Systems and methods for triangular timestamp transformation in computer messaging

Patent metadata

Field	Value
Publication number	US-12445473-B2
Application number	US-202318163110-A
Country	US
Kind code	B2
Filing date	Feb 1, 2023
Priority date	Feb 1, 2023
Publication date	Oct 14, 2025
Grant date	Oct 14, 2025

Abstract

A message traffic analysis system is provided. The message traffic analysis system includes a memory device and at least one processor. The at least one processor is programmed to receive a plurality of historical messages between a plurality of sources and a destination server, for each of the plurality of historical messages, time shift the corresponding timestamp by an amount, transform the plurality of time shifted timestamps based on a portion of an entire time period completed, generate a model of message traffic based on the plurality of historical messages with the transformed and time shifted timestamps, receive one or more real-time messages between a first source and the destination server, execute the model of message traffic using the one or more real-time messages as inputs, and determine whether or not to allow the one or more real-time messages based on the execution of the model.

First claim

What is claimed is:

1. A message traffic analysis system comprising a message timestamp transformation analysis (MTTA) server communicatively coupled to a destination server, the MTTA server comprising:
a memory device; and
at least one processor coupled to the memory device, the at least one processor programmed to:
receive, from the destination server, a plurality of historical messages that have been routed through a message routing server between a plurality of sources and the destination server, wherein each message of the plurality of historical messages includes a timestamp;
for each of the plurality of historical messages, time shift the corresponding timestamp by:
calculating an initial timestamp value as a number of time units that have passed from a beginning of a time scale;
calculating a total number of time units in the time scale;
calculating a time shift value based on a base point that is different from the beginning of the time scale; and
calculating the time shifted timestamp as a difference between the initial timestamp value and the time shift value, divided by the total number of time units in the time scale;

transform the plurality of time shifted timestamps based on a portion of an entire time period completed;
generate a model of message traffic based on the plurality of historical messages with the transformed and time shifted timestamps;
receive one or more real-time messages between a first source and the destination server;
execute the model of message traffic using the one or more real-time messages as inputs; and
determine whether or not to prevent the one or more real-time messages from reaching the destination server based on the execution of the model.

2. The message traffic analysis system of claim 1 , wherein the at least one processor is further programmed to:
retrieve one or more timestamps associated with the one or more real-time messages;
time shift and transform the one or more timestamps;
adjust the one or more real-time messages with the time shifted and transformed one or more timestamps; and
execute the model of message traffic using the one or more adjusted real-time messages at inputs.

3. The message traffic analysis system of claim 1 , wherein the time shifted timestamp for each of the plurality of historical messages is a first shifted timestamp.

4. The message traffic analysis system of claim 3 , wherein the at least one processor is further programmed to create a second shifted timestamp for each of the plurality of historical messages.

5. The message traffic analysis system of claim 4 , wherein the at least one processor is further programmed to create a third shifted timestamp for each of the plurality of historical messages.

6. The message traffic analysis system of claim 5 , the at least one processor is further programmed to generate the model using one or more of the first shifted timestamp, the second shifted timestamp, and the third shifted timestamp.

7. The message traffic analysis system of claim 1 , wherein to transform the plurality of time shifted timestamps, the at least one processor is further programmed to transform each time shifted timestamp into a corresponding angle by multiplying the time shifted timestamp by 2π.

8. The message traffic analysis system of claim 7 , wherein to transform the plurality of time shifted timestamps, the at least one processor is further programmed to apply a function of cosine or sine to the angle corresponding to each time shifted time stamp.

9. The message traffic analysis system of claim 8 , wherein the at least one processor is further programmed to apply a power to results of the function.

10. The message traffic analysis system of claim 7 , wherein to transform the plurality of time shifted timestamps, the at least one processor is further programmed to apply a hyperbolic tangent function to the angle corresponding to each time shifted time stamp.

11. The message traffic analysis system of claim 1 , wherein the plurality of historical messages are a first plurality of message traffic, and wherein the at least one processor is further programmed to:
receive a second plurality of message traffic, including a second plurality of timestamps;
for each message of the second plurality of message traffic, time shift the corresponding timestamp;
transform the second plurality of time shifted timestamps based on a portion of an entire time period completed; and
update the model of message traffic based on the second plurality of message traffic with the transformed and time shifted timestamps.

12. The message traffic analysis system of claim 1 , wherein the entire time period is one of a day, a week, a month, or a year.

13. The message traffic analysis system of claim 1 , wherein the at least one processor is further programmed to transmit one or more alerts based on the execution of the model.

14. The message traffic analysis system of claim 1 , wherein the at least one processor is further programmed to discard the one or more real-time messages based on the execution of the model.

15. A computer-implemented method for message traffic analysis, the method implemented on a message timestamp transformation analysis (MTTA) server communicatively coupled to a destination server and comprising a memory device coupled to at least one processor, the method comprising:
receiving, from the destination server, a plurality of historical messages that have been routed through a message routing server between a plurality of sources and the destination server, wherein each message of the plurality of historical messages includes a timestamp;
for each of the plurality of historical messages, time shifting the corresponding timestamp by:
calculating an initial timestamp value as a number of time units that have passed from a beginning of a time scale;
calculating a total number of time units in the time scale;
calculating a time shift value based on a base point that is different from the beginning of the time scale; and
calculating the time shifted timestamp as a difference between the initial timestamp value and the time shift value, divided by the total number of time units in the time scale;

transforming the plurality of time shifted timestamps based on a portion of an entire time period completed;
generating a model of message traffic based on the plurality of historical messages with the transformed and time shifted timestamps;
receiving one or more real-time messages between a first source and the destination server;
executing the model of message traffic using the one or more real-time messages as inputs; and
determining whether or not to prevent the one or more real-time messages from reaching the destination server based on the execution of the model.

16. The method of claim 15 further comprising:
retrieving one or more timestamps associated with the one or more real-time messages;
time shifting and transform the one or more timestamps
adjusting the one or more real-time messages with the time shifted and transformed one or more timestamps; and
executing the model of message traffic using the one or more adjusted real-time messages at inputs.

17. The method of claim 15 , wherein the time shifted timestamp for each of the plurality of historical message is a first shifted timestamp, and wherein the method further comprises:
creating a second shifted timestamp for each of the plurality of historical messages;
creating a third shifted timestamp for each of the plurality of historical messages; and
generate the model using one or more

Assignees

• Mastercard International Inc
• Mastercard Int Incorporated Purchase

Inventors

• Afzal Sayed Amin

Classifications

• G06F16/258

  Data format conversion from or to a database · CPC title

• G06F18/10

  Pre-processing; Data cleansing · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title