Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Data on website visitors and e-commerce customers
52 views
Skip to first unread message
ideaproxy
Jul 4, 2012, 11:37:06 PM7/4/12
to
A data collector system is made up of the following four online services
1. Javascript service to return Geographical and demographic information
of web service visitors.
Javascript code is served from a central set of servers. Various websites include the Javascript code in their website code. Javascript service uses the IP address, user-agent, and accept language of the website visitor to determine the vistor's geographic location, ISP, Organization, user type (business, residential, traveler, education), netspeed, estimated age, gender, interests, education, occupation, has children, income, marital status.
2. IP geolocation Web service
This web service returns the estimated geographic location, ISP, Organization, user type (business, residential, traveler, education), netspeed, estimated age, gender, interests, education, occupation, has children, income, marital status of a website visitor or server given an IP address, user_agent and accept language and email or hashed email.
3. Fraud detection web service
This web service returns the likelihood of a online transaction being fraudulent. It takes as inputs the customer IP address, user-agent, email, order information (credit card, address) and returns a risk score as well as other information about the individual order variables.
The fraud detection service assigns a identifier for each merchant
querying the service. The service categorizes merchants as low or
high risk based on
the percentage of transactions from that merchant that are determined
to be coming from a proxy or are determined to be fraud.
The fraud detection service may mark an IP address as being a proxy
if that IP address comes from a high risk merchant. However, if
a sufficient number of transactions on the same IP are from low
risk merchants, the IP will not be flagged as a proxy, or if it
is already flagged, it will be removed from the proxy database.
The billing addresses associated with the credit cards are passed to the fraud detection service and used to construct a IP geolocation database. For each IP address range, the best estimated location is selected by minimizing the sum of the square root of distances between the estimated location and the set of billing addresses.
4. Javascript service to record device information
Javascript code is served to multiple merchants and websites from a central server. The javascript code records the IP address, user agent, accept language and device information including screen size and resolution as well as plugin information into a database. The Javascript code is used to link transactions together that are using the same device. If a device has been associated with a high-risk or fraudulent transaction, future transactions from that device are flagged as high-risk. The Javascript code also performs session analysis and determines from the website browsing logs if the visitor may be high-risk for fraud.
To determine the demographics for an IP range:
1. The zipcodes associated with the online orders associated with the IP range are looked up from the fraud detection service logs.
2. The demographics associated with those postal codes are looked up against the census or other demographic database and averaged to return demographics for a IP address range.
The IP address, email, user agent, and accept language data is used to build a lookup table of IP address to user agent and accept language. If the user agent and accept language have been seen before on an IP or email, the fraud detection web service will return a lower risk score indicating a lower likelihood of fraud.
Demographics associated with a user-agent string will be determined as follows:
1. IP address and user-agent pairs are recorded by the four data collector systems listed above.
2. Using a IP Geolocation database the estimated location including zipcode is determined for the IP / user-agent pair.
3. Using Census data and estimated location, demographic information is determined for each IP / user-agent pair.
4. The average demographic profile for each user-agent string is computed by averaging all the demographic information assicated with each IP / user-agent data point.
5. A regression or data mining model may be employed to find the demographic profile for the user-agent using the Census data and IP geolocation database.
6. The demographic information associated with the IP address and user-agent are combined, and are returned by any of the four services listed above.
Interests of website visitor will be determined by the types of websites they visited.
The websites visited are determined looking up the visitor's IP address, user-agent and/or device information against
the log data of the four online services above. The category of the website is determined, and if a sufficient
number websites or pages under a category are visited, then an associated interest is assigned to the website
visitor. The interest may be returned as an output for any of the four online services listed above.
1. Javascript service to return Geographical and demographic information
of web service visitors.
Javascript code is served from a central set of servers. Various websites include the Javascript code in their website code. Javascript service uses the IP address, user-agent, and accept language of the website visitor to determine the vistor's geographic location, ISP, Organization, user type (business, residential, traveler, education), netspeed, estimated age, gender, interests, education, occupation, has children, income, marital status.
