Age prediction of end users based on input device data

The present technology includes receiving event data of a user from a user device while the user interacts with a graphical user interface (GUI) to access a service, where the event data includes behavioral biometrics of the user obtained from one or more input devices of the user device, and predicting, based on the event data, a projected age of the user, where predicting the age of the user includes inputting the event data into a machine learning model, where the machine learning model is configured to receive event data and output an age prediction for a user associated with the event data.

TECHNICAL FIELD

The present technology pertains to predicting an age of an end user and, more particularly to, predicting a projected age of the end user based on event data obtained while the end user interacts with a graphical user interface of a service.

BACKGROUND

Interactions between people are based on knowledge of who each party is. In physical interactions, people can verify the identity of another person. More specifically, people can utilize various different senses to determine whether the other person is who they say they are. For example, the person can look at a driver's license, ask specific questions, hear the person's voice, etc. Even if one cannot fully determine if the person is who they say they are, people can at least have a general idea of the actual person they are interacting with.

This contrasts with the digital world, where we have little insight into who is truly behind an avatar or an account. As the world becomes increasingly involved with the digital world, users are more frequently performing interactions online. For example, users regularly fill out forms online for various reasons. As another example, users post content or posts on social media networks. Furthermore, users may utilize a variety of different types of devices to access these different services. For example, users use computers, mobile phones, tablets, etc.

When users interact online, service providers and other people are not able to ascertain a true identity of the user. For example, a user signing up online for an account with a clothing retail store may potentially provide a different or false identity. The clothing retail store has no way to determine whether the information provided is true.

DETAILED DESCRIPTION

Various examples of the present technology are discussed in detail below. While specific implementations are discussed, it should be understood that this is done for illustration purposes only. A person skilled in the relevant art will recognize that other components and configurations may be used without parting from the spirit and scope of the present technology. In some instances, well-known structures and devices are shown in block diagram form in order to facilitate describing one or more aspects. Further, it is to be understood that functionality that is described as being carried out by certain system components may be performed by more or fewer components than shown.

Interactions between people are based on knowledge of who each party is. In physical interactions, people can verify the identity of another person. More specifically, people can utilize various different senses to determine whether the other person is who they say they are. For example, the person can look at a driver's license, ask specific questions, hear the person's voice, etc. Even if one cannot fully determine if the person is who they say they are, people can at least have a general idea of the actual person they are interacting with.

This contrasts with the digital world, where we have little insight into who avatars and accounts truly are and/or belong to. As the world becomes increasingly involved with the digital world, users are more frequently performing interactions online. For example, users regularly fill out forms online. As another example, users post content or posts on social media networks. Furthermore, users may utilize a variety of different types of devices to access these different services. For example, users use computers, mobile phones, tablets, etc.

When users interact online, service providers and other people are not able to ascertain a true identity of the user. For example, a user signing up online for an account with a clothing retail store may potentially provide a different or false identity. The clothing retail store has no way to determine whether the information provided is true.

A more malicious scenario may be a user or fraudster attempting to impersonate another person to access or set up an account for the other person. For example, a malicious user could attempt to impersonate a person to access the bank account of the person by inputting information into a form for forgotten passwords on a website of the bank. While these forms often have security questions to provide safeguards against improper access to accounts, these safeguards may fail when a malicious user has the correct answers for the security questions. Another safeguard is two-factor authentication. However, two-factor authentication is also subject to various attacks and is not a sufficient safe guard on its own.

Thus, the present technology addresses the need in the art for more information regarding a user by interpreting user idiosyncrasies as the user interacts with a service. More specifically, the present technology includes receiving event data from a user device interacting with a webpage or application of a service (e.g., via code executing on the user device and deployed on the webpage of the service). The event data is inputted into a machine learning model that is configured to derive biometric, behavioral, and habitual patterns to predict a projected age of the user. The present technology also provides solutions for identifying potentially fraudulent interactions based on the projected age, event data, and inputted data.

FIG.1illustrates an example network environment100for utilizing a subject evaluation service124to assist a partner web service116to evaluate transactions by a subject entity106utilizing the partner web service116.

FIG.1illustrates an example network environment100, in which a subject entity106utilizes an access device102to access a partner web service116associated with a partner web service116(e.g., a merchant, provider, payment processor, financial institution, crypto exchange, crypto wallet, etc.). In some embodiments, the partner web service116has a webpage/app118(application (app) or webpage) loaded and executing on the access device102. The webpage/app118associated with the partner web service116can include code to report various events to API110of subject evaluation service124. In some instances, the webpage/app118can report the events directly to API110, and in some cases, the webpage/app118can report the events through partner web service116. As will be described further herein, the events that are reported to API110of subject evaluation service124are useful in providing additional insight into the transaction regarding the likelihood that the subject entity106is a fraudulent party that is attempting to conduct the transaction, or other insight pertaining to the subject entity106.

Subject entities106can include individuals and entities that conduct transactions. More specifically, subject entities106can perform or conduct on-chain transactions, off-chain transactions, and traditional transactions. On-chain transactions are transactions that occur on a blockchain that are reflected on a distributed, public ledger. On-chain transactions are typically validated and authenticated and lead to an update to the overall blockchain network. For example, a subject entity106may purchase a cryptocurrency on a crypto exchange. Off-chain transactions are transactions that occur outside of a blockchain. For example, a subject entity106may purchase a cryptocurrency wallet from another person, such that the value of the cryptocurrency is transferred to the subject entity106, but the blockchain does not identify the transaction. Traditional transactions are transactions that are unrelated to blockchains, such as a credit card transaction at a merchant, depositing a check, an Automated Cleaning House (ACH) transaction to move money from one account to another, etc. For example, a subject entity106may purchase clothing with a credit card or debit card on a third-party website (e.g., a partner web service116) that is associated with or otherwise connected to network environment100.

