cursor movement data and a second set of client parameters associated with a first group of client devices to identify fraudulent activity; and
generating, based on the prediction result, an output indicating whether the client device is associated with particular activity identified by the second cursor movement data and a second set of client parameters as fraudulent.
2. The computer-implemented method of claim 1 , further comprising:
receiving first log data generated via the client device; and
determining whether the first log data includes a value for a field that does not correspond to a stored value for the field, wherein the stored value corresponds to an account associated with a member of a group of users;
wherein the output is further based on the determination.
3. The computer-implemented method of claim 2 , wherein the determination comprises a determination that the value does not correspond to a parameter, and wherein the output is associated with a preventative action.
4. The computer-implemented method of claim 2 , wherein the value comprises at least one of: a screen resolution, a web browser implemented by the client device, an Internet protocol (IP) address of the client device, a financial transaction, a change to a user address, a change to a password, or a change to a notification preference.
5. The computer-implemented method of claim 2 , wherein:
a first layer of the machine learning model processes the visual depiction to generate an initial output; and
a second layer of the machine learning model processes the initial output and the first set of client parameters to generate the prediction result.
6. The method of claim 5 , wherein the machine learning model comprises a neural network that includes at least one two-dimensional convolutional layer for processing the visual depiction.
7. The method of claim 1 , wherein the machine learning model includes at least one dropout layer that reduces a number of nodes in the machine learning model with non-zero weights by at least 75%.
8. The method of claim 1 , wherein a value related to a first client parameter included in the first set of client parameters is embedded in a filename corresponding to the visual depiction.
9. The method of claim 1 , wherein analyzing the visual depiction and the first set of client parameters comprises processing the visual depiction via a first convolutional layer to generate a first set of weights.
10. The method of claim 1 , wherein analyzing the visual depiction and the first set of client parameters comprises:
processing the visual depiction via a first convolutional layer to generate a first set of weights; and
processing the first set of weights via a pooling layer to generate a second set of weights.
11. The method of claim 1 , wherein analyzing the visual depiction and the first set of client parameters comprises:
processing the visual depiction via a first convolutional layer to generate a first set of weights;
processing the first set of weights via a pooling layer to generate a second set of weights; and
processing the second set of weights via a flattening layer to generate a third set of weights.
12. The method of claim 1 , wherein analyzing the visual depiction and the first set of client parameters comprises:
processing the visual depiction via a first convolutional layer to generate a first set of weights;
processing the first set of weights via a pooling layer to generate a second set of weights;
processing the second set of weights via a flattening layer to generate a third set of weights; and
processing the third set of weights via a dense layer to generate a fourth set of weights.
13. The method of claim 1 , wherein analyzing the visual depiction and the first set of client parameters comprises:
processing the visual depiction via a first convolutional layer to generate a first set of weights;
processing the first set of weights via a pooling layer to generate a second set of weights;
processing the second set of weights via a flattening layer to generate a third set of weights;
processing the third set of weights via a dense layer to generate a fourth set of weights; and
processing the fourth set of weights via a dropout layer to generate a fifth set of weights.
14. The method of claim 1 , wherein the machine learning model includes at least one dense layer that performs at least one of a rectified linear unit (ReLU) activation function or a sigmoid activation function.
15. A fraud prediction system, comprising:
a memory storing a fraud prediction application; and
a processor coupled to the memory, wherein, when executed by the processor, the fraud prediction application configures the processor to:
receiving first cursor movement data representing one or more cursor movements captured via a client device, wherein the first cursor movement data comprises coordinates of a cursor during the one or more cursor movements and at least one of a speed of the cursor or a direction of the cursor at each of the coordinates;
generating a first image based on the first cursor movement data, wherein the first image comprises a visual depiction of the coordinates of the cursor, wherein the first image encodes a plurality of image parameters at each of the coordinates of the cursor, wherein the plurality of image parameters comprises a first image parameter that encodes the speed of the cursor when the cursor is at the coordinates and a second image parameter that encodes the direction of the cursor when the cursor is at the coordinates;
receiving a first set of client parameters that are associated with the client device;
analyzing the first image and the first set of client parameters using a machine learning model to generate a prediction result, wherein the machine learning model is trained based on second cursor movement data and a second set of client parameters associated with a first group of client devices to identify fraudulent activity; and
generating, based on the prediction result, an output indicating whether the client device is associated with particular activity identified by the second cursor movement data and a second set of client parameters as fraudulent.
16. The fraud prediction system of claim 15 , wherein the fraud prediction application further configures the processor to:
receive first log data generated via the client device; and
determine whether the first log data includes a value for a field that does not correspond to a stored value for the field, wherein the stored corresponds to an account associated with a member of a group of users;
wherein the output is further based on the determination.
17. The fraud prediction system of claim 16 , wherein the determination comprises a determination that the value does not correspond to a parameter, and wherein the output is associated with a preventative action.
18. One or more non-transitory computer-readable storage media storing instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of:
receiving first cursor movement data representing one or more cursor movements captured via a client device, wherein the first cursor movement data comprises coordinates of a cursor during the one or more cursor movements and at least one of a speed of the cursor or a direction of the cursor at each of the coordinates;
generating a first image based on the first cursor movement data, wherein the first image comprises a visual depiction of the one or more cursor movements;
receiving a first set of client parameters that are associated with the client device;
analyzing the first image and the first set of client parameters using a machine learning model to generate a prediction result, wherein the machine learning model is trained using at least a plurality of images generated from second cursor movement data to identify fraudulent activity; and
generating, based at least on the prediction result, an output indicating whether the client device is associated with particular activity identified by the machine learning model as fraudulent.
19. The one or more non-transitory computer-readable storage media of claim 18 , further comprising instruction that, when executed by the one or more processors, further cause the one or more processors to perform the steps of:
receive first log data generated via the client device; and
determine whether the first log data includes a value for a field that does not correspond to a stored value for the field, wherein the stored corresponds to an account associated with a member of a group of users;
wherein the output is further based on the determination.
20. The one or more non-transitory computer-readable storage media of claim 19 , wherein the determination comprises a determination that the value does not correspond to a parameter, and wherein the output is associated with a preventative action.