2. IP geolocation Web service
This web service returns the estimated geographic location, ISP, Organization, user type (business, residential, traveler, education), netspeed, estimated age, gender, interests, education, occupation, has children, income, marital status of a website visitor or server given an IP address, user_agent and accept language and email or hashed email.
3. Fraud detection web service
This web service returns the likelihood of a online transaction being fraudulent. It takes as inputs the customer IP address, user-agent, email, order information (credit card, address) and returns a risk score as well as other information about the individual order variables.
The fraud detection service assigns a identifier for each merchant
querying the service. The service categorizes merchants as low or
high risk based on
the percentage of transactions from that merchant that are determined
to be coming from a proxy or are determined to be fraud.
The fraud detection service may mark an IP address as being a proxy
if that IP address comes from a high risk merchant. However, if
a sufficient number of transactions on the same IP are from low
risk merchants, the IP will not be flagged as a proxy, or if it
is already flagged, it will be removed from the proxy database.
The billing addresses associated with the credit cards are passed to the fraud detection service and used to construct a IP geolocation database. For each IP address range, the best estimated location is selected by minimizing the sum of the square root of distances between the estimated location and the set of billing addresses.
4. Javascript service to record device information
Javascript code is served to multiple merchants and websites from a central server. The javascript code records the IP address, user agent, accept language and device information including screen size and resolution as well as plugin information into a database. The Javascript code is used to link transactions together that are using the same device. If a device has been associated with a high-risk or fraudulent transaction, future transactions from that device are flagged as high-risk. The Javascript code also performs session analysis and determines from the website browsing logs if the visitor may be high-risk for fraud.
To determine the demographics for an IP range:
1. The zipcodes associated with the online orders associated with the IP range are looked up from the fraud detection service logs.
2. The demographics associated with those postal codes are looked up against the census or other demographic database and averaged to return demographics for a IP address range.
The IP address, email, user agent, and accept language data is used to build a lookup table of IP address to user agent and accept language. If the user agent and accept language have been seen before on an IP or email, the fraud detection web service will return a lower risk score indicating a lower likelihood of fraud.
Demographics associated with a user-agent string will be determined as follows:
1. IP address and user-agent pairs are recorded by the four data collector systems listed above.
2. Using a IP Geolocation database the estimated location including zipcode is determined for the IP / user-agent pair.
3. Using Census data and estimated location, demographic information is determined for each IP / user-agent pair.
4. The average demographic profile for each user-agent string is computed by averaging all the demographic information assicated with each IP / user-agent data point.
5. A regression or data mining model may be employed to find the demographic profile for the user-agent using the Census data and IP geolocation database.
6. The demographic information associated with the IP address and user-agent are combined, and are returned by any of the four services listed above.
Interests of website visitor will be determined by the types of websites they visited.
The websites visited are determined looking up the visitor's IP address, user-agent and/or device information against
the log data of the four online services above. The category of the website is determined, and if a sufficient
number websites or pages under a category are visited, then an associated interest is assigned to the website
visitor. The interest may be returned as an output for any of the four online services listed above.
ideaproxy
Jul 19, 2012, 9:11:43 PM7/19/12
to
Described is a collection of web services for determining location, demographical information, likelihood of fraud, and interests based on IP address, user agent, ISP and reverse DNS name.
A data collector system is made up of the following four online services.
1. Javascript service to return Geographical and demographic information
of web service visitors.
Javascript code is served from a central set of servers. Various websites include the Javascript code in their website code. Javascript service uses the IP address, user-agent, and accept language of the website visitor to determine the vistor's geographic location, ISP, Organization, user type (business, residential, traveler, education), netspeed, estimated age, gender, interests, education, occupation, has children, income, marital status.
2. IP geolocation Web service
This web service returns the estimated geographic location, ISP, Organization, user type (business, residential, traveler, education), netspeed, estimated age, gender, interests, education, occupation, has children, income, marital status of a website visitor or server given an IP address, user_agent and accept language and email or hashed email.