Partner web services116are applications, websites, and/or services for entities or platforms (e.g., merchants, service providers, payment processors, financial institutions, crypto exchanges, crypto wallets, etc.) associated with or otherwise connected to network environment100. For example, merchants typically have a website (e.g., a partner web service116) that people can purchase goods or access services. As another example, people typically use a website or crypto exchange service to trade cryptocurrency.

Partner web service116can be in communication with various databases and services. For example, partner web service116can have access to one or more databases maintained by partner web service116, such as, for example, an account database122that stores user profiles and other account information associated with respective subject entities106. Partner web service116can also communicate with and access one or more third-party databases114such as credit reporting databases, people search databases, social network databases, etc., to access additional information pertinent to the services provided by partner web service116.

In some embodiments, network environment100can be useful to connect partner web service116to subject evaluation service124to evaluate the subject entity attempting to conduct a transaction with partner web service116. Subject evaluation service124can perform its functions for many partner web services116, and as such, it can aggregate information about the subject entity106as the subject entity interacts with the partner web services116across the Internet. Subject evaluation service124can build a profile to identify subject entities using event data that is difficult for those committing fraud to impersonate. Subject evaluation service124can utilize transaction information from many partner web service116to train one or machine learning algorithms using ML service112to evaluate various transaction dimensions to determine whether the subject entity is authentic or is a fraudulent entity impersonating the subject entity.

Subject entity database104can store routine personal identifying information such as phone numbers, e-mails, SSNs, bank account numbers, credit card numbers, blockchain wallets, etc., and user behavior information such as typing dynamics, mouse control dynamics, device motion dynamics, access device identifying information, and more. In other words, subject entity database104can include various types of data that can identify and/or be linked to or associated with a particular user (e.g., subject entity106).

In some embodiments, the subject evaluation service124can utilize the ML service112to train machine learning algorithms to evaluate other aspects of a transaction beyond whether a fraudulent entity is impersonating the subject entity106. For example, the subject evaluation service124can include ML algorithms that are able to evaluate patterns in a subject entity's service usage to help evaluate transaction risks associated with a particular transaction involving the subject entity.

Application programming interface110(API110) provides an interface between partner web service116and subject evaluation service124and is configured to receive event data from webpage/app118. The event data can include a variety of information pertaining to aspects of how the subject entity106interacts with the webpage/app118(e.g., mouse movements, keyboard events, typing speed, movement of the device, etc.). In some aspects, the event data is pseudo-biometric data because a collection of such data can be used to generate a profile and/or a unique fingerprint that can be used to represent a particular subject entity. API110is configured to record various behavioral biometrics. In some embodiments, the device events can be collected and reported by a script or algorithm deployed on webpage/app118that communicates directly or indirectly (through partner web service116) with API110of subject evaluation service124. In some embodiments, webpage/app118is further configured to stream the data (for example, while a subject entity106is filling out a form), or in a batch (after the subject entity106submits the form).

Events database108is configured to store the data received by API110. In some embodiments, events database108is further configured to communicate with ML service112.

API110is configured to record biometric data (e.g., mouse movements, keyboard events, typing speed, movement of the device, etc.). In some embodiments, API110is called by an algorithm, script, or a software development kit (SDK) deployed on partner web service116and executed on or by access device102. Additionally, API110is configured to asynchronously receive biometric behavioral data and/or device intelligence data. Similarly, API110is configured to asynchronously provide the biometric data and/or device intelligence data to events database108. In some embodiments, API110is also configured to provide the data to ML service112.

ML service112can be configured to receive data to train an ML model and/or to use a trained ML model to evaluate received data. More specifically, ML service112can be configured to receive the behavioral biometric data and/or device intelligence data from events database108to train the ML model or to receive data from API110to identify a particular user associated with the data using a trained ML model.

Subject entity database104can be the same database as events database108or separate. Subject entity database104can be configured to store information about a subject entity. For example, subject entity database104can store statistics regarding the behavioral biometric data and/or device intelligence data that might be used to identify a subject entity and/or the access devices that a subject entity regularly utilizes to access one or more services. Subject entity database104can also be configured to store conclusions of a trained ML algorithm pertaining to subject entity, such as a conclusion of the approximate age of the subject entity based on data defining attributes of how the subject entity moves a mouse, their typing speed dynamics, how they hold and move their hand-held device, etc.

In some embodiments, the subject evaluation service124might access one or more third-party database114or partner link service120to collect additional information to evaluate subject entity106. One or more third-party databases114can include credit reporting databases, people search databases, social network databases, etc. The partner link service120can be a service that has access to one or more accounts of the subject entity106, including accounts at web services other than the partner web service116. Some partner link services120can obtain account access credentials from subject entity106to one or more accounts to facilitate the processing of one or more transactions on behalf of subject entity106.

