# US 11,907,658 B2 · User-agent anomaly detection using sentence embedding > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,658 B2 - Document ID: US11907658B2 - Status: Granted - Kind: B2 - Application number: 17/308,931 - Filed: 2021-05-05 - Published: 2022-11-10 - Granted: 2024-02-20 - Earliest claimed: 2021-05-05 - Assignees: Paypal, Inc. - Applicants: PayPal, Inc. - Inventors: Zhe Chen; Hewen Wang; Yuzhen Zhuo; Solomon kok how Teo; Shanshan Peng; Quan Jin Ferdinand Tang; Serafin Trujillo; Kenneth Bradley Snyder; Mandar Ganaba Gaonkar; Omkumar Mahalingam - Web page: https://patentgrep.com/patent/US11907658B2 ## CPC - G06F 40/284: Lexical analysis, e.g. tokenisation or collocates - G06F 18/2321: using statistics or function optimisation, e.g. modelling of probability density functions - G06F 18/2415: based on parametric or probabilistic models, e.g. based on likelihood ratio or false acceptance rate versus a false rejection rate - G06F 40/30: Semantic analysis - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for user-agent anomaly detection are disclosed. In one embodiment, a user-agent string may be embedded into a numerical data vector representation using a sentence embedding algorithm (e.g., FastText). A predictive score may be calculated based on the numerical data vector representation and using a probability distribution function model that models a likelihood of occurrence of the observed user-agent based on patterns learned from historic payload data (e.g., a Gaussian Mixture Model). The predictive score may be compared to a threshold and, based on the comparison, it may be determined whether the user-agent is fraudulent. ## Claims ### Claim 1 A computer system comprising: a non-transitory memory storing instructions; and one or more hardware processors configured to read the instructions and cause the computer system to perform operations comprising: receiving, from a user-agent computer application of a device, a request to access a resource of the computer system; determining, based on the request, a character string that identifies the user-agent computer application; generating, from the character string, a plurality of character n-grams based on a plurality of word sizes, wherein the plurality of character n-grams comprises at least a first set of character n-grams corresponding to a first word size and a second set of character n-grams corresponding to a second word size; determining a plurality of hash values based on performing one or more hash functions on the plurality of character n-grams; embedding, using a sentence embedding algorithm, the character string into a numerical data vector representation of the user-agent client application based on the plurality of hash values, wherein the embedding comprises transforming each of the plurality of hash values into a numerical value within the numerical data vector representation of the user-agent computer application; calculating, for the user-agent client application, a predictive score based on the numerical data vector representation, wherein the predictive score indicates whether the character string that identifies the user-agent computer application corresponds to an anomaly based on a probability distribution function that models patterns learned from historic data associated with a plurality of user-agent computer applications; comparing the predictive score to a threshold; and determining, based on the comparing, whether the user-agent computer application corresponds to a fraudulent application. ### Claim 2 (depends on 1) The computer system of claim 1, wherein the probability distribution function comprises a Gaussian Mixture Model, having a weighted sum of M-component Gaussian densities, generated based on the patterns learned from the historic data associated with the plurality of user-agent computer applications, and wherein the M-component Gaussian densities correspond to normal distributions of subpopulations of the plurality of user-agent computer applications. ### Claim 3 (depends on 1) The computer system of claim 1, wherein the operations further comprise: aggregating the historic data associated with the plurality of user-agent computer applications; based on the historic data, extracting a plurality of character strings for the plurality of user-agent computer applications; embedding the plurality of character strings into a plurality of respective numerical data vector representations for the plurality of user-agent computer applications; and generating the probability distribution function based on the plurality of respective numerical data vector representations. ### Claim 4 (depends on 1) The computer system of claim 1, wherein the character string represents two or more of an operating system type of an operating system of the device, an application model associated with the user-agent computer application, a device type associated with the device, or a device manufacturer associated with the device. ### Claim 5 (depends on 1) The computer system of claim 1, wherein the numerical data vector representation has a dimensionality that corresponds to a parameter of the probability distribution function. ### Claim 6 (depends on 1) The computer system of claim 1, wherein the request is a Hypertext Transfer Protocol (HTTP) request, and wherein the character string is extracted from the HTTP request. ### Claim 7 (depends on 1) The computer system of claim 1, wherein the operations further comprise denying the user-agent computer application from accessing the resource in response to determining that the user-agent computer application corresponds to the fraudulent application. ### Claim 8 A method comprising: receiving, by a computer system, a request from a user-agent application of a device to access at least one resource associated with a service provider system; extracting, from the request, an identifier of the user-agent application, wherein the identifier comprises a character string; generating, from the character string, a plurality of character n-grams based on a plurality of word sizes, wherein the plurality of character n-grams comprises a first set of character n-grams corresponding to a first word size and a second set of character n-grams corresponding to a second word size; determining a plurality of hash values based on performing one or more hash functions on the plurality of character n-grams; converting, by the computer system, the character string into a numerical data vector representation of the user-agent application based on the plurality of hash values, wherein the converting comprises transforming each of the plurality of hash values into a numerical value within the numerical data vector representation of the user-agent application; calculating, by the computer