Systems and methods for merchant level fraud detection based in part on event timing

A non-transitory computer readable storage medium storing instructions, which when executed by a server computer system that comprises a memory and a processor, causes the processor of the server computer system to perform operations for detecting fraudulent activities at the server computer system, the operations comprising:

• accessing a first set of user system data generated for a user system service request being processed by the server computer system;
• encoding the first set of-user system data into a set of structured data input signals;
• accessing a set of time based data associated with a set of application programming interface (API) events performed by distributed service processing systems of the server computer system that are initiated by, or performed in response to, the user system service request, wherein each API event is associated with timing data;
• encoding the set of time based data into a set of unstructured time-based data input signals, wherein each unstructured time-based input signal in the set of unstructured time-based data input signals comprises an identifier of one of the set of API events and a relative time value, the relative time value encoded as a transformation of timing data associated with the one of the set of API events to a relative time value of the one of the set of API events relative to a second one of the set of API events;
• inputting the set of structured data input signals into a first machine learning model, and inputting the set of unstructured data input signals into a second machine learning model, the first machine learning model trained to detect fraudulent activities from structured data input signals and the second machine learning model trained to detect fraudulent activities based on relative timing of API events performed by the distributed service processing systems of the server computer system in the unstructured time-based data input signals;
• generating a single fraud score by combining a first fraud score generated by the first machine learning model with a second fraud score generated by the second machine learning model;
• and
• in response to detecting that the single fraud score satisfies a fraud detection threshold, initiating one or more remediative actions against the user system service request, a user system, or a combination thereof;
• wherein initiating the one or more remediative actions comprises:
• sending a fraud detection message to the user system with data indicative of the single fraud score,
• receiving, from the user system, feedback data indicative of lack of fraud by the user system with respect to the user system service request, and
• annotating the set of structured data input signals and the set of unstructured data input signals with the feedback data as annotated service request data.

A server computer system for detecting fraudulent merchant activities at a commerce platform system, the server computer system comprising:

• a memory that stores one or more instructions;
• and
• one or more processors coupled with the memory configured to execute the one or more instructions causing the one or more processors to perform operations, comprising:
• accessing a first set of user system data generated for a user system service request being processed by the server computer system;
• encoding the first set of user system data into a set of structured data input signals;
• accessing a set of time based data associated with a set of application programming interface (API) events performed by distributed service processing systems of the server computer system that are initiated by, or performed in response to, the user system service request, wherein each API event is associated with timing data;
• encoding the set of time based data into a set of unstructured time-based data input signals, wherein each unstructured time-based input signal in the set of unstructured time-based data input signals comprises an identifier of one of the set of API events and a relative time value, the relative time value encoded as a transformation of timing data associated with the one of the set of API events to a relative time value of the one of the set of API events relative to a second one of the set of API events;
• inputting the set of structured data input signals into a first machine learning model, and inputting the set of unstructured data input signals into a second machine learning model, the first machine learning model trained to detect fraudulent activities from structured data input signals and the second machine learning model trained to detect fraudulent activities based on relative timing of API events performed by the distributed service processing systems of the server computer system in the unstructured time-based data input signals;
• generating a single fraud score by combining a first fraud score generated by the first machine learning model with a second fraud score generated by the second machine learning model;
• and
• in response to detecting that the single fraud score satisfies a fraud detection threshold, initiating one or more remediative actions against the user system service request, a user system, or a combination thereof;
• wherein initiating the one or more remediative actions comprises:
• sending a fraud detection message to the user system with data indicative of the single fraud score,
• receiving, from the user system, feedback data indicative of lack of fraud by the user system with respect to the user system service request, and
• annotating the set of structured data input signals and the set of unstructured data input signals with the feedback data as annotated service request data.