Collectively network environment100provides a system that facilitates a partner web service116to utilize evaluations made by the subject evaluation service124regarding the subject entity106to permit the partner web service116to decide whether to proceed with a transaction. Such evaluations might indicate that a fraudulent party is impersonating a subject entity and/or that a subject entity is attempting to perform a transaction that might come with increased risk. The subject evaluation service124can make these evaluations because subject evaluation service124tracks a subject entity and aggregates data as the subject entity performs transactions with a plurality of web services.

FIG.2AandFIG.2Billustrate a webpage embodiment of webpage/app200. For example, webpage/app200may be webpage/app118of partner web service116. More specifically, a computer or other access device (e.g., access device102) can run or otherwise display webpage/app200with a graphical user interface (GUI) on a display associated with the access device.

Webpage/app200may have one or more fields202,204,206,208that require input from a user (e.g., subject entity106). On computers and other access devices (e.g., access device102), the GUI may include a text cursor210and a cursor212. A text cursor210is a position indicator on the display where a user can enter text. Cursor212is a visible and moving pointer that the user controls with a mouse, touch pad, or similar input device. As a user fills out fields202,204,206,208, the user will utilize input devices, such as a keyboard, a mouse, a keypad, etc. For example, the user will type answers into fields202,204,206,208using a keyboard and/or keypad. Additionally, as the user completes an answer in one field (e.g., field202), the user will switch to another field (e.g., field204) by either pressing “tab” on the keyboard and/or moving the mouse to align cursor212over field204and click the mouse.

As discussed above, webpage/app200can include code, scripts, algorithms, and/or a SDK deployed thereon. The code is configured to record event data as the user utilizes the access device to interact with a GUI of webpage/app200. Event data can include a variety of information pertaining to aspects of how the subject entity106interacts with the webpage/app200. For example, event data can include, but is not limited to, x-y coordinates of cursor212, mouse movements, mouse clicks, mouse wheel scrolls, mousepad inputs, keyboard events, key inputs, keystrokes, keypress down, keypress releases, movement of the device, etc. The event data is also referred to herein as biometric data and/or behavioral data. The event data is a collection of such data that can be used to predict an age of the subject entity accessing webpage/app200of partner web service116.

For example,FIG.2Aillustrates a user that has typed an answer into field202using the keyboard. The code on webpage/app200records each individual keypress down on the keyboard with timestamps and each individual keypress release on the keyboard with timestamps. For example,FIG.2Aillustrates that the user typed or is typing “John Smith” in field202. Thus, the code records a timestamp and a keypress down event on the shift button and the letter “J” along with another timestamp and a keypress release event of the shift button and the letter “J.” The code continues to record these events for each keyboard event with respective timestamps.

FIG.2Billustrates the user has finished typing the answer in field204and moves the cursor212to field206. More specifically, the user moves cursor212from field204to field206by moving the mouse. The code on webpage/app200can record x-y coordinates of the cursor212in relation to the page along with timestamps. In some embodiments, the code can record actual movements of cursor212. Thus, the code records a set of x-y coordinates of the cursor212at field204and a respective timestamp, another set of x-y coordinates of the cursor212when the cursor212is moved over to field206and the respective timestamp, and a mouse click event or clicking of the mouse when the cursor212is over field206to select field206for text input. The code on webpage/app200then continues to record the typing event data associated with inputting text into field206(e.g., keypress down, keypress release, timestamps, etc.).

For example,FIG.2Billustrates a mouse trail214over webpage/app200. In some embodiments, the mouse trail214may not be visible to the user, but the data of mouse trail214can still be recorded despite not being displayed to the user. Mouse trail214is a set of coordinates associated with a timestamp. For example, each dot in mouse trail214can represent a timestamp and x-y coordinate of where the cursor212is on the display at a particular time. In other words, each dot illustrates an example measurement or packet of data that captures some event (e.g., movement of the mouse). Thus, as these timestamps and x-y coordinates are aggregated, they form mouse trail214.

In some embodiments, webpage/app200can directly send the points and timestamps of mouse trail214directly to ML service112. In some embodiments, webpage/app200can process the data (e.g., timestamps and x-y coordinates) into refined information, such as velocity, jitter, hesitation percentage, and other behavioral biometrics, and send the processed or refined information to the subject evaluation service124and/or ML service112.

As discussed above, webpage/app200can include code to report various events to an API (e.g., API110of subject evaluation service124). In some instances, the webpage/app200can report the events directly to the API, and in some cases, the webpage/app200can report the events through the service associated with webpage/app200(e.g., partner web service116). In some embodiments, the code can asynchronously send the recorded data to a database (e.g., events database108) and/or a machine learning model (e.g., a machine learning model deployed on ML service112).

FIG.2Cillustrates an application embodiment of webpage/app200. For example, webpage/app200may be webpage/app118of partner web service116. More specifically, an access device (e.g., access device102) of the user can include a touchscreen device including, but not limited to, a smartphone, a tablet, a laptop, a touchscreen computer, a mobile device, and other touchscreen devices. The access device can run or otherwise display webpage/app200with a GUI on a touchscreen display of the access device.

Webpage/app200may have one or more fields202,204,206,208that require input from a user (e.g., subject entity106). The touchscreen display of the access device is configured to receive touch inputs216when the user touches the device. For example,FIG.2Cillustrates that the user has typed answers in fields202,204, and206.FIG.2Cfurther illustrates a touch input216at field208. In other words, the user has tapped the area of the display where the GUI displays field208. Webpage/app200is configured to record the touch input216, the location of the touch input216, and a timestamp for the touch input216.