The service also returns information based on the user agent and accept language strings such as language, device type, operating system, browser type and version.
3. Fraud detection web service
This web service returns the likelihood of a online transaction being fraudulent. It takes as inputs the customer IP address, user-agent, email, order information (credit card, billing and ship address) and returns a risk score as well as other information about the individual order variables.
The fraud detection service assigns a identifier for each merchant
querying the service. The service categorizes merchants as low or
high risk based on
the percentage of transactions from that merchant that are determined
to be coming from a proxy or are determined to be fraud.
The fraud detection service may mark an IP address as being a proxy
if that IP address comes from a high risk merchant. However, if
a sufficient number of transactions on the same IP are from low
risk merchants, the IP will not be flagged as a proxy, or if it
is already flagged, it will be removed from the proxy database.
The billing addresses associated with the credit cards are passed to the fraud detection service and used to construct a IP geolocation database. For each IP address range, the best estimated location is selected by minimizing the sum of the square root of distances between the estimated location and the set of associated billing addresses. This database is used to return the the location of IP addresses for all of the web services described in this disclosure.
4. Javascript service to record device information
Javascript code is served to multiple websites from a central set of servers. The javascript code records the IP address, user agent, accept language and device information including screen size and resolution as well as plugin information into a database. The Javascript code is used to link transactions together that are using the same device. If a device has been associated with a high-risk or fraudulent transaction, future transactions from that device are flagged as high-risk. In addition, the IP, email and other order data associated with the device are flagged as high risk. The Javascript code also performs session analysis and determines from the website browsing logs if the visitor may be high-risk for fraud.
To determine the demographics for an IP range:
1. The zipcodes associated with the online orders associated with the IP range are looked up from the fraud detection service logs.
2. The demographics associated with those postal codes are looked up against the census or other demographic database and averaged to return demographics for a IP address range.
The IP address, email, user agent, and accept language data is used to build a lookup table of IP address to user agent and accept language. If the user agent and accept language have been seen before on an IP or email, the fraud detection web service will return a lower risk score indicating a lower likelihood of fraud.
Demographics associated with a user-agent string will be determined as follows:
1. IP address and user-agent pairs are recorded by the four data collector systems listed above.
2. Using a IP Geolocation database the estimated location including zipcode is determined for the IP / user-agent pair
1. user-agent and customer billing postal code is recorded by the fraud
detection web service.
2. Census data is used to determine the demographics
associated with the customer billing postal code.
3. The average demographics are computed across all billing postal codes
associated with each user-agent string.
4. A data mining algorithm may be employed to find the
demographic profile for each user-agent string using the average demographics
based on billing postal code.
Demographics associated with an ISP or organization are determined as follows:
1. IP address and customer billing postal code is recorded by the fraud detection service.
2. ISP and Organization is determined by looking up the ISP and Organization of the IP address using a IP to ISP and IP to Organization database.
3. Census data is used to determine the demographics
associated with the customer billing postal code.
4. The average demographics are computed across all billing postal codes
associated with each ISP and Organization.
5. A data mining algorithm may be employed to find the
demographic profile for each ISP or organization using the average demographics
based on billing postal code.
Reverse DNS information can be used to further classify and segment the demographics within an ISP. For example if the reverse DNS includes the string fios, those IPs are classifed as Verizon FiOS and are analyzed separately to determine if FiOS users have a different demographic profile.
A data collector system is made up of the following four online services.
1. Javascript service to return Geographical and demographic information
of web service visitors.
Javascript code is served from a central set of servers. Various websites include the Javascript code in their website code. Javascript service uses the IP address, user-agent, and accept language of the website visitor to determine the vistor's geographic location, ISP, Organization, user type (business, residential, traveler, education), netspeed, estimated age, gender, interests, education, occupation, has children, income, marital status.
2. IP geolocation Web service
This web service returns the estimated geographic location, ISP, Organization, user type (business, residential, traveler, education), netspeed, estimated age, gender, interests, education, occupation, has children, income, marital status of a website visitor or server given an IP address, user_agent and accept language and email or hashed email.
