Dynamic record identification and analysis computer system with event monitoring components

Patent metadata

Field	Value
Publication number	US-10757123-B2
Application number	US-201815944908-A
Country	US
Kind code	B2
Filing date	Apr 4, 2018
Priority date	Jan 25, 2018
Publication date	Aug 25, 2020
Grant date	Aug 25, 2020

Abstract

Aspects of the disclosure relate to deploying and utilizing a dynamic record identification and analysis computer system with event monitoring components. A computing device may receive account reconnaissance data identifying a first plurality of user accounts that have experienced at least one event associated with account security concern characteristics. The computing platform may analyze event history data associated with the first plurality of user accounts to identify one or more common interactions associated with a subset of the first plurality of user accounts. The computing platform may identify a point of compromise among the subset of the first plurality of user accounts. Subsequently, the computing platform may search enterprise user account records to identify a second plurality of user accounts that have at least one event associated with the point of compromise. The computing platform may add the second plurality of user accounts to an alert table.

First claim

What is claimed is:

1. A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive account reconnaissance data identifying a first plurality of user accounts that have experienced at least one event associated with account security concern characteristics;
based on receiving the account reconnaissance data identifying the first plurality of user accounts that have experienced at least one event associated with account security concern characteristics, analyze event history data associated with the first plurality of user accounts to identify one or more common interactions associated with a subset of the first plurality of user accounts;
based on analyzing the event history data associated with the first plurality of user accounts to identify the one or more common interactions associated with the subset of the first plurality of user accounts, identify a point of compromise among the subset of the first plurality of user accounts, the point of compromise corresponding to a particular common interaction of the one or more common interactions, wherein identifying the point of compromise among the subset of the first plurality of user accounts comprises identifying the point of compromise among the subset of the first plurality of user accounts based on transaction history information associated with the subset of the first plurality of user accounts;
based on identifying the point of compromise among the subset of the first plurality of user accounts, generate a validation user interface for a user of an analyst computer system, the validation user interface comprising at least one user-selectable element of a plurality of user-selectable elements enabling the user of the analyst computer system to provide input validating the point of compromise identified by the computing platform;
provide, via the communication interface, to the analyst computer system, the validation user interface generated for the user of the analyst computer system, wherein providing the validation user interface generated for the user of the analyst computer system to the analyst computer system causes the analyst computer system to display the validation user interface to the user of the analyst computer system;
receive, via the communication interface, from the analyst computer system, validation information indicating that the at least one user-selectable element of the plurality of user-selectable elements enabling the user of the analyst computer system to provide input validating the point of compromise identified by the computing platform has been selected by the user of the analyst computer system to validate the point of compromise identified by the computing platform;
search enterprise user account records to identify a second plurality of user accounts that have at least one event associated with the point of compromise;
based on searching the enterprise user account records to identify the second plurality of user accounts, add the second plurality of user accounts to an alert table;
generate one or more system configuration commands based on adding the second plurality of user accounts to the alert table;
send, via the communication interface, to an account management computer system, the one or more system configuration commands, wherein sending the one or more system configuration commands to the account management computer system causes the account management computer system to restrict transaction requests associated with the second plurality of user accounts processed by the account management computer system; and
update merchant weighting information maintained by the computing platform in a merchant database maintained by the computing platform based on adding the second plurality of user accounts to the alert table, wherein updating the merchant weighting information comprises increasing or decreasing at least one weight applied to at least one specific merchant based on identifying the at least one specific merchant as the point of compromise.

2. The computing platform of claim 1 , wherein identifying the point of compromise among the subset of the first plurality of user accounts comprises identifying the point of compromise among the subset of the first plurality of user accounts based on initial merchant weighting information determined and maintained by the computing platform.

3. The computing platform of claim 2 , wherein identifying the point of compromise among the subset of the first plurality of user accounts comprises identifying the point of compromise among the subset of the first plurality of user accounts based on temporal grouping information determined and maintained by the computing platform.

4. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
prior to receiving the account reconnaissance data identifying the first plurality of user accounts that have experienced at least one event associated with account security concern characteristics:
receive, via the communication interface, from an account reconnaissance identification computer system, configuration information defining a data monitoring schedule for the computing platform; and
set one or more configuration preferences for the computing platform based on the configuration information defining the data monitoring schedule for the computing platform.

5. The computing platform of claim 4 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
prior to receiving the account reconnaissance data identifying the first plurality of user accounts that have experienced at least one event associated with account security concern characteristics:
request, via the communication interface, from the account reconnaissance identification computer system, the account reconnaissance data identifying the first plurality of user accounts that have experienced at least one event associated with account security concern characteristics, based on the one or more configuration preferences.

6. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
after receiving the account reconnaissance data identifying the first plurality of user accounts that have experienced at least one event associated with account security concern characteristics:
send, via the communication interface, to the account management computer system, a request for account activity information associated with the first plurality of user accounts; and
receive, via the communication interface, from the account management computer system, the event history data associated with the first plurality of user accounts in response to the request for the account activity information associated with the first plurality of user accounts.

7. The computing platform of claim 6 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
load, from the merchant database maintained by the computing platform, initial merchant weighting information determined by the computing platform based on previously identified connections between one or more specific merchants and one or more specific occurrences of account reconnaissance activity,
wherein identifying the point of compromise among the sub

Assignees

• Bank Of America

Inventors

• Bearley Amijo
• Jones Robert D
• Bell Kolt
• Widmann Craig

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F16/9535

  Search customisation based on user profiles and personalisation · CPC title

• G06F16/955

  using information identifiers, e.g. uniform resource locators [URL] · CPC title