Graph computing for electronic communication risk detection

Patent metadata

Field	Value
Publication number	US-12423704-B2
Application number	US-202218059699-A
Country	US
Kind code	B2
Filing date	Nov 29, 2022
Priority date	Nov 2, 2022
Publication date	Sep 23, 2025
Grant date	Sep 23, 2025

Abstract

Techniques are disclosed for detecting risk via a server system that receives, based on user activity at a device, an indication of a trigger event corresponding to a potential electronic communication. After receiving the trigger event indication and prior to receiving an indication of initiation of the electronic communication, the system executes a set of computations for the communication, including performing a multi-hop query to a graph database storing a graphical representation of a plurality of communications and storing results of the execution. In response to initiation of the electronic communication, the system retrieves, using information corresponding to entities involved in the electronic communication, one or more portions of the results of executing the set of computations the database. The system determines, based on the retrieved results, whether to approve the electronic communication. The disclosed techniques may advantageously decrease unsecure electronic communications relative to real-time risk detection techniques.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a processor of a server system from a computing device of a user, an indication of a trigger event corresponding to an electronic transaction, wherein the trigger event is a browser object model (BOM) event, wherein the BOM event indicates one or more user actions tracked via a browser of the computing device of the user, and wherein the BOM event triggers an asynchronous computation process;
after receiving the indication of the trigger event and prior to initiation of the electronic transaction, executing, by the processor of the server system, a set of asynchronous computations for the electronic transaction including executing a high volume multi-hop graph database query, wherein executing the high volume multi-hop graph database query includes accessing multiple nodes of a graphical representation of a plurality of prior electronic transactions stored by a graph database;
modifying, by the processor of the server system using results of executing the set of asynchronous computations, the graphical representation stored in the graph database, wherein the modifying includes storing the results of executing the set of asynchronous computations in an edge of the graphical representation in the graph database;
storing, by the processor of the server system in a variable database, the results of executing the set of asynchronous computations;
in response to determining that the electronic transaction has initiated, retrieving, by the processor of the server system using information corresponding to one or more entities involved in the electronic transaction, one or more portions of the results of executing the set of asynchronous computations stored in the variable database;
generating, by the processor of the server system based on one or more portions of the results of executing the set of asynchronous computations retrieved from the variable database, an authorization decision for the electronic transaction; and
transmitting, by the processor of the server system to the computing device of the user, the authorization decision for the electronic transaction.

2. The method of claim 1 , wherein prior to the executing and after receiving the indication of the trigger event, the method further comprising:
determining, by the server system based on the indication, the set of asynchronous computations for the electronic transaction, wherein the set of asynchronous computations includes a batch of graph database queries; and
generating, by the server system based on determining that two or more queries in the batch of graph database queries overlap, a single high-volume, multi-hop graph database query to replace the two or more queries in the batch.

3. The method of claim 1 , wherein accessing the multiple graph nodes includes retrieving variables from electronic transactions occurring at least three graph nodes from a graph node of the electronic transaction within the graphical representation.

4. The method of claim 1 , wherein the server system executes a graph compute service to execute the set of asynchronous computations, and wherein executing the set of asynchronous computations includes calling, by the graph compute service, at least one other service.

5. The method of claim 1 , wherein the variable database stores results of a plurality of sets of computations as key-value pairs, wherein keys of rows in the variable database include an identifier of a sender entity and an identifier of a receiver entity involved in respective electronic transactions corresponding to the rows in the variable database, and wherein respective key-value pairs include multiple variable columns storing results of respective computations included in a given set of asynchronous computations corresponding to a given electronic transaction, wherein respective variable columns store a plurality of different variables.

6. The method of claim 1 , further comprising:
in response to receiving the indication of the trigger event, determining, by the server system based on the trigger event, one or more types of computations to include in the set of asynchronous computations, wherein the determining includes calculating, based on prior activity of the user, a likelihood score indicating a likelihood that the user will initiate the electronic transaction.

7. The method of claim 1 , wherein the set of asynchronous computations includes one or more parallel computations.

8. The method of claim 1 , wherein the set of asynchronous computations includes one or more sequential computations.

9. The method of claim 1 , wherein executing the multi-hop graph database query includes querying the graph database to retrieve one or more of the following types of data for the electronic transaction: account activity of an entity involved in one or more electronic transactions, transaction amount, transaction type, and risk decision history for one or more entities involved in the electronic transaction.

10. A non-transitory computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:
receiving an indication of a trigger event corresponding to an electronic transaction, wherein the trigger event is a browser object model (BOM) event, wherein the BOM event indicates one or more user actions tracked via an application of a user computing device, and wherein the BOM event triggers an asynchronous computation process;
after receiving the indication of the trigger event and prior to initiation of the electronic transaction, executing a set of asynchronous computations for the electronic transaction including executing a multi-hop graph database query, wherein executing the multi-hop graph database query includes accessing multiple nodes of a graphical representation of a plurality of prior electronic transactions stored by a graph database;
modifying, using results of executing the set of asynchronous computations, the graphical representation stored in the graph database, wherein the modifying includes storing the results of executing the set of asynchronous computations in an edge of the graphical representation in the graph database;
storing, in a variable database, the results of executing the set of asynchronous computations;
in response to determining that the electronic transaction has initiated, retrieving, using information corresponding to one or more entities involved in the electronic transaction, one or more portions of the results of executing the set of asynchronous computations stored in the variable database;
generating, based on one or more portions of the results of executing the set of asynchronous computations retrieved from the variable database, an authorization decision for the electronic transaction; and
transmitting, to the user computing device, the authorization decision for the electronic transaction.

11. The non-transitory computer-readable medium of claim 10 , wherein accessing the multiple graph nodes includes retrieving variables from electronic transactions occurring at least three graph nodes from a graph node of the electronic transaction within the graphical representation.

12. The non-transitory computer-readable medium of claim 10 , wherein the set of asynchronous computations includes at least one of parallel computations and sequential computations.

13. The non-transitory computer-readable medium of claim 10 , wherein the variable database stores results of a plurality of sets of computations as key-value pairs, wherein keys of rows in the variable database include an identifier of a sender entity and an identifier of a receiver en

Assignees

• Paypal Inc

Inventors

• Lian Lance
• Zhang Haoran
• Fang Jiaxin
• Guo Junshi
• Zhang Pengshan
• Zhang Xia
• Zhang Yu

Classifications

• G06F16/9024 Primary

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06F16/90335

  Query processing · CPC title

• G06N20/00

  Machine learning · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title