User-agent anomaly detection using sentence embedding

A method comprising:

• receiving, by a computer system, a request from a user-agent application of a device to access at least one resource associated with a service provider system;
• extracting, from the request, an identifier of the user-agent application, wherein the identifier comprises a character string;
• generating, from the character string, a plurality of character n-grams based on a plurality of word sizes, wherein the plurality of character n-grams comprises a first set of character n-grams corresponding to a first word size and a second set of character n-grams corresponding to a second word size;
• determining a plurality of hash values based on performing one or more hash functions on the plurality of character n-grams;
• converting, by the computer system, the character string into a numerical data vector representation of the user-agent application based on the plurality of hash values, wherein the converting comprises transforming each of the plurality of hash values into a numerical value within the numerical data vector representation of the user-agent application;
• calculating, by the computer system and for the user-agent application, a predictive score based on the numerical data vector representation, wherein the predictive score indicates whether the identifier of the user-agent application corresponds to an anomaly based on a probability distribution function that models patterns learned from historic data associated with a plurality of user-agent applications that have requested access to the at least one resource associated with the service provider system;
• comparing, by the computer system, the predictive score to a threshold;
• and
• based on the comparing, classifying, by the computer system, the user-agent application as non-fraudulent or fraudulent.

A non-transitory machine-readable medium having instructions stored thereon, wherein the instructions are executable to cause a machine of a system to perform operations comprising:

• receiving, from a user-agent client application of a user device and over a network, a request to access a computer resource associated with a service provider;
• extracting, from the request, an identifier of the user-agent client application, wherein the identifier comprises a character string;
• generating, from the character string, a plurality of character n-grams based on a plurality of different word sizes, wherein the plurality of character n-grams comprises at least a first set of character n-grams corresponding to a first word size and a second set of character n-grams corresponding to a second word size;
• determining a plurality of hash values based on performing one or more hash functions on the plurality of character n-grams;
• embedding, using a sentence embedding algorithm, the identifier into a numerical data vector representation of the user-agent client application based on the plurality of hash values, wherein the embedding comprises transforming each of the plurality of hash values into a numerical value within the numerical data vector representation of the user-agent client application;
• calculating, for the user-agent client application, a predictive score based on the numerical data vector representation, wherein the predictive score indicates whether the identifier of the user-agent client application corresponds to an anomaly based on a probability distribution function that models patterns learned from historic data associated with a plurality of user-agent client applications;
• comparing the predictive score to a threshold;
• and
• determining a classification for the user-agent client application based on the comparing, wherein the classification indicates whether the user-agent client application corresponds to a fraudulent application or a legitimate application;
• and
• processing the request based on the classification of the user-agent client application.