Scalable search and ranking of biometric signatures

A system comprising:

• one or more processors;
• and
• a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• capturing data associated with user interactions of a user with a user interface displayed by a computing device, the captured data including mouse movement;
• generating a graphical image depicting a visual representation of a path of the mouse movement from the captured data;
• encoding the graphical image into an image vector;
• searching a vector database comprising a plurality of previously encoded image vectors that are indexed for vector similarity searching the searching comprising using vector similarity matching to retrieve and rank one or more historical image vectors in the vector database that meet or exceed a similarity threshold in comparison to the image vector, at least some of the plurality of previously encoded image vectors being flagged as indicating fraudulent activity;
• and
• outputting a result based on the one or more identified historical image vectors retrieved from the vector database, the result comprising a risk score for each of the one or more identified historical image vectors that is based in part on a similarity difference measurement.

A machine-storage medium comprising instructions which, when executed by one or more processors of a machine, cause the machine to perform operations comprising:

• capturing data associated with user interactions of a user with a user interface displayed by a computing device, the captured data including mouse movement;
• generating a graphical image depicting a visual representation of a path of the mouse movement from the captured data;
• encoding the graphical image into an image vector;
• searching a vector database comprising a plurality of previously encoded image vectors that are indexed for vector similarity searching, the searching comprising using vector similarity matching to retrieve and rank one or more historical image vectors in the vector database that meet or exceed a similarity threshold in comparison to the image vector, at least some of the plurality of previously encoded image vectors being flagged as indicating fraudulent activity;
• and
• outputting a result based on the one or more identified historical image vectors retrieved from the vector database, the result comprising a risk score for each of the one or more identified historical image vectors that is based in part on a similarity difference measurement.