In some embodiments, the access device is a mobile device that includes other sensors and webpage/app200is configured to record and/or receive sensor data from sensors of the mobile device. For example, modern smartphones now have accelerometers and gyroscopes that are configured to record sensor data that is indicative of motion and tilt of the smartphone. More specifically, gyroscopes are configured to measure tilt or rotation around one or more spatial axes. Accelerometers are configured to measure acceleration or change in velocity of the mobile device. Accordingly, webpage/app200(e.g., via the code running thereon) is configured to record measurements of rotation and changes in velocity of the mobile device. For example, some users may prefer to hold the phone lower and angle the phone at approximately a 45 degree angle respective to the ground. Other users may prefer to hold the phone higher and angle the phone near perpendicular to the ground at eye level. The gyroscope of the mobile device can identify the rotational orientation and store the orientation and/or the changes relative to a frame of reference as sensor data. Webpage/app200(e.g., via the code deployed thereon) can record the sensor data from the gyroscope and provide the data to an evaluation service (e.g., subject evaluation service124via API110) and/or a machine learning model (e.g., as deployed on ML service112). As another example, younger users of mobile devices are able to type more quickly while keeping the mobile device more stable. On the other hand, older users of mobile devices may type slower and have shakier hands. The accelerometer can measure the movement as the users tap the mobile device to type and the jitters of the older users and store the measurements as sensor data. As discussed above, webpage/app200(e.g., via the code executing on the mobile device) can record the sensor data from the accelerometer and provide the data to an evaluation service (e.g, subject evaluation service124via API110) and/or a machine learning model (e.g., as deployed on ML service112).

The machine learning model (e.g., as deployed on ML service112) is configured to receive event data of a user from a user device while the user interacts (e.g., fills out a form, presses through pages, etc.) with a GUI to access a service (e.g., webpage/app200, webpage/app118, partner web service116, etc.). The machine learning model is configured to predict a projected age for the user associated with the event data based on the received or inputted event data. In some embodiments, the machine learning model can derive behavioral biometrics or pseudo behavioral biometrics from the event data. As discussed above, the event data can include timestamps, movements of a mouse, clicking of the mouse, scrolling of a scroll wheel of the mouse, mousepad inputs, x-y coordinates of a cursor associated with the mouse, a key input on a keyboard, a key stroke, a keypress down of a key on the keyboard, a keypress release of the key on the keyboard, and field switching.

The machine learning model can, for example, derive a manner or habit of switching from one field to another field (e.g., by pressing the “tab” key, by clicking into the next field, by utilizing a combination of pressing the “tab” key and clicking the next field, etc.).

As another example, the machine learning model can derive a velocity and precision of mouse movements (e.g., by analyzing x-y coordinates of cursor212over time). In some embodiments, the velocity and precision of mouse movements can identify jitters, hesitation, or shakiness. For example, younger users tend to have better hand-eye coordination, which results in quicker and more precise mouse movements. On the other hand, older users tend to have slower and shakier mouse movements.

As yet another example, the machine learning model can derive an amount of time spent filling out the one or more fields of a form or other input habits including, but not limited to, frequency of typographical errors, usage of copy and paste controls, usage of input support software (e.g., sticky keys, filter keys, etc.).

Additionally, the machine learning model can derive typing speed and/or method of typing (e.g., using all ten fingers, using two fingers, individual touch input216for typing, continuous or “gesture” touch input216for typing, etc.). The typing speed and/or method of typing can further differentiate between different age groups. For example, very young children often type with one finger on each hand, while adults often type with all ten fingers, which results in faster typing and minimal or no time lag between key inputs and/or keypress and releases. As another example, certain age groups may gravitate towards a particular method of touchscreen typing (e.g., adults under 50 may often utilize gesture typing, while adults over 50 may more frequently individually use touch inputs216).

The machine learning model can predict, based on the event data and the derivations of behavioral and habitual patterns therefrom, a projected age of the user. More specifically, the machine learning model predicts, based on the event data obtained from the user device as the user interacted with the GUI of the service, a projected age of the user.

In some embodiments, the code is deployed on webpage/apps200of multiple different partner web services116. Each webpage/app200can send event data along with other identifying data (e.g., an account stored in account database122of partner web service116). For example, the user may utilize multiple different social media networks. Accordingly, each social media network can have a webpage/app200that includes code to record event data from the user device as the user interacts with the webpage/app200. The machine learning model can receive the event data for the user from all of the webpage/apps200(e.g., additional event data) and further refine derivations and predictions based on the additional event data.

In some embodiments, the machine learning model can determine whether a current interaction is fraudulent based on the additional event data. In some embodiments, the machine learning model can determine behavioral or habitual patterns of the user. For example, the machine learning model can identify that an average typing speed of the user is approximately 40 words per minute, a habit of utilizing the keyboard rather than the mouse to navigate the webpage (e.g., by pressing “tab,” “shift” and “tab,” “enter,” etc.). The machine learning model can compare the event data from the current interaction against the additional event data and the patterns derive therefrom. If the event data is significantly different from the identified behavioral patterns, then the machine learning model can determine that the current interaction is likely fraudulent and/or performed by a different person from the claimed user.

