System and methods for dynamic digital threat mitigation

Patent metadata

Field	Value
Publication number	US-10643216-B2
Application number	US-201916357593-A
Country	US
Kind code	B2
Filing date	Mar 19, 2019
Priority date	Jul 17, 2017
Publication date	May 5, 2020
Grant date	May 5, 2020

Abstract

Systems and methods include: receiving digital event type data that define attributes of a digital event type; receiving digital fraud policy that defines a plurality of digital processing protocols; transmitting via a network the digital event data and the digital fraud policy to a remote digital fraud mitigation platform; using the digital event data to configure a first computing node comprising an events data application program interface or an events data computing server to detect digital events that classify as the digital event type; using digital fraud policy to configure a second computing node comprising a decisioning API or a decisioning computing server to automatically evaluate and automatically select one digital event processing outcome of a plurality of digital event processing outcomes that indicates a disposal of the digital events classified as the digital event type; and implementing a digital threat mitigation application process flow that evaluates digital event data.

First claim

What is claimed:

1. A machine learning-based method for mitigating digital fraud and digital abuse, the method comprising:
an events application programming interface (API) that interactively communicates with one or more endpoints of a digital fraud detection and mitigation platform and that collects various digital event data of a predetermined type from one or more online service providers using the digital fraud detection and mitigation platform, wherein the various digital event data of the predetermined type relate to online activities of one or more users involved with one or more digital services provided by an online service provider;
a threat score API that exposes a machine learning-based threat score using a machine learning-based computation against the various digital event data of the predetermined type collected via the events API, wherein the threat score API interfaces with one or more endpoints of the platform that operate machine learning models that produce threat scores for customers of the digital fraud detection and mitigation platform;
at the digital fraud detection and mitigation platform:
collecting from a distinct online service provider via the events API digital event data;
generating via the threat score API a threat score, produced by the machine learning model endpoints of the threat score API, for the digital event data;
implementing a digital threat evaluation computing node that comprises a plurality of differentiated and disparate evaluation stages, wherein:
each of the plurality of differentiated and disparate evaluation stages comprises predetermined evaluation criteria for evaluating the digital event data, the predetermined evaluation criteria for each of the plurality of differentiated and disparate stages is different,
the plurality of differentiated and disparate evaluation stages are arranged in a sequential ordering requiring a processing of the digital event data and the threat score by each stage in a predefined order, wherein if the processing of the digital event data and the threat score fails at a given stage, the processing of the digital event data and the threat score does not loop at the given stage and times out from the given stage, wherein each of the plurality of differentiated and disparate stages is implemented by distinct circuitry;

setting a distinct minimum threat score threshold at each of the plurality of differentiated and disparate evaluation stages of the computing node, wherein the distinct minimum threat score threshold increases with each successive stage of the plurality of differentiated and disparate evaluation stages of the computing node;
setting, for each of the plurality of differentiated and disparate evaluation stages of the computing node, a distinct routing instruction to a distinct one of a plurality of distinct decisioning nodes;
passing the digital event data and the threat score through one or more of the plurality of differentiated and disparate evaluation stages of the computing node;
evaluating by the computing node one or more of the digital event data and the threat score of the digital event data,
wherein:
if the threat score for the digital event data satisfies or exceeds the distinct minimum threat score threshold at a given stage of the plurality of differentiated and disparate evaluation stages or if a timeout occurs, passing the digital event data and the threat score to a successive stage of the plurality of differentiated and disparate evaluation stages of the computing node until the threat score fails to satisfy the distinct minimum threshold of a successive stage or until an automated decision is achieved at the computing node;
if the threat score for the digital event data does not satisfy the distinct minimum threat score threshold of the given stage of the plurality of differentiated and disparate evaluation stages of the computing node, routing the digital event data and threat score based on the distinct routing instruction for a current stage of the computing node to the distinct one of the plurality of distinct decision nodes away from the computing node;
identifying a disposal decision for the digital event data based on the distinct one of the plurality of distinct decision nodes; and
exposing the disposal decision and the threat score for the digital event data via the threat score API.

2. A system configured to mitigate digital fraud and digital abuse, the system comprising:
an events application programming interface that interactively communicates with one or more endpoints of a digital threat mitigation service and that collects various digital event data from one or more online service providers using the digital fraud detection and mitigation platform, wherein the various digital event data relate to online activities of one or more users involved with one or more digital services provided by an online service provider;
a threat score API that exposes a machine learning-based threat score using a machine learning-based computation against the various digital event data collected via the events API, wherein the threat score API interfaces with one or more endpoints of the platform that operate machine learning models that produce threat scores for customers of the digital fraud detection and mitigation platform; and
one or more hardware computer servers implementing the digital threat mitigation service to:
identify a digital fraud policy that defines a plurality of digital event processing protocols to enable automated decisioning of a disposal decision for digital event data associated with the online service provider and associated with an online transaction, and wherein the digital threat mitigation service uses the digital fraud policy to:
implement an operation of a first computing node that collects via the events API the digital event data associated with the online service provider; and
generate via the threat score API a digital threat score, produced by the machine learning model endpoints of the threat score API, for the digital event data;
implement an operation of a second computing node that comprises a plurality of differentiated and disparate evaluation stages by using the digital fraud policy to set different predetermined evaluation criteria at each of the plurality of differentiated and disparate evaluation stages of the second computing node for processing the digital event data and the associated digital threat score, wherein the plurality of differentiated and disparate evaluation stages are arranged in a sequential ordering requiring a processing of the digital event data and the digital threat score by each stage in a predefined order, wherein if the processing of the digital event data and the digital threat score fails at a given stage, the processing of the digital event data and the digital threat score does not loop at the given stage and times out from the given stage, wherein each of the plurality of differentiated and disparate stages is implemented by distinct circuitry;
set a distinct minimum threat score threshold at each of the plurality of differentiated and disparate evaluation stages of the second computing node, wherein the distinct minimum threat score threshold increases with each successive stage of the plurality of differentiated and disparate evaluation stages of the second computing node;
set, for each of the plurality of differentiated and disparate evaluation stages of the second computing node, a distinct routing instruction to a distinct one of a plurality of distinct disposal computing nodes;
pass the digital event data and the digital threat score through one or more of the plurality of differentiated and disparate evaluation stages of the second computing node;
evaluate by the second computing node one or more of the digital event data and the digital threat score of the digital event dat

Assignees

• Sift Science Inc

Inventors

• Sadaghiani Fred
• Wylde Micah
• Gu Keren
• Ho Eugenia
• Grant Noah

Classifications

• G06F16/285

  Clustering or classification · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title