Advanced computer system drift detection

    公开(公告)号:US10445163B2

    公开(公告)日:2019-10-15

    申请号:US15719279

    申请日:2017-09-28

    申请人: PayPal, Inc.

    IPC分类号: G06F11/00

    摘要: Computer system drift can occur when a computer system or a cluster of computer systems deviates from ideal and/or desired behavior. In a server farm, for example, many different machines may be identically configured to work in conjunction with each other to provide an electronic service (serving web pages, processing electronic payment transactions, etc.). Over time, however, one or more of these systems may drift from previous behavior. Early drift detection can be important, especially in large enterprises, to avoiding costly downtime. Changes in a computer's configuration files, network connections, and/or executable processes can indicate ongoing drift, but collecting this information at scale can be difficult. By using certain hashing and min-Hash techniques, however, drift detection can be streamlined and accomplished for large scale operations. Velocity of drift may also be tracked using a decay function.

    Fictitious account generation on detection of account takeover conditions

    公开(公告)号:US11805129B2

    公开(公告)日:2023-10-31

    申请号:US17563440

    申请日:2021-12-28

    申请人: PayPal, Inc.

    IPC分类号: H04L9/40 G06Q30/018

    摘要: Methods and systems for fictitious account generation on detection of account takeover conditions are described. A login attempt may be detected and determined to indicate fraud, such as when the login attempt is accompanied by many failed login attempts or is from an untrusted or known malicious endpoint. A fictitious account may be generated, which may include falsified account data and may limit account functionality to prevent unauthorized and fraudulent use of the account. The computing device that performs the login attempt may be routed and permitted to log in to the fictitious account, where the service provider or another computing entity may then monitor activity and usage of the fictitious account by the potentially malicious party. The fictitious account may be maintained so that other actors using the account may access the account and their activity also monitored.

    USING CLONED ACCOUNTS TO TRACK ATTACKS ON USER ACCOUNTS

    公开(公告)号:US20220166796A1

    公开(公告)日:2022-05-26

    申请号:US17145819

    申请日:2021-01-11

    申请人: PAYPAL, INC.

    IPC分类号: H04L9/40

    摘要: Methods and systems for using cloned accounts to track attacks on user accounts are described. A user login attempt is detected for a user account from a client computing device. A determination is made that the user is not a legitimate user. The user is routed to a cloned user account. An analysis of the interaction between the user and the cloned user account is performed.

    AUTOMATIC EXTRACTION OF INFORMATION FROM OBFUSCATED IMAGE REGIONS

    公开(公告)号:US20200159907A1

    公开(公告)日:2020-05-21

    申请号:US16150213

    申请日:2018-10-02

    申请人: PAYPAL, INC.

    摘要: Images related to one or more attacks to a service provider system may be analyzed to improve the security of the service provider system. Each of the images may be segmented into multiple segments. Each of the segments is analyzed independently to determine whether the segment includes obfuscated data and if so, which one of the data obfuscation techniques was used to generate the obfuscated data. Additional information regarding the obfuscated data may be derived from other segments that include unobfuscated data and from the metadata of the image. A data restoration algorithm may be configured accordingly to restore the obfuscated data. The restored data, as well as a context derived for the image, may be used to adjust one or more security parameters of the service provider system to improve the security of the service provider system.

    Using cloned accounts to track attacks on user accounts

    公开(公告)号:US11665199B2

    公开(公告)日:2023-05-30

    申请号:US17145819

    申请日:2021-01-11

    申请人: PAYPAL, INC.

    IPC分类号: H04L9/40

    CPC分类号: H04L63/1491 H04L63/08

    摘要: Methods and systems for using cloned accounts to track attacks on user accounts are described. A user login attempt is detected for a user account from a client computing device. A determination is made that the user is not a legitimate user. The user is routed to a cloned user account. An analysis of the interaction between the user and the cloned user account is performed.

    FICTITIOUS ACCOUNT GENERATION ON DETECTION OF ACCOUNT TAKEOVER CONDITIONS

    公开(公告)号:US20220124097A1

    公开(公告)日:2022-04-21

    申请号:US17563440

    申请日:2021-12-28

    申请人: PayPal, Inc.

    IPC分类号: G06F21/62 G06Q30/00

    摘要: Methods and systems for fictitious account generation on detection of account takeover conditions are described. A login attempt may be detected and determined to indicate fraud, such as when the login attempt is accompanied by many failed login attempts or is from an untrusted or known malicious endpoint. A fictitious account may be generated, which may include falsified account data and may limit account functionality to prevent unauthorized and fraudulent use of the account. The computing device that performs the login attempt may be routed and permitted to log in to the fictitious account, where the service provider or another computing entity may then monitor activity and usage of the fictitious account by the potentially malicious party. The fictitious account may be maintained so that other actors using the account may access the account and their activity also monitored.

    Fictitious account generation on detection of account takeover conditions

    公开(公告)号:US11265323B2

    公开(公告)日:2022-03-01

    申请号:US16190066

    申请日:2018-11-13

    申请人: PAYPAL, INC.

    IPC分类号: H04L29/06 G06Q30/00

    摘要: Methods and systems for fictitious account generation on detection of account takeover conditions are described. A login attempt may be detected and determined to indicate fraud, such as when the login attempt is accompanied by many failed login attempts or is from an untrusted or known malicious endpoint. A fictitious account may be generated, which may include falsified account data and may limit account functionality to prevent unauthorized and fraudulent use of the account. The computing device that performs the login attempt may be routed and permitted to log in to the fictitious account, where the service provider or another computing entity may then monitor activity and usage of the fictitious account by the potentially malicious party. The fictitious account may be maintained so that other actors using the account may access the account and their activity also monitored.

    Automatic extraction of information from obfuscated image regions

    公开(公告)号:US11080388B2

    公开(公告)日:2021-08-03

    申请号:US16150213

    申请日:2018-10-02

    申请人: PAYPAL, INC.

    摘要: Images related to one or more attacks to a service provider system may be analyzed to improve the security of the service provider system. Each of the images may be segmented into multiple segments. Each of the segments is analyzed independently to determine whether the segment includes obfuscated data and if so, which one of the data obfuscation techniques was used to generate the obfuscated data. Additional information regarding the obfuscated data may be derived from other segments that include unobfuscated data and from the metadata of the image. A data restoration algorithm may be configured accordingly to restore the obfuscated data. The restored data, as well as a context derived for the image, may be used to adjust one or more security parameters of the service provider system to improve the security of the service provider system.