In some embodiments, the machine learning model can also receive inputted data. In other words, the machine learning model can receive data that the user input into fields field202,204,206,208. In some scenarios, the field may be for identifying an age of the user and the user can provide an age accordingly. The machine learning model can identify, based on the inputted age and an age prediction output (e.g., a projected or predicted age of the user), whether the interaction may be fraudulent. If the inputted age is beyond a threshold range of the predicted age, the machine learning model can flag or otherwise identify the interaction as potentially fraudulent. For example, the user may assert that the user is in an age group over 50, while the machine learning model may predict a projected age of the user to be in the early twenties. A threshold range may be within twenty years of the projected age. Thus, the user is outside of a threshold range of thirty to seventy years old. Accordingly, the machine learning model can flag that the interaction is likely being performed by a young person instead of the alleged older age. In some embodiments, the machine learning model can flag the interaction as fraudulent or otherwise require additional review or caution.

FIG.3illustrates an example method300for predicting an age of a user based on event data obtained from input devices of a user device while the user interacts with a GUI of a service. Although the example method300depicts a particular sequence of operations, the sequence may be altered without departing from the scope of the present disclosure. For example, some of the operations depicted may be performed in parallel or in a different sequence that does not materially affect the function of the method300. In other examples, different components of an example device or system that implements the method300may perform functions at substantially the same time or in a specific sequence.

At step302, method300includes receiving, by an evaluation service, a request from the service regarding the user. For example, API110and/or subject evaluation service124can receive a request from the service (e.g., partner web service116) regarding the user (e.g., subject entity).

At step304, method300includes receiving event data of a user from a user device while the user interacts with a graphical user interface (GUI) to access a service. For example, API110and/or subject evaluation service124can receive event data of the user from the user device while the user interacts with the GUI to access the service (e.g., partner web service116). In some embodiments, the event data includes behavioral biometrics of the user obtained from one or more input devices of the user device. In some embodiments, the user device is a mobile device and/or a mobile phone. In some embodiments, the one or more input devices include at least one of a gyroscope and an accelerometer. In some embodiments the event data includes type of data including at least one of a timestamp, movement of a mouse, clicking of the mouse, scrolling a scroll wheel of the mouse, a mousepad input, x-y coordinates of a cursor of the mouse, a key input on a keyboard, a key stroke, a keypress down of a key on the keyboard, a keypress release of the key on the keyboard, and field switching.

At step306, method300includes receiving additional event data of the user from the user device. For example, API110and/or subject evaluation service124can receive additional event data of the user from the user device. In some embodiments, the additional event data includes additional behavioral biometrics of the user obtained from the one or more input devices of the user device when the user is performing another interaction with another service on the user device. In some embodiments, the behavioral biometrics include at least one of a manner of switching from one field to another field, velocity of moving the mouse, jitter in mouse movements, typing speed, hesitation percentage, time spent filling out one or more fields of a form, input habits, and a frequency of typographic errors.

At step308, method300includes deriving the behavioral biometrics based on at least one of the types of data. For example, a machine learning model of ML service112and/or subject evaluation service124can derive behavioral biometrics based on at least one type of event data. For example, a machine learning model of ML service112can derive behavioral biometrics, such as velocity of moving the mouse, jitter in mouse movements, hesitation percentage, etc., from event data, such as x-y coordinates of the cursor of the mouse with respective timestamps. In some embodiments, the event data can be preprocessed to derive the behavioral biometrics and the behavioral biometrics are inputted directly into the machine learning model.

At step310, method300includes predicting, based on the event data, a projected age of the user. For example, a machine learning model of ML service112and/or subject evaluation service124can predict, based on the event data, a projected age of the user. In some embodiments, predicting the age of the user includes inputting the event data into a machine learning model, wherein the machine learning model is configured to receive event data and output an age prediction for a user associated with the event data.

At step312, method300includes receiving inputted data from the user device. For example, API110and/or subject evaluation service124can receive inputted data from the user device. In some embodiments, the inputted data is data that the user input during the interaction, and wherein the inputted data includes an age input for user.

At step314, method300includes determining, based on the age prediction output from the machine learning model, whether the interaction is fraudulent. For example, subject evaluation service124can determine, based on the age prediction output from the machine learning model for the event data from the user device as the user interacts with the GUI of the service, whether the interaction is fraudulent. In some embodiments, determining whether the interaction is fraudulent is further based on whether the event data matches the additional event data. In some embodiments, determining whether the interaction is fraudulent is further based on whether the projected age is within a threshold range of the age input for the user and/or if the age input for the user is within a threshold range of the projected age. Thus, the present technology provides additional information that facilitates identifying whether the user performing the interaction is actually the person that the user claims to be.

At step316, method300includes outputting, by the evaluation service, the projected age to the service. For example, subject evaluation service124can output the projected age to the service (e.g., partner web service116). In some embodiments, outputting the projected age is performed together with providing the determination of whether the interaction is fraudulent. For example, subject evaluation service124can provide an output indicating that the interaction is likely fraudulent because the projected age of the user is likely in their twenties, but the user account is for someone in their fifties.

FIG.4illustrates an example method400for training a machine learning algorithm to receive event data of a user from a user device while the user interacts with a GUI to access a service and predict, based on the event data obtained while the user interacts with the GUI, a projected age of the user. Although the example method400depicts a particular sequence of operations, the sequence may be altered without departing from the scope of the present disclosure. For example, some of the operations depicted may be performed in parallel or in a different sequence that does not materially affect the function of the method400. In other examples, different components of an example device or system that implements the method400may perform functions at substantially the same time or in a specific sequence.

