Detection of anomalies associated with fraudulent access to a service platform

Patent metadata

Field	Value
Publication number	US-12563061-B2
Application number	US-202218059028-A
Country	US
Kind code	B2
Filing date	Nov 28, 2022
Priority date	Dec 29, 2020
Publication date	Feb 24, 2026
Grant date	Feb 24, 2026

Abstract

In some implementations, a system may obtain a first model that is trained to identify feature data associated with a client system using one or more services of a service platform. The system may train, based on the feature data, a second model to identify anomalies associated with devices accessing the one or more services in association with a client identifier of the client system. The system may receive access data associated with an acting device accessing a service of the service platform. The system may determine, using the second model, that the acting device accessing the service corresponds to potential anomalous activity based on the access information. The system may obtain, from a verification device, a verification that the acting device accessing the service is anomalous activity. The system may perform, based on obtaining the verification, an action associated with the acting device.

First claim

What is claimed is:

1 . A method, comprising:
receiving, by a device, access data associated with an acting device accessing a service of a service platform, wherein the access data includes a client identifier of a client system and access information associated with the acting device accessing the service; determining, by the device and based on the access information and using a supervised machine learning model, a probability that the acting device accessing the service corresponds to anomalous activity based at least in part on: a comparison of client location information identified in source data, that identifies respective client addresses or respective client locations of one or more devices of the client system associated with usage of one or more services of the service platform, and device location information, of the access information, that identifies a location of the acting device, a comparison of corresponding identifiers of the one or more services in a service usage pattern and a service identifier of the service identified in the access information, and a comparison of timing of accessing the one or more services of the service platform and timing of the device accessing the service identified in the access information, wherein the supervised machine learning model is trained based on a service usage pattern associated with the one or more devices of the client system accessing the one or more services of the service platform, wherein the service usage pattern is determined using a first cosine similarity analysis of timestamps associated with the one or more devices accessing the one or more services during a time period associated with training the supervised machine learning model; determining, by the device, that the probability satisfies a threshold probability indicating that the acting device accessing the service is likely an anomalous activity; requesting, by the device and via a user device and based on the probability satisfying the threshold probability, feedback that indicates whether the acting device accessing the service is anomalous activity; receiving, by the device, the feedback from the user device; and retraining, by the device, the supervised machine learning model based on the feedback and the access data.

2 . The method of claim 1 , wherein the service usage pattern is further determined using a second cosine similarity analysis of frequencies of accessing individual services of the one or more services during the time period.

3 . The method of claim 1 , wherein the access data comprises an application programming interface (API) call to an API associated with the service and the service platform comprises an API gateway of the one or more services.

4 . The method of claim 1 , wherein the supervised machine learning model is configured to determine the probability based on a decision tree that is configured to:
determine, from the access information, whether timing of the device accessing the service is outside of a usage threshold of the service usage pattern; determine, based on whether timing of the device accessing the service is outside of the usage threshold of the service usage pattern, whether a source address of the acting device in the access information matches a client address of the respective client addresses; and determine, whether the source address of the acting device matches the client address of the one or more devices, whether a source location of the acting device is within a distance threshold of a client location of the respective client locations.

5 . The method of claim 1 , further comprising at least one of:
preventing the acting device from further accessing the service platform; transmitting, to a management device, a notification that indicates that the acting device accessing the service is anomalous activity; or storing, in a data structure, the access data in association with an indication that the acting device accessing the service is anomalous activity.

6 . The method of claim 1 , wherein the feedback comprises a verification of a particular type of anomalous activity associated with the acting device accessing the service.

7 . The method of claim 1 , wherein determining the probability that the acting device accessing the service corresponds to anomalous activity comprises:
determining the probability that the acting device accessing the service corresponds to anomalous activity is further based at least in part on a comparison of timing of accessing the one or more services of the service platform and timing of the device accessing the service identified in the access information.

8 . A device, comprising:
one or more memories; and one or more processors, coupled to the one or more memories, configured to: receive access data associated with an acting device accessing a service of a service platform, wherein the access data includes a client identifier of a client system and access information associated with the acting device accessing the service; determine, based on the access information and using a supervised machine learning model, a probability that the acting device accessing the service corresponds to anomalous activity based at least in part on: a comparison of client location information identified in source data, that identifies respective client addresses or respective client locations of one or more devices of the client system associated with usage of one or more services of the service platform, and device location information, of the access information, that identifies a location of the acting device, a comparison of corresponding identifiers of the one or more services in a service usage pattern and a service identifier of the service identified in the access information, and a comparison of timing of accessing the one or more services of the service platform and timing of the device accessing the service identified in the access information, wherein the supervised machine learning model is trained based on a service usage pattern associated with the one or more devices of the client system accessing the one or more services of the service platform, wherein the service usage pattern is determined using a first cosine similarity analysis of timestamps associated with the one or more devices accessing the one or more services during a time period associated with training the supervised machine learning model; determine that the probability satisfies a threshold probability indicating that the acting device accessing the service is likely an anomalous activity; request, via a user device and based on the probability satisfying the threshold probability, feedback that indicates whether the acting device accessing the service is anomalous activity; receive the feedback from the user device; and retrain the supervised machine learning model based on the feedback and the access data.

9 . The device of claim 8 , wherein the service usage pattern is further determined using a second cosine similarity analysis of frequencies of accessing individual services of the one or more services during the time period.

10 . The device of claim 8 , wherein the access data comprises an application programming interface (API) call to an API associated with the service and the service platform comprises an API gateway of the one or more services.

11 . The device of claim 8 , wherein the supervised machine learning model is configured to determine the probability based on a decision tree that is configured to:
determine, from the access information, whether timing of the device accessing the service is outside of a usage threshold of the service usage pattern; det

Assignees

• Capital One Services Llc

Inventors

• Tan Bozhao
• Tiwari Vikash
• Dzegilenko Fedor
• Gupta Ashish
• Michel Jeffrey
• Weimer Jonathan
• Panda Meenakshi
• Hulawale Vinayak
• Joshi Rohit

Classifications

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• H04L67/133

  Protocols for remote procedure calls [RPC] · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• G06F21/554

  involving event detection and direct action · CPC title