Fraud detection based on analysis of frequency-domain data

Patent metadata

Field	Value
Publication number	US-11909749-B2
Application number	US-202117215610-A
Country	US
Kind code	B2
Filing date	Mar 29, 2021
Priority date	Jul 2, 2018
Publication date	Feb 20, 2024
Grant date	Feb 20, 2024

Abstract

A risk analysis system configures the decision engine to detect anomalous online activities by analyzing usage patterns associated with one or more user accounts across multiple frequencies. The risk analysis system obtains transaction log data representing transactions associated with one or more accounts, and extracts data from the transaction log data to generate time-series data along a time dimension. The time-series data may represent usage characteristics of one or more user accounts over a period of time. The risk analysis system derives pattern data representing usage patterns across multiple different frequencies based on the time-series data. The risk analysis system then configures the decision engine to detect anomalous account activities based on the derived pattern data.

First claim

What is claimed is:

1. A system, comprising:
one or more hardware processors, one or more non-transitory computer-readable memories, with program instructions stored on the one or more non-transitory computer-readable memories, the one or more hardware processors configured to execute the program instructions to cause the system to perform operations comprising:
generating first account data corresponding to a user account, wherein the first account data comprises time series data that corresponds to a first account attribute;
deriving second account data from the first account data, wherein the second account data corresponds to a plurality of account usage frequencies;
determining a plurality of pattern strength values corresponding to the plurality of account usage frequencies based on the second account data, wherein each pattern strength value in the plurality of pattern strength values indicates a corresponding strength of a pattern existing in the first account data according to a corresponding account usage frequency in the plurality of account usage frequencies;
determining (i) a first pattern index based on a first portion of the plurality of pattern strength values that corresponds to a first account usage frequency range and (ii) a second pattern index based on a second portion of the plurality of pattern strength values that corresponds to a second corresponds to an account usage frequency range; and
configuring a decision engine to produce an output indicating a likelihood of anomalous activity associated with the user account using the first pattern index and the second pattern index.

2. The system of claim 1 , the operations further comprising:
calculating a first statistical value based on the first portion of the plurality of pattern strength values that corresponds to the first account usage frequency range, wherein the first pattern index is determined further based on the first statistical value; and
calculating a second statistical value based on the second portion of the plurality of pattern strength values that corresponds to the second account usage frequency range, wherein the second pattern index is determined further based on the second statistical value.

3. The system of claim 2 , wherein the first statistical value is one of a maximum pattern strength value, a minimum pattern strength value, a mean value, or a standard deviation value calculated based on the first portion of the plurality of pattern strength values.

4. The system of claim 1 , the operations further comprising:
in response to receiving the output from the decision engine, modifying the user account based on the output.

5. The system of claim 4 , wherein the modifying the user account based on the output includes adjusting a security level associated with the user account.

6. The system of claim 4 , wherein the modifying the user account based on the output includes implementing an additional authentication requirement for accessing the user account.

7. The system of claim 1 , wherein the operations further comprise:
receiving a transaction request; and
processing the transaction request based on the output of the decision engine.

8. A method comprising:
generating, by a computer system, first account data corresponding to a user account, wherein the first account data is a comprises time series data that corresponds to a first account attribute;
deriving, by the computer system, second account data from the first account data, wherein the second account data corresponds to a plurality of account usage frequencies;
determining, by the computer system, a plurality of pattern strength values corresponding to the plurality of account usage frequencies based on the second account data, wherein each pattern strength value in the plurality of pattern strength values indicates a corresponding strength of a pattern existing in the first account data according to a corresponding account usage frequency in the plurality of account usage frequencies;
determining, by the computer system, (i) a first pattern index based on a first portion of the plurality of pattern strength values that corresponds to a first account usage frequency range and (ii) a second pattern index based on a second portion of the plurality of pattern strength values that corresponds to a second account usage frequency range; and
configuring, by the computer system, a decision engine to output a likelihood of anomalous activity associated with the user account using the first pattern index and the second pattern index.

9. The method of claim 8 , further comprising:
calculating a first statistical value based on the first portion of the plurality of pattern strength values that corresponds to the first account usage frequency range, wherein the first pattern index is determined further based on the first statistical value; and
calculating a second statistical value based on the second portion of the plurality of pattern strength values that corresponds to the second account usage frequency range, wherein the second pattern index is determined further based on the second statistical value.

10. The method of claim 9 , wherein the first pattern index comprises a statistical value derived from a first set of pattern strength values that corresponds to a first set of account usage frequencies within the first account usage frequency range.

11. The method of claim 8 , further comprising:
in response to receiving an output from the decision engine, modifying the user account based on the output.

12. The method of claim 11 , wherein the modifying the user account based on the output includes adjusting a security level associated with the user account.

13. The method of claim 11 , wherein the modifying the user account based on the output includes implementing an additional authentication requirement for accessing the user account.

14. The method of claim 8 , further comprising:
receiving a transaction request; and
processing the transaction request based on an output of the decision engine.

15. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
generating first account data corresponding to a user account, wherein the first account data comprises time series data that corresponds to a first account attribute;
deriving second account data from the first account data, wherein the second account data corresponds to a plurality of account usage frequencies;
determining a plurality of pattern strength values corresponding to the plurality of account usage frequencies based on the second account data, wherein each pattern strength value in the plurality of pattern strength values indicates a corresponding strength of a pattern existing in the first account data according to a corresponding account usage frequency in the plurality of account usage frequencies;
determining (i) a first pattern index based on a first potion of the plurality of pattern strength values that corresponds to a first account usage frequency range and (ii) a second pattern index based on a second portion of the plurality of pattern strength values that corresponds to a second account usage frequency range; and
configuring a decision engine to generate an output indicating a likelihood of anomalous activity associated with the user account using the first pattern index and the second pattern index.

16. The non-transitory machine-readable medium of claim 15 , the operations further comprising:
calculating a first statistical value based on the first por

Assignees

• Paypal Inc

Inventors

• Xie Zhen
• Vakilinia Kasra
• Chen Yang
• Oppenheim Hagar
• Ji Xing

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F16/2228

  Indexing structures · CPC title

• G06F16/258

  Data format conversion from or to a database · CPC title

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title

• H04W12/63

  Location-dependent; Proximity-dependent · CPC title