Systems and methods for detecting resources responsible for events

Patent metadata

Field	Value
Publication number	US-10742671-B2
Application number	US-201916271619-A
Country	US
Kind code	B2
Filing date	Feb 8, 2019
Priority date	Dec 30, 2016
Publication date	Aug 11, 2020
Grant date	Aug 11, 2020

Abstract

Systems and methods are disclosed for identifying resources responsible for events. In one embodiment, a method may include determining a number of unique actors in a plurality of actors that have accessed the resource. The method may further include identifying from the plurality of actors a set of affected actors that has been affected by an event and identifying from the set of affected actors a subset of resource-affected actors that accessed the resource prior to being affected by the event. The method may further include determining a number of resource-affected actors in the subset of resource-affected actors and, based on the number of unique actors and the number of resource-affected actors, determining an event score for the resource. The event score may be a lower bound of a confidence interval of a binomial proportion of the number of resource-affected actors to the number of unique actors.

First claim

The invention claimed is:

1. A system, comprising:
a memory storing instructions; and
a processor configured to execute the instructions to perform operations comprising:
receiving data associated with at least one resource;
identifying, in real-time as the data associated with the at least one resource is received, a plurality of first actors that have accessed the at least one resource;
determining a number of unique actors from the first actors;
identifying from the unique actors, a set of affected actors that have been affected by an event;
identifying, from the set of affected actors, a subset of resource-affected actors comprising affected actors that accessed the at least one resource prior to being affected by the event;
determining a number of resource-affected actors in the subset of resource-affected actors;
determining an event score for the resource based on the number of unique actors and the number of resource-affected actors, wherein the event score comprises a lower bound of a confidence interval of a binomial proportion of the number of resource-affected actors to the number of unique actors;
determining an aggregated event score for at least one unique actor that accessed the at least one resource, based on the event score for the at least one resource;
flagging the at least one unique actor when their aggregated event score exceeds a predetermined threshold; and
declining any incoming purchases by the at least one unique actor whose aggregated event score exceeds the predetermined threshold.

2. The system of claim 1 , wherein the confidence interval comprises a Clopper-Pearson interval.

3. The system of claim 1 , wherein the confidence interval comprises a Wald Interval.

4. The system of claim 1 , wherein the plurality of first actors comprises users, financial cards, or accounts.

5. The system of claim 1 , wherein the at least one resource is an automated teller machine (ATM), a database, or a merchant.

6. The system of claim 1 , further comprising applying a Bloom filter to the data associated with the at least one resource.

7. The system of claim 1 , further comprising a modeling system configured to generate models illustrating events traceable to the at least one resource.

8. The system of claim 1 , wherein the event is a security breach, an unauthorized data access, an instance of fraud, or a change in customer behavior.

9. The system of claim 1 , further comprising generating a graphical user interface configured to:
receive input from a user; and
create in response to the input at least one display identifying the event score for the at least one resource and the aggregated score for the at least one unique actor.

10. A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising:
receiving data associated with at least one resource;
identifying, in real-time as the data associated with the at least one resource is received, a plurality of first actors that have accessed the at least one resource;
determining a number of unique actors from the first actors;
identifying from the unique actors, a set of affected actors that have been affected by an event;
identifying, from the set of affected actors, a subset of resource-affected actors comprising affected actors that accessed the resource prior to being affected by the event;
determining a number of resource-affected actors in the subset of resource-affected actors;
determining an event score for the resource based on the number of unique actors and the number of resource-affected actors, wherein the event score comprises a lower bound of a confidence interval of a binomial proportion of the number of resource-affected actors to the number of unique actors; and
determining an aggregated event score for at least one unique actor that accessed the at least one resource, based on the event score for the resource;
flagging the at least one unique actor when their aggregated event score exceeds a predetermined threshold and
declining any incoming purchases by the at least one unique actor whose aggregated event score exceeds the predetermined threshold.

11. The non-transitory computer-readable medium of claim 10 , wherein the number of resource-affected actors in the subset of resource-affected actors is determined by calculating a weighted sum of the subset of resource-affected actors, weighted according to a proportion of a number of accesses made by each of the resource-affected actors at the at least one resource.

12. The non-transitory computer-readable medium of claim 10 , wherein the confidence interval comprises a Clopper-Pearson interval.

13. The non-transitory computer-readable medium of claim 10 , wherein the confidence interval comprises a Wald Interval.

14. The non-transitory computer-readable medium of claim 10 , wherein the plurality of first actors comprises users, financial cards, or accounts.

15. The non-transitory computer-readable medium of claim 10 , wherein the at least one resource is an automated teller machine (ATM), a database, or a merchant.

16. The non-transitory computer-readable medium of claim 10 , further comprising a modeling system configured to generate models illustrating events traceable to the at least one resource.

17. The non-transitory computer-readable medium of claim 10 , wherein the event is a security breach, an unauthorized data access, an instance of fraud, or a change in customer behavior.

18. The non-transitory computer-readable medium of claim 10 , further comprising generating a graphical user interface configured to:
receive input from a user; and
create in response to the input at least one display identifying the event score for the at least one resource and the aggregated score for the at least one unique actor.

Assignees

• Capital One Services Llc

Inventors

• Moradi Chris
• Sisk Jacob
• Bloom Evan
• Gimby Craig
• Sun Xin

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• H04W12/126

  Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning · CPC title

• H04W12/122

  Counter-measures against attacks; Protection against rogue devices · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title

• G06F16/9038

  Presentation of query results · CPC title