system and for the user-agent application, a predictive score based on the numerical data vector representation, wherein the predictive score indicates whether the identifier of the user-agent application corresponds to an anomaly based on a probability distribution function that models patterns learned from historic data associated with a plurality of user-agent applications that have requested access to the at least one resource associated with the service provider system; comparing, by the computer system, the predictive score to a threshold; and based on the comparing, classifying, by the computer system, the user-agent application as non-fraudulent or fraudulent. ### Claim 9 (depends on 8) The method of claim 8, wherein the probability distribution function comprises a Gaussian Mixture Model, having a weighted sum of M-component Gaussian densities, generated based on the patterns learned from the historic data associated with the plurality of user-agent applications that have requested access to the at least one resource associated with the service provider system, and wherein the M-component Gaussian densities correspond to normal distributions of subpopulations of the plurality of user-agent applications. ### Claim 10 (depends on 8) The method of claim 8, further comprising: aggregating, by the computer system, the historic data associated with the plurality of user-agent applications that have requested access to the at least one resource associated with the computer system; based on the historic data, extracting, by the computer system, a plurality of character strings for the plurality of user-agent applications; converting, by the computer system, the plurality of character strings into a plurality of respective numerical data vector representations of the plurality of user-agent applications; and generating, by the computer system, the probability distribution function based on the plurality of respective numerical data vector representations. ### Claim 11 (depends on 10) The method of claim 10, wherein the converting the plurality of character strings into the plurality of respective numerical data vector representations is performed using a FastText algorithm. ### Claim 12 (depends on 8) The method of claim 8, wherein the numerical data vector representation has at least 300 dimensions. ### Claim 13 (depends on 8) The method of claim 8, further comprising: classifying the user-agent application as fraudulent based on the comparing; and storing the character string in a blacklist database that prevents the user-agent application from accessing the at least one resource. ### Claim 14 (depends on 13) The method of claim 13, further comprising blocking an Internet Protocol address associated with the device. ### Claim 15 A non-transitory machine-readable medium having instructions stored thereon, wherein the instructions are executable to cause a machine of a system to perform operations comprising: receiving, from a user-agent client application of a user device and over a network, a request to access a computer resource associated with a service provider; extracting, from the request, an identifier of the user-agent client application, wherein the identifier comprises a character string; generating, from the character string, a plurality of character n-grams based on a plurality of different word sizes, wherein the plurality of character n-grams comprises at least a first set of character n-grams corresponding to a first word size and a second set of character n-grams corresponding to a second word size; determining a plurality of hash values based on performing one or more hash functions on the plurality of character n-grams; embedding, using a sentence embedding algorithm, the identifier into a numerical data vector representation of the user-agent client application based on the plurality of hash values, wherein the embedding comprises transforming each of the plurality of hash values into a numerical value within the numerical data vector representation of the user-agent client application; calculating, for the user-agent client application, a predictive score based on the numerical data vector representation, wherein the predictive score indicates whether the identifier of the user-agent client application corresponds to an anomaly based on a probability distribution function that models patterns learned from historic data associated with a plurality of user-agent client applications; comparing the predictive score to a threshold; and determining a classification for the user-agent client application based on the comparing, wherein the classification indicates whether the user-agent client application corresponds to a fraudulent application or a legitimate application; and processing the request based on the classification of the user-agent client application. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the probability distribution function comprises a Gaussian Mixture Model, having a weighted sum of M-component Gaussian densities, generated based on the patterns learned from the historic data associated with the plurality of user-agent client applications that have requested access to resources of the service provider, and wherein the M-component Gaussian densities correspond to normal distributions of subpopulations of the plurality of user-agent client applications. ### Claim 17 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the operations further comprise: aggregating the historic data associated with the plurality of user-agent client applications that have requested access to computer resources of the service provider; based on the historic data, extracting a plurality of character strings for the plurality of user-agent client applications; embedding the plurality of character strings into a plurality of respective numerical data vector representations for the plurality of user-agent client applications; and generating the probability distribution function based on the plurality of respective numerical data vector representations. ### Claim 18 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein the embedding the plurality of character strings into the plurality of respective numerical data vector representations is performed using a FastText algorithm. ### Claim 19 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the character string represents a browser type, a browser version, and one or more hardware and software specifications of the user device. ### Claim 20 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the processing the request comprises denying the request to access the computer resource in response to determining that the classification indicates that the user-agent client application corresponds to the fraudulent application.