At step402, method400includes training the machine learning model to receive the event data and predict the projected age. For example, subject evaluation service124and/or ML service112can train the machine learning model to receive the event data and predict the projected age.

At step404, method400includes providing prediction training inputs to the machine learning model. For example, subject evaluation service124and/or ML Service112can provide prediction training inputs to the machine learning model (e.g., from events database108, API110, webpage/app118, webpage/apps200, and/or partner web service116). In some embodiments, the prediction training inputs include a training data set of event data set and a training data set of projected ages. In some embodiments, the data includes one or more different types of data. A first type of data can have a higher variance than a second type of data and, consequently, the second type of data can have a lower variance than the first type of data.

At step406, method400includes increasing a weight of the first type of data for predicting the projected age. For example, subject evaluation service124and/or ML Service112can increase a weight of the first type of data for predicting the projected age. More specifically, method400can adjust a weight of a type of data based on a relative variance. For example, if the first type of data has a higher variance than the second type of data, method400can increase a weight of the first type of data or decrease a weight of the second type of data. As another example, if the second type of data falls below a threshold variance, then method400can remove the second type of data.

It is further considered that partner web service116can provide additional feedback regarding the actual age of the user. Subject evaluation service124and/or ML service112can utilize the additional feedback to continuously train the machine learning model.

FIG.5illustrates an example lifecycle500of a ML model in accordance with some examples. The first stage of the lifecycle500of a ML model is a data ingestion service502to generate datasets described below. ML models require a significant amount of data for the various processes described inFIG.5and the data persisted without undertaking any transformation to have an immutable record of the original dataset. The data can be provided from third party sources such as publicly available dedicated datasets. The data ingestion service502provides a service that allows for efficient querying and end-to-end data lineage and traceability based on a dedicated pipeline for each dataset, data partitioning to take advantage of the multiple servers or cores, and spreading the data across multiple pipelines to reduce the overall time to reduce data retrieval functions.

In some cases, the data may be retrieved offline that decouples the producer of the data from the consumer of the data (e.g., an ML model training pipeline). For offline data production, when source data is available from the producer, the producer publishes a message and the data ingestion service502retrieves the data. In some examples, the data ingestion service502may be online and the data is streamed from the producer in real-time for storage in the data ingestion service502.

After data ingestion service502, a data preprocessing service preprocesses the data to prepare the data for use in the lifecycle500and includes at least data cleaning, data transformation, and data selection operations. The data cleaning and annotation service504removes irrelevant data (data cleaning) and general preprocessing to transform the data into a usable form. The data cleaning and annotation service504includes labelling of features relevant to the ML model. In some examples, the data cleaning and annotation service504may be a semi-supervised process performed by a ML to clean and annotate data that is complemented with manual operations such as labeling of error scenarios, identification of untrained features, etc.

After the data cleaning and annotation service504, data segregation service506to separate data into at least a training set508, a validation dataset510, and a test dataset512. Each of the training set508, a validation dataset510, and a test dataset512are distinct and do not include any common data to ensure that evaluation of the ML model is isolated from the training of the ML model.

The training set508is provided to a model training service514that uses a supervisor to perform the training, or the initial fitting of parameters (e.g., weights of connections between neurons in artificial neural networks) of the ML model. The model training service514trains the ML model based a gradient descent or stochastic gradient descent to fit the ML model based on an input vector (or scalar) and a corresponding output vector (or scalar).

After training, the ML model is evaluated at a model evaluation service516using data from the validation dataset510and different evaluators to tune the hyperparameters of the ML model. The predictive performance of the ML model is evaluated based on predictions on the validation dataset510and iteratively tunes the hyperparameters based on the different evaluators until a best fit for the ML model is identified. After the best fit is identified, the test dataset512, or holdout data set, is used as a final check to perform an unbiased measurement on the performance of the final ML model by the model evaluation service516. In some cases, the final dataset that is used for the final unbiased measurement can be referred to as the validation dataset and the dataset used for hyperparameter tuning can be referred to as the test dataset.

After the ML model has been evaluated by the model evaluation service516, an ML model deployment service518can deploy the ML model into an application or a suitable device. The deployment can be into a further test environment such as a simulation environment, or into another controlled environment to further test the ML model.

After deployment by the ML model deployment service518, a performance monitor service520monitors for performance of the ML model. In some cases, the performance monitor service520can also record additional transaction data that can be ingested via the data ingestion service502to provide further data, additional scenarios, and further enhance the training of ML models.

FIG.6shows an example of computing system600, which can be for example any computing device making up access device102, partner web service116, partner link service120, subject evaluation service124, or any component thereof in which the components of the system are in communication with each other using connection602. Connection602can be a physical connection via a bus, or a direct connection into processor604, such as in a chipset architecture. Connection602can also be a virtual connection, networked connection, or logical connection.

Example computing system600includes at least one processing unit (CPU or processor)604and connection602that couples various system components including system memory608, such as read-only memory (ROM)610and random access memory (RAM)612to processor604. Computing system600can include a cache of high-speed memory606connected directly with, in close proximity to, or integrated as part of processor604.

Processor604can include any general purpose processor and a hardware service or software service, such as services616,618, and620stored in storage device614, configured to control processor604as well as a special-purpose processor where software instructions are incorporated into the actual processor design. Processor604may essentially be a completely self-contained computing system, containing multiple cores or processors, a bus, memory controller, cache, etc. A multi-core processor may be symmetric or asymmetric.