3. Fraud detection web service
The fraud detection service assigns a identifier for each merchant
querying the service. The service categorizes merchants as low or
high risk based on
the percentage of transactions from that merchant that are determined
to be coming from a proxy or are determined to be fraud.
The fraud detection service may mark an IP address as being a proxy
if that IP address comes from a high risk merchant. However, if
a sufficient number of transactions on the same IP are from low
risk merchants, the IP will not be flagged as a proxy, or if it
is already flagged, it will be removed from the proxy database.
4. Javascript service to record device information
To determine the demographics for an IP range:
1. The zipcodes associated with the online orders associated with the IP range are looked up from the fraud detection service logs.
2. The demographics associated with those postal codes are looked up against the census or other demographic database and averaged to return demographics for a IP address range.
The IP address, email, user agent, and accept language data is used to build a lookup table of IP address to user agent and accept language. If the user agent and accept language have been seen before on an IP or email, the fraud detection web service will return a lower risk score indicating a lower likelihood of fraud.
Demographics associated with a user-agent string will be determined as follows:
1. IP address and user-agent pairs are recorded by the four data collector systems listed above.
2. Using a IP Geolocation database the estimated location including zipcode is determined for the IP / user-agent pair
3. Using Census data and estimated location, demographic information is determined for each IP / user-agent pair.
4. The average demographic profile for each user-agent string is computed by averaging all the demographic information assicated with each IP / user-agent data point.
5. A regression or data mining algorithm may be employed to find the demographic profile for the user-agent using the Census data and IP geolocation database.
4. The average demographic profile for each user-agent string is computed by averaging all the demographic information assicated with each IP / user-agent data point.
6. The demographic information associated with the IP address and user-agent are combined, and are returned by any of the four services listed above.
Demographics associated with a user-agent string may also be determined as follows
1. user-agent and customer billing postal code is recorded by the fraud
detection web service.
2. Census data is used to determine the demographics
associated with the customer billing postal code.
3. The average demographics are computed across all billing postal codes
associated with each user-agent string.
4. A data mining algorithm may be employed to find the
demographic profile for each user-agent string using the average demographics
based on billing postal code.
Demographics associated with an ISP or organization are determined as follows:
1. IP address and customer billing postal code is recorded by the fraud detection service.
2. ISP and Organization is determined by looking up the ISP and Organization of the IP address using a IP to ISP and IP to Organization database.
3. Census data is used to determine the demographics
associated with the customer billing postal code.
4. The average demographics are computed across all billing postal codes
associated with each ISP and Organization.
5. A data mining algorithm may be employed to find the
demographic profile for each ISP or organization using the average demographics
based on billing postal code.
Reverse DNS information can be used to further classify and segment the demographics within an ISP. For example if the reverse DNS includes the string fios, those IPs are classifed as Verizon FiOS and are analyzed separately to determine if FiOS users have a different demographic profile.
ideaproxy
Sep 7, 2012, 7:40:04 PM9/7/12
to
Javascript code is served to multiple websites from a central set of servers. The javascript code records the IP address, user agent, accept language and device information including screen size and resolution as well as plugin information into a database. The Javascript code is used to link transactions together that are using the same device. If a device has been associated with a high-risk or fraudulent transaction, future transactions from that device are flagged as high-risk. A device may be marked as a high risk device if is associated with a high risk IP or email. In addition, the IP, email and other order data associated with a high risk device may be flagged as high risk. The Javascript code also performs session analysis and determines from the website browsing logs if the visitor may be high-risk for fraud.
ideaproxy
Sep 9, 2012, 6:34:24 PM9/9/12
to
Javascript code is served to multiple websites from a central set
of servers. The javascript code runs on the device and obtains the IP address, user agent, accept language and device information including screen size and resolution as well as plugin information. The javascript code sends the device information back to the server using a GET or POST HTTP request. Server-side codes records the device information along with the IP address, referrer URL into a database or log file.
