System and methods for dynamic digital threat mitigation

Patent metadata

Field	Value
Publication number	US-10296912-B2
Application number	US-201816138311-A
Country	US
Kind code	B2
Filing date	Sep 21, 2018
Priority date	Jul 17, 2017
Publication date	May 21, 2019
Grant date	May 21, 2019

Abstract

Systems and methods include: implementing a first machine learning model to generate an output of a global digital threat score for an online activity based on an input of the collected digital event data; implementing a second machine learning model that generates a category inference of a category of digital fraud or a category of digital abuse from a plurality of digital fraud or digital abuse categories; selecting a third machine learning model from an ensemble of digital fraud or digital abuse machine learning models based on the category inference generated by the second machine learning model, wherein the ensemble of digital fraud or digital abuse machine learning models comprise a plurality of disparate digital fraud or digital abuse category-specific machine learning models; and implementing the selected third machine learning model to generate a digital fraud or digital abuse category-specific threat score based on the digital event data.

First claim

What is claimed:

1. A machine learning system comprising:
one or more computing server devices that implement a remote machine learning service comprising:
a machine learning system that:
implements a global scoring machine learning model that generates a global digital threat score for an online activity based on an input of digital event data associated with the online activity;
implements a companion machine learning model that generates a category inference that indicates a probability of an existence within the online activity of a category of digital fraud or a category of digital abuse from a plurality of digital fraud or digital abuse categories based on the digital event data,
wherein if the probability of the category inference satisfies or exceeds a predetermined threshold, automatically warping the global digital threat score that was generated for the online activity to a category-specific threat score that is distinct from the global threat score and that is for the category of digital fraud or the category of digital abuse of the online activity, wherein warping the global threat score includes:
parsing from the digital event data a subset of digital event data that is likely to be useful in generating the category-specific digital threat score; and
providing the subset of digital event data as input for warping the global threat score to the category-specific threat score;

wherein the machine learning service:
returns the global threat score and the category-specific threat score for the online activity to a remote service provider associated with the online activity thereby enabling an implementation of one or more online risk mitigation protocols that reduce or eliminate the category of digital abuse or the category of digital fraud based on the category-specific threat score.

2. The system according to claim 1 , wherein
the global digital threat score is agnostic to a category of digital abuse or a category of digital fraud.

3. The system of according to claim 1 , wherein
the category-specific threat score indicates a probability or a likelihood that the online activity involves the category of digital fraud or the category of digital abuse of the category inference.

4. The system according to claim 1 , further comprising:
an application programming interface (API) that is implemented by the remote machine learning service and that is configured to collect requests for the global digital threat score and/or the category-specific threat score.

5. The system according to claim 4 , wherein
the machine learning service receives via the API a multi-part request comprising (i) a request for the global digital threat score and (ii) another request for the category-specific threat score.

6. The system according to claim 1 , wherein
the machine learning service further:
identifies one or more features of the digital event data that operate to increase or decrease a value of the probability of the category inference of the existence within the online activity of the category of digital fraud or the category of digital abuse,
wherein returning the category-specific threat score includes returning the one or more features as drivers of the category-specific threat score.

7. The system according to claim 6 , wherein
the machine learning service further:
identifies user identification data that identifies a user involved in the online activity; and
converts the user identification data associated with the digital event data into queries used to collect historical digital event data associated with the user involved in the online activity from one or more databases of the remote machine learning service; and

provides the historical digital event data associated with the user as additional input into the global scoring machine learning model when generating the global digital threat score.

8. The system according to claim 1 , wherein
the global digital threat score comprises a binary indication of an existence or non-existence of digital fraud or digital abuse within the online activity.

9. The system according to claim 1 , wherein
the companion machine learning model is automatically implemented when it is determined that the service provider associated with the digital event data is susceptible to one or more categories of digital abuse or digital fraud based on historical data associated with the service provider.

10. The system according to claim 1 , wherein:
the one or more categories of digital fraud or digital abuse includes one or more of digital payment abuse, digital content abuse, digital promotion abuse, digital account takeover, and digital account abuse.

11. A method for predicting and/or classifying digital fraud or digital abuse, the method comprising:
at a machine learning service comprising a machine learning system:
implementing a global scoring machine learning model that generates a global digital threat score for an online activity based on an input of digital event data associated with the online activity;
implementing a companion machine learning model that generates a category inference that indicates a probability of an existence within the online activity of a category of digital fraud or a category of digital abuse from a plurality of digital fraud or digital abuse categories based on the digital event data,
wherein if the probability of the category inference satisfies or exceeds a predetermined threshold, automatically warping the global digital threat score that was generated for the online activity to a category-specific threat score that is distinct from the global threat score and that is for the category of digital fraud or the category of digital abuse of the online activity;
identifying one or more features of the digital event data that operate to increase or decrease a value of the probability of the category inference of the existence within the online activity of the category of digital fraud or the category of digital abuse;
returning by the machine learning service the global threat score and the category-specific threat score for the online activity to a remote service provider associated with the online activity thereby enabling an implementation of one or more online risk mitigation protocols that reduce or eliminate the category of digital abuse or the category of digital fraud based on the category-specific threat score, wherein returning the category-specific threat score includes returning the one or more features as drivers of the category-specific threat score.

12. The method according to claim 11 , wherein
the category-specific threat score indicates a probability or a likelihood that the online activity involves the category of digital fraud or the category of digital abuse of the category inference.

Assignees

• Sift Science Inc

Inventors

• Sadaghiani Fred
• Paino Alex
• Burnim Jacob
• Gu Keren
• Lee Gary
• Grant Noah
• Ho Eugenia
• Beeferman Doug

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F16/285

  Clustering or classification · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06N20/00

  Machine learning · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title