To enable user interaction, computing system600includes an input device626, which can represent any number of input mechanisms, such as a microphone for speech, a touch-sensitive screen for gesture or graphical input, keyboard, mouse, motion input, speech, etc. Computing system600can also include output device622, which can be one or more of a number of output mechanisms known to those of skill in the art. In some instances, multimodal systems can enable a user to provide multiple types of input/output to communicate with computing system600. Computing system600can include communication interface624, which can generally govern and manage the user input and system output. There is no restriction on operating on any particular hardware arrangement, and therefore the basic features here may easily be substituted for improved hardware or firmware arrangements as they are developed.

The storage device614can include software services, servers, services, etc., that when the code that defines such software is executed by the processor604, it causes the system to perform a function. In some embodiments, a hardware service that performs a particular function can include the software component stored in a computer-readable medium in connection with the necessary hardware components, such as processor604, connection602, output device622, etc., to carry out the function.

Aspect 1. A computer-implemented method comprising: receiving event data of a user from a user device while the user interacts with a graphical user interface (GUI) to access a service, wherein the event data includes behavioral biometrics of the user obtained from one or more input devices of the user device; and predicting, based on the event data, a projected age of the user, wherein predicting the age of the user includes inputting the event data into a machine learning model, wherein the machine learning model is configured to receive event data and output an age prediction for a user associated with the event data.

Aspect 2. The computer-implemented method of Aspect 1, further comprising: determining, based on the age prediction output from the machine learning model for the event data from the user device as the user interacts with the GUI of the service, whether the interaction is fraudulent.

Aspect 3. The computer-implemented method of any of Aspects 1 to 2, further comprising: receiving, by an evaluation service, a request from the service regarding the user; and outputting, by the evaluation service, the projected age to the service.

Aspect 4. The computer-implemented method of any of Aspects 1 to 3, further comprising: receiving additional event data of the user from the user device, wherein the additional event data includes additional behavioral biometrics of the user obtained from the one or more input devices of the user device when the user is performing another interaction with another service on the user device, wherein determining whether the interaction is fraudulent is further based on whether the event data matches the additional event data.

Aspect 5. The computer-implemented method of any of Aspects 1 to 4, further comprising: receiving inputted data from the user device, wherein the inputted data is data that the user input during the interaction, and wherein the inputted data includes an age input for user, and wherein determining whether the interaction is fraudulent is further based on whether the projected age is within a threshold range of the age input for the user.

Aspect 6. The computer-implemented method of any of Aspects 1 to 5, wherein the user device is a mobile phone, and wherein the one or more input devices include at least one of a gyroscope and an accelerometer.

Aspect 7. The computer-implemented method of any of Aspects 1 to 6, wherein the event data includes types of data including at least one of a timestamp, movement of a mouse, clicking of the mouse, scrolling a scroll wheel of the mouse, a mousepad input, x-y coordinates of a cursor of the mouse, a key input on a keyboard, a key stroke, a keypress down of a key on the keyboard, a keypress release of the key on the keyboard, and field switching.

Aspect 8. The computer-implemented method of any of Aspects 1 to 7, further comprising: deriving the behavioral biometrics based on at least one of the types of data.

Aspect 9. The computer-implemented method of any of Aspects 1 to 8, wherein the behavioral biometrics include at least one of a manner of switching from one field to another field, velocity of moving the mouse, jitters, typing speed, hesitation percentage, time spent filling out one or more fields of a form, input habits, and a frequency of typographic errors.

Aspect 10. The computer-implemented method of any of Aspects 1 to 9, further comprising: training the machine learning model to receive the event data and predict the projected age, the training comprising: providing prediction training inputs to the machine learning model, wherein the prediction training inputs include a training data set of event data set and a training data set of projected ages.

Aspect 11. The computer-implemented method of any of Aspects 1 to 10, wherein the event data includes one or more different types of data, and wherein a first type of data has a higher variance than a second type of data and the second type of data has a lower variance than the first type of data, and wherein training the machine learning model further comprises: increasing a weight of the first type of data for predicting the projected age.

Aspect 12. A system includes a storage (implemented in circuitry) configured to store instructions and a processor. The processor configured to execute the instructions and cause the processor to: receive event data of a user from a user device while the user interacts with a graphical user interface (GUI) to access a service, wherein the event data includes behavioral biometrics of the user obtained from one or more input devices of the user device; and predict, based on the event data, a projected age of the user, wherein predicting the age of the user includes inputting the event data into a machine learning model, wherein the machine learning model is configured to receive event data and output an age prediction for a user associated with the event data.

Aspect 13. The system of Aspect 12, wherein the instructions further cause the processor to: determine, based on the age prediction output from the machine learning model for the event data from the user device as the user interacts with the GUI of the service, whether the interaction is fraudulent.

Aspect 14. The system of any of Aspects 12 to 13, wherein the instructions further cause the processor to: receive, by an evaluation service, a request from the service regarding the user; and output, by the evaluation service, the projected age to the service.

Aspect 15. The system of any of Aspects 12 to 14, wherein the instructions further cause the processor to: receive additional event data of the user from the user device, wherein the additional event data includes additional behavioral biometrics of the user obtained from the one or more input devices of the user device when the user is performing another interaction with another service on the user device, wherein determining whether the interaction is fraudulent is further based on whether the event data matches the additional event data.