A device may be marked as a high risk device if is associated with a high risk IP or email. In addition, the IP, email and other order data associated with a high risk device may be flagged as high risk. The web session (from the javascript posting logs) may be analyzed to determines if the visitor may be high-risk for fraud.
ideaproxy
Sep 14, 2012, 2:50:05 PM9/14/12
to
Demographic information may be associated with device information and attributes, including user agent, accept language, screen size, http headers, system fonts, browser plugins and mime type details, time zone and system clock offset.
JavaScript data collector system:
Javascript code is included on multiple websites from a central set
of servers. The javascript code runs on the device and obtains the IP address, user agent, accept language and device information including screen size and resolution as well as plugin information. The javascript code sends the device information back to the server using a GET or POST HTTP request. Server-side code records the device information along with the IP address, referrer URL into a database or log file.
Fraud Detection data collector system:
This web service returns the likelihood of a online transaction being fraudulent. It takes as inputs the customer IP address, user-agent, email, order information (credit card, billing and ship address) and returns a risk score as well as other information about the individual order variables.
This system will also associate a transaction with a device by comparing the merchant and IP address associated the transaction with the IP address and website URL in the JavaScript data collector system log database.
Demographics associated with a device attributes will be determined as follows:
1. IP address and device attributes are recorded by the data collector systems listed above.
2. Using a IP Geolocation database the estimated location including zipcode is determined for the IP and device attributes
3. Using Census data and estimated location, demographic information is determined for each IP and device attributes.
4. The average demographic profile for each device attribute is computed by averaging all the demographic information associated with each IP / device attribute data point.
5. A data mining algorithm may be employed to find the demographic profile for each device attribute using the Census data and IP geolocation database. A regression model may be built to estimate demographics given multiple device attributes, IP and ISP.
6. The demographic information associated with the IP address and device attributes are combined, and are returned by a web service. This may involve a look up to the Javascript data collector log database to pull the device attributes using IP address, user_agent and merchant identifier based on the inputs to the web service.
Demographics associated with a device attributes may also be determined as follows
1. device attributes and customer billing postal code are recorded by the fraud
detection web service. Device attributes may be looked up in the Javascript data collector log database as above.
4. A data mining algorithm may be employed to find the
demographic profile for each device attribute using the averaged demographics based on billing postal code.
The riskScore returned by the fraud detection system may be improved by looking up the associated device in the Javascript data collector log database using the IP, user_agent and merchant identifier passed to the fraud detection web service. Risk scores may be assigned to each device attribute by averaging the occurrence of high risk transactions on proxies or other risk attribute for each device attribute over all associated transactions. The association is made using the IP, user_agent and merchant ID and URL. The overall risk score associated with the device is combined from the individual device attribute risk attributes, using a formula or data mining system. The overall risk score associated with the transaction is combined with the risk associated with the order attributes and the device attributes, using a formula or data mining system.
JavaScript data collector system:
Javascript code is included on multiple websites from a central set
of servers. The javascript code runs on the device and obtains the IP address, user agent, accept language and device information including screen size and resolution as well as plugin information. The javascript code sends the device information back to the server using a GET or POST HTTP request. Server-side code records the device information along with the IP address, referrer URL into a database or log file.
Fraud Detection data collector system:
This web service returns the likelihood of a online transaction being fraudulent. It takes as inputs the customer IP address, user-agent, email, order information (credit card, billing and ship address) and returns a risk score as well as other information about the individual order variables.
This system will also associate a transaction with a device by comparing the merchant and IP address associated the transaction with the IP address and website URL in the JavaScript data collector system log database.
Demographics associated with a device attributes will be determined as follows:
1. IP address and device attributes are recorded by the data collector systems listed above.
2. Using a IP Geolocation database the estimated location including zipcode is determined for the IP and device attributes
3. Using Census data and estimated location, demographic information is determined for each IP and device attributes.
4. The average demographic profile for each device attribute is computed by averaging all the demographic information associated with each IP / device attribute data point.
5. A data mining algorithm may be employed to find the demographic profile for each device attribute using the Census data and IP geolocation database. A regression model may be built to estimate demographics given multiple device attributes, IP and ISP.
