Controlling ATM surface attacks leveraging decentralized swarm intelligence using ATMS

Patent metadata

Field	Value
Publication number	US-12373839-B2
Application number	US-202318115858-A
Country	US
Kind code	B2
Filing date	Mar 1, 2023
Priority date	Mar 1, 2023
Publication date	Jul 29, 2025
Grant date	Jul 29, 2025

Abstract

A decentralized swarm intelligence algorithm over a network of paired ATMs to prevent or control surface attacks on ATMs. The ATMs may be seeded with an initial swarm intelligence model to identify suspicious activity. An ATM may relay alerts about suspicious activity at that ATM to other paired ATMs. The ATMs use machine learning to update the model and perform swarm intelligence autonomously at the paired ATMs. A bank may provide the initial swarm intelligence model, receive alerts about and analyze the attacks, and provide updated swarm intelligence models to prevent or limit future attacks. Smart contracts may be used to specify rules for performing swarm intelligence using the paired ATMs. Records regarding swarm intelligence models, attempted suspicious attacks including payment instruments that may have been used, actions taken in response to the attacks, and smart contracts may be recorded on a blockchain distributed ledger.

First claim

What is claimed is:

1. A method for controlling access to an automated teller machine (ATM) upon detection of a suspicious payment instrument, the method comprising:
pairing a first ATM with a plurality of other ATMs to form a network of paired ATMs that perform banking transactions and serve as distributed nodes for performing a swarm intelligence algorithm, wherein the paired ATMs are accessible using one or more payment instruments that are external to the ATMs;
receiving, at the first ATM, an initial swarm intelligence model for performing the swarm intelligence algorithm on the network of paired ATMs;
detecting, by the first ATM, one of the one or more payment instruments used by a user to access the first ATM and capturing information about the payment instrument;
determining, by the first ATM, whether the detected payment instrument of the user is suspicious based on the initial swarm intelligence model and the captured information;
allowing, by the first ATM, interaction with the payment instrument when the payment instrument is not determined to be suspicious; and
when the detected payment instrument of the user is determined to be suspicious:
executing, by the first ATM, an action to control access to the first ATM by the payment instrument that is determined to be suspicious;
relaying, by the first ATM, an alert to the plurality of other ATMs about the suspicious payment instrument; and
updating, at the first ATM, the initial swarm intelligence model to an updated swarm intelligence model that accounts for the determination that the payment instrument is suspicious.

2. The method of claim 1 , further comprising:
receiving, at the plurality of other ATMs, copies of the initial swarm intelligence model, and
updating the initial swarm intelligence model at one or more of the plurality of other ATMs in the network of paired ATMs upon receiving the alert from the first ATM.

3. The method of claim 1 , further comprising:
transmitting the captured information about the payment instrument about the detection of the suspicious payment instrument to a fraud incident database in communication with the paired ATMs to update the fraud incident database.

4. The method of claim 1 , further comprising:
analyzing, using a neural network, the detected suspicious payment instrument to ascertain any vulnerability of the first ATM to the suspicious payment instrument.

5. The method of claim 1 , wherein the paired ATMs are configured to wirelessly communicate with one another over one or more wireless communications networks, and the relaying of the alert to the plurality of other ATMs is performed over the one or more wireless communications networks.

6. The method of claim 1 , wherein the relaying of the alert to the plurality of other ATMs is performed by the first ATM using ant colony optimization (ACO).

7. The method of claim 1 , wherein the paired ATMs to which the alert is relayed are located within a geofenced area.

8. The method of claim 1 , wherein each of the paired ATMs is a blockchain node, the method further comprising:
updating a distributed ledger upon detection of a suspicious payment instrument received at the first ATM.

9. The method of claim 7 , wherein the distributed ledger includes one or more smart contracts that includes rules for one or more of:
pairing ATMs, performing swarm intelligence using the paired ATMs, updating the swarm intelligence model at each of the paired ATM, transmitting updates of the swarm intelligence model to a fraud incident database, relaying alerts to the paired ATMs, or interacting with a bank.

10. The method of claim 1 , wherein the execution of an action to control access to the first ATM comprises one or more of:
preventing or limiting access to the first ATM, preventing or limiting a requested banking transaction, or requiring an additional step to be performed before executing the requested banking transaction.

11. The method of claim 1 , wherein the execution of an action to control access to the first ATM comprises one or more of:
blocking a user of the suspicious payment instrument, blocking all users of a same type of payment instrument as the suspicious payment instrument, requiring an increased authentication or verification of the suspicious payment instrument before use, limiting an amount or type of a transaction that may be performed by the suspicious payment instrument at the ATM, or placing the user of the suspicious payment instrument on a blacklist.

12. The method of claim 1 , further comprising quarantining the first ATM upon detection of the suspicious payment instrument.

13. The method of claim 1 , further comprising synchronizing, by the first ATM, the updated swarm intelligence model with a version of a swarm intelligence model for the paired ATMs that is maintained at a fraud incident database and is in communication with the paired ATMs.

14. The method of claim 1 , wherein each of the paired ATMs, including the first ATM and the plurality of other ATMs, comprises an edge in an edge network.

15. A system comprising:
a plurality of automated teller machines (ATMs) that perform banking transactions and collectively control attacks on the ATMs;
wherein the ATMs are paired to serve as distributed nodes for collectively performing a swarm intelligence algorithm for collecting and sharing information about suspicious payment instruments that have attempted to access the ATMs;
wherein each of the ATMs comprises:
an interface for a payment instrument to access a respective ATM for performing a banking transaction;
a memory for storing an initial swarm intelligence model for performing the swarm intelligence algorithm at the respective ATM; and
a processor configured to:
detect, by the respective ATM, a payment instrument used, by one of the users, to access the respective ATM and capture information about the payment instrument;
determine, by the respective ATM, whether the payment instrument is suspicious based on the initial swarm intelligence model;
allow, by the respective ATM, interaction with the payment instrument when the payment instrument is not determined to be suspicious; and
when the detected payment instrument is determined to be suspicious:
execute, by the respective ATM, an action to control access to the respective ATM by the payment instrument that is determined to be suspicious;
relay, by the respective ATM, an alert to the plurality of other ATMs about the suspicious payment instrument; and
update, at the respective ATM, the initial swarm intelligence model to account for a determination that the payment instrument is suspicious.

16. The system of claim 15 , wherein each of the ATMs further comprises a dynamic local cache for relaying alerts in real time to other ATMs in the plurality of ATMs.

17. The system of claim 16 , wherein the processor of each of the ATMs is further configured to relay the real-time alerts based on an ant colony optimization.

18. The system of claim 15 , wherein each of the ATMs comprises a wireless communications transceiver to communicate with one another wirelessly.

19. The system of claim 15 , wherein each of the ATMs operates as a blockchain node, and wherein the ATMs use a distributed ledger to capture a record of interactions between the ATMs.

20. The system of claim 15 , further comprising a fraud incident database in communication with the ATMs that is periodically synchronized with the swarm intelligence algorithm operating on the ATMs.

21. Th

Assignees

• Bank Of America

Inventors

• Singh Shailendra
• Sethia Maneesh Kumar

Classifications

• G06Q20/1085

  involving automatic teller machines [ATMs] · CPC title

• G06Q20/389

  Keeping log of transactions for guaranteeing non-repudiation of a transaction · CPC title

• G06N5/043

  Distributed expert systems; Blackboards · CPC title

• G06N3/006

  based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO] · CPC title

• G07F19/208

  Use of an ATM as a switch or hub · CPC title