Aspect 16. The system of any of Aspects 12 to 15, wherein the instructions further cause the processor to: receive inputted data from the user device, wherein the inputted data is data that the user input during the interaction, and wherein the inputted data includes an age input for user, and wherein determining whether the interaction is fraudulent is further based on whether the projected age is within a threshold range of the age input for the user.

Aspect 17. The system of any of Aspects 12 to 16, wherein the user device is a mobile phone, and wherein the one or more input devices include at least one of a gyroscope and an accelerometer.

Aspect 18. The system of any of Aspects 12 to 17, wherein the event data includes types of data including at least one of a timestamp, movement of a mouse, clicking of the mouse, scroll a scroll wheel of the mouse, a mousepad input, x-y coordinates of a cursor of the mouse, a key input on a keyboard, a key stroke, a keypress down of a key on the keyboard, a keypress release of the key on the keyboard, and field switching.

Aspect 19. The system of any of Aspects 12 to 18, wherein the instructions further cause the processor to: derive the behavioral biometrics based on at least one of the types of data.

Aspect 20. The system of any of Aspects 12 to 19, wherein the behavioral biometrics include at least one of a manner of switching from one field to another field, velocity of moving the mouse, jitters, typing speed, hesitation percentage, time spent filling out one or more fields of a form, input habits, and a frequency of typographic errors.

Aspect 21. The system of any of Aspects 12 to 20, wherein the instructions further cause the processor to: train the machine learning model to receive the event data and predict the projected age, the training comprising: provide prediction training inputs to the machine learning model, wherein the prediction training inputs include a training data set of event data set and a training data set of projected ages.

Aspect 22. The system of any of Aspects 12 to 21, wherein the event data includes one or more different types of data, and wherein a first type of data has a higher variance than a second type of data and the second type of data has a lower variance than the first type of data, and wherein training the machine learning model further comprises: increase a weight of the first type of data for predicting the projected age.

Aspect 23. A non-transitory computer readable medium comprising instructions, which when executed by a computing system, cause the computing system to: receive event data of a user from a user device while the user interacts with a graphical user interface (GUI) to access a service, wherein the event data includes behavioral biometrics of the user obtained from one or more input devices of the user device; and predict, based on the event data, a projected age of the user, wherein predicting the age of the user includes inputting the event data into a machine learning model, wherein the machine learning model is configured to receive event data and output an age prediction for a user associated with the event data.

Aspect 24. The computer readable medium of Aspect 23, wherein the instructions, when executed by the computing system, further cause the computing system to: determine, based on the age prediction output from the machine learning model for the event data from the user device as the user interacts with the GUI of the service, whether the interaction is fraudulent.

Aspect 25. The computer readable medium of any of Aspects 23 to 24, wherein the instructions, when executed by the computing system, further cause the computing system to: receive, by an evaluation service, a request from the service regarding the user; and output, by the evaluation service, the projected age to the service.

Aspect 26. The computer readable medium of any of Aspects 23 to 25, wherein the instructions, when executed by the computing system, further cause the computing system to: receive additional event data of the user from the user device, wherein the additional event data includes additional behavioral biometrics of the user obtained from the one or more input devices of the user device when the user is performing another interaction with another service on the user device, wherein determining whether the interaction is fraudulent is further based on whether the event data matches the additional event data.

Aspect 27. The computer readable medium of any of Aspects 23 to 26, wherein the instructions, when executed by the computing system, further cause the computing system to: receive inputted data from the user device, wherein the inputted data is data that the user input during the interaction, and wherein the inputted data includes an age input for user, and wherein determining whether the interaction is fraudulent is further based on whether the projected age is within a threshold range of the age input for the user.

Aspect 28. The computer readable medium of any of Aspects 23 to 27, wherein the user device is a mobile phone, and wherein the one or more input devices include at least one of a gyroscope and an accelerometer.

Aspect 29. The computer readable medium of any of Aspects 23 to 28, wherein the event data includes types of data including at least one of a timestamp, movement of a mouse, clicking of the mouse, scroll a scroll wheel of the mouse, a mousepad input, x-y coordinates of a cursor of the mouse, a key input on a keyboard, a key stroke, a keypress down of a key on the keyboard, a keypress release of the key on the keyboard, and field switching.

Aspect 30. The computer readable medium of any of Aspects 23 to 29, wherein the instructions, when executed by the computing system, further cause the computing system to: derive the behavioral biometrics based on at least one of the types of data.

Aspect 31. The computer readable medium of any of Aspects 23 to 30, wherein the behavioral biometrics include at least one of a manner of switching from one field to another field, velocity of moving the mouse, jitters, typing speed, hesitation percentage, time spent filling out one or more fields of a form, input habits, and a frequency of typographic errors.

Aspect 32. The computer readable medium of any of Aspects 23 to 31, wherein the instructions, when executed by the computing system, further cause the computing system to: train the machine learning model to receive the event data and predict the projected age, the training comprising: provide prediction training inputs to the machine learning model, wherein the prediction training inputs include a training data set of event data set and a training data set of projected ages.

Aspect 33. The computer readable medium of any of Aspects 23 to 32, wherein the event data includes one or more different types of data, and wherein a first type of data has a higher variance than a second type of data and the second type of data has a lower variance than the first type of data, and wherein training the machine learning model further comprises: increase a weight of the first type of data for predicting the projected age.