6. The demographic information associated with the IP address and device attributes are combined, and are returned by a web service. This may involve a look up to the Javascript data collector log database to pull the device attributes using IP address, user_agent and merchant identifier based on the inputs to the web service.
Demographics associated with a device attributes may also be determined as follows
1. device attributes and customer billing postal code are recorded by the fraud
detection web service. Device attributes may be looked up in the Javascript data collector log database as above.
2. Census data is used to determine the demographics
associated with the customer billing postal code.
3. The average demographics are computed across all billing postal codes
associated with each device attribute.
associated with the customer billing postal code.
3. The average demographics are computed across all billing postal codes
4. A data mining algorithm may be employed to find the
demographic profile for each device attribute using the averaged demographics based on billing postal code.
The riskScore returned by the fraud detection system may be improved by looking up the associated device in the Javascript data collector log database using the IP, user_agent and merchant identifier passed to the fraud detection web service. Risk scores may be assigned to each device attribute by averaging the occurrence of high risk transactions on proxies or other risk attribute for each device attribute over all associated transactions. The association is made using the IP, user_agent and merchant ID and URL. The overall risk score associated with the device is combined from the individual device attribute risk attributes, using a formula or data mining system. The overall risk score associated with the transaction is combined with the risk associated with the order attributes and the device attributes, using a formula or data mining system.
Message has been deleted
ideaproxy
Oct 11, 2012, 6:24:50 PM10/11/12
to
Uniquely identify and track devices so we can see a fraudster cycling through multiple proxies looking for one which we don't notice.
If we see a device come in through several known proxies, the next IP it uses is probably also a proxy, and can be marked as a proxy.
Identification is done by running Javascript on the client device that collects information about it. This information includes things like the browser name, the plugins, etc.
If we want to ensure that the JS will be delivered to as many clients as possible, we need to have our customers deliver the JS. Otherwise people can just block JS from our domain. However, if our customer delivers the JS they will also need to implement a system to pass the device data back to us.
For some use cases, if we deliver the JS we will want to associate the device with a given transaction from our customer. That means that our customer has to incorporate a unique device id that we provide when submitting data to our fraud detection service. This can be done by providing an API that our customer can access through *their* JS.
If we deliver the JS and clients block us, we can incorporate that into the risk score as well. We will still need our customer to indicate that they tried to use our device id JS so we can distinguish "not using device tracking" from "tried to use device tracking but it was blocked".
We can identify a device based on small changes to its configuration (plugin changes, etc.)
This would be useful for more "intelligent" tracking of a single device through proxies and over time.
It's hard to know if a given device is the same or just very similar. We could give this some sort of weighted score and factor it into the overall risk score.
One approach would be to plot each device in an N-dimensional space and measure the distance between the two devices. The closer the distance the more likely they are to be the same. I'd guess that we need to use some sort of geometric algorithm to make the likelihood fall off quickly, rather than simply measuring the linear distance.
We might also record a timestamp with every device id and somehow factor that into the likelihood that the device is the same.
For our initial release, we will offer a single javascript file which we host ourself. This will cause the browser to submit identifying information about the browser (user-agent, languages enabled, plugins, OS, etc.).
We log this information and use it to identify a single device across multiple IP addresses.
When we see a single device quickly hopping between IPs, especially known proxies, this is a strong indication of fraud.
We can also look for this IP-hopping pattern as a way to detect new proxies.
We will incorporate this measurement into the risk score returned by our fraud detection service.
Longer-term, we may have to find a way to let clients host the javascript themselves.
If we see a device come in through several known proxies, the next IP it uses is probably also a proxy, and can be marked as a proxy.
Identification is done by running Javascript on the client device that collects information about it. This information includes things like the browser name, the plugins, etc.
If we want to ensure that the JS will be delivered to as many clients as possible, we need to have our customers deliver the JS. Otherwise people can just block JS from our domain. However, if our customer delivers the JS they will also need to implement a system to pass the device data back to us.
For some use cases, if we deliver the JS we will want to associate the device with a given transaction from our customer. That means that our customer has to incorporate a unique device id that we provide when submitting data to our fraud detection service. This can be done by providing an API that our customer can access through *their* JS.
If we deliver the JS and clients block us, we can incorporate that into the risk score as well. We will still need our customer to indicate that they tried to use our device id JS so we can distinguish "not using device tracking" from "tried to use device tracking but it was blocked".
We can identify a device based on small changes to its configuration (plugin changes, etc.)
This would be useful for more "intelligent" tracking of a single device through proxies and over time.
It's hard to know if a given device is the same or just very similar. We could give this some sort of weighted score and factor it into the overall risk score.
One approach would be to plot each device in an N-dimensional space and measure the distance between the two devices. The closer the distance the more likely they are to be the same. I'd guess that we need to use some sort of geometric algorithm to make the likelihood fall off quickly, rather than simply measuring the linear distance.
We might also record a timestamp with every device id and somehow factor that into the likelihood that the device is the same.
For our initial release, we will offer a single javascript file which we host ourself. This will cause the browser to submit identifying information about the browser (user-agent, languages enabled, plugins, OS, etc.).
We log this information and use it to identify a single device across multiple IP addresses.
When we see a single device quickly hopping between IPs, especially known proxies, this is a strong indication of fraud.
We can also look for this IP-hopping pattern as a way to detect new proxies.
We will incorporate this measurement into the risk score returned by our fraud detection service.
Longer-term, we may have to find a way to let clients host the javascript themselves.
ideaproxy
Dec 16, 2012, 10:01:00 PM12/16/12
to
The risk associated with a e-commerce transaction will be affected by the timezone of the device compared to the timezone of the IP address. If the timezone of the device is different that the timezone of the IP address the reported riskiness of the transaction will be increased.
ideaproxy
May 7, 2013, 9:59:45 PM5/7/13
to
This disclosure is for a system for determining the riskiness of a set of orders linked by a common attribute, such as an IP address.
Definition: avgProxy = average percentage of orders placed on proxies
Step 1. Retrive a list of merchants that have orders placed on proxies over a threshold
percentage.
Step 2. For each merchant, get the IP addresses associated with recent online orders, along with the avgProxy where the proxy was not determined to be a proxy by using this algorithm.
Step 3. For each set of merchants and order attributes, find other merchants or order attributes on the set of associated IP addresses along with the subset of IP addresses and avgProxy associated with refining the IP address set with the merchant or order attribute. If the subset avgProxy is significantly higher or lower than parent node's avgProxy, then add the subset to the tree data structure.
Iterate Step 3 until done.
To query the tree, gather merchant IDs, IP country, IP user type and any other order attributes associated with a common element such as IP. Start at top level of tree by selecting a node that is contained in the order attribute set. Continue walking the tree, each time following child nodes with attributes that are contained in attribute set, until children nodes no longer contain an attribute in the set. Calculate risk by combining the avgProxy of terminal nodes.
Definition: avgProxy = average percentage of orders placed on proxies
Step 1. Retrive a list of merchants that have orders placed on proxies over a threshold
percentage.
Step 2. For each merchant, get the IP addresses associated with recent online orders, along with the avgProxy where the proxy was not determined to be a proxy by using this algorithm.
Step 3. For each set of merchants and order attributes, find other merchants or order attributes on the set of associated IP addresses along with the subset of IP addresses and avgProxy associated with refining the IP address set with the merchant or order attribute. If the subset avgProxy is significantly higher or lower than parent node's avgProxy, then add the subset to the tree data structure.
Iterate Step 3 until done.
To query the tree, gather merchant IDs, IP country, IP user type and any other order attributes associated with a common element such as IP. Start at top level of tree by selecting a node that is contained in the order attribute set. Continue walking the tree, each time following child nodes with attributes that are contained in attribute set, until children nodes no longer contain an attribute in the set. Calculate risk by combining the avgProxy of terminal nodes.
0 new messages