Graph Computing for Electronic Communication Risk Detection

Patent metadata

Field	Value
Publication number	US-2024144277-A1
Application number	US-202218059699-A
Country	US
Kind code	A1
Filing date	Nov 29, 2022
Priority date	Nov 2, 2022
Publication date	May 2, 2024
Grant date	—

Abstract

Techniques are disclosed for detecting risk via a server system that receives, based on user activity at a device, an indication of a trigger event corresponding to a potential electronic communication. After receiving the trigger event indication and prior to receiving an indication of initiation of the electronic communication, the system executes a set of computations for the communication, including performing a multi-hop query to a graph database storing a graphical representation of a plurality of communications and storing results of the execution. In response to initiation of the electronic communication, the system retrieves, using information corresponding to entities involved in the electronic communication, one or more portions of the results of executing the set of computations the database. The system determines, based on the retrieved results, whether to approve the electronic communication. The disclosed techniques may advantageously decrease unsecure electronic communications relative to real-time risk detection techniques.

First claim

What is claimed is:

1 . A method, comprising:
receiving, by a server system based on user activity at a computing device, an indication of a trigger event corresponding to a potential electronic communication; after receiving the indication of the trigger event and prior to receiving an indication of initiation of the potential electronic communication, executing, by the server system, a set of computations for the potential electronic communication, wherein execution of at least one of the set of computations includes accessing multiple graph nodes of a graph database storing a graphical representation of a plurality of electronic communications; storing, by the server system in a database, results of the execution of the set of computations; in response to determining that the electronic communication has initiated, retrieving, by the server system using information corresponding to one or more entities involved in the electronic communication, one or more portions of the results of executing the set of computations stored in the database; and determining, by the server system based on the retrieved results, whether to approve the electronic communication.

2 . The method of claim 1 , further comprising:
updating, by the server system using results of the set of computations, the graphical representation stored in the graph database.

3 . The method of claim 1 , wherein accessing the multiple graph nodes includes performing the multi-hop query to retrieve variables from electronic communications occurring at least three graph nodes from a graph node of the potential electronic communication within the graphical representation.

4 . The method of claim 1 , wherein the server system executes a graph compute service to perform the execution of the set of computations, and wherein executing the set of computations includes calling, by the graph compute service, at least one other service.

5 . The method of claim 1 , wherein the database is a variable database storing results of a plurality of sets of computations as a key-value pairs, wherein the keys of rows include an identifier of a sender entity and an identifier of a receiver entity involved in respective electronic communications corresponding to the rows, and wherein respective key-value pairs include multiple variable columns storing results of respective computations included in a given set of computations corresponding to a given electronic communication, wherein respective variable columns store a plurality of different variables.

6 . The method of claim 1 , further comprising:
in response to receiving the indication of the trigger event, determining, by the server system based on the trigger event, one or more types of computations to include in the set of computations, wherein the determining includes calculating, based on prior activity of a user associated with the trigger event, a likelihood score indicating the likelihood that the user will initiate the potential electronic communication.

7 . The method of claim 1 , wherein the set of computations includes at least one of parallel computations and sequential computations.

8 . The method of claim 1 , wherein the event is a browser object model (BOM) event, and wherein the BOM event indicates one or more user activities within a user interface displayed to the user via their computing device.

9 . The method of claim 1 , wherein performing the multi-hop query to the graph database includes querying the graph database to retrieve one or more of the following types data for the potential electronic communication: account activity of an entity involved in one or more electronic communications, communication amount, communication type, and risk decision history for one or more entities involved in the potential electronic communication.

10 . A non-transitory computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:
receiving an indication of a trigger event corresponding to a potential electronic communication; after receiving the indication of the trigger event and prior to receiving an indication of initiation of the potential electronic communication, executing a set of computations for the potential electronic communication, wherein execution of at least one of the set of computations includes accessing multiple graph nodes of a graph database storing a graphical representation of a plurality of electronic communications; storing, in a variable database, results of the execution of the set of computations; in response to determining that the electronic communication has initiated, retrieving, using information corresponding to one or more entities involved in the electronic communication, one or more columns storing results of executing the set of computations stored in the database; and determining, based on the retrieved results, whether to approve the electronic communication.

11 . The non-transitory computer-readable medium of claim 10 , wherein accessing the multiple graph nodes includes performing the multi-hop query to retrieve variables from electronic communications occurring at least three graph nodes from a graph node of the potential electronic communication within the graphical representation.

12 . The non-transitory computer-readable medium of claim 10 , wherein the set of asynchronous computations includes at least one of parallel computations and sequential computations, wherein the event is a browser object model (BOM) event, and wherein the BOM event indicates one or more user activities within a user interface displayed to the user via their computing device.

13 . The non-transitory computer-readable medium of claim 10 , wherein the variable database stores results of a plurality of sets of computations as a key-value pairs, wherein the keys of rows include an identifier of a sender entity and an identifier of a receiver entity involved in respective electronic communications corresponding to the rows, and wherein respective key-value pairs include multiple variable columns storing results of respective computations included in a given set of computations corresponding to a given electronic communication, wherein respective variable columns store a plurality of different variables.

14 . The non-transitory computer-readable medium of claim 10 , wherein the operations further comprise, prior to receiving the indication of a trigger event:
displaying, to via a user interface of a computing device of an entity associated with the potential electronic communication, a plurality of compute nodes; and generating, based on user selection of one or more of the plurality of compute nodes, the set of computations, wherein the generating includes determining, based on input from the entity at the user interface, an order and of execution for the compute nodes included in the set of computations; and storing the generated set of computations for later presentation to entities associated with potential electronic communications.

15 . The non-transitory computer-readable medium of claim 10 , wherein the set of computations is a directed acyclic graph (DAG), and wherein the plurality of electronic communications are online electronic transactions.

16 . A system, comprising:
at least one processor; and a memory having instructions stored thereon that are executable by the at least one processor to cause the system to:
receive, based on user activity at a computing device, an indication of a trigger event corresponding to a potential electronic communication;
after rece

Assignees

• Paypal Inc

Inventors

• Lian Lance
• Zhang Haoran
• Fang Jiaxin
• Guo Junshi
• Zhang Pengshan
• Zhang Xia
• Zhang Yu

Classifications

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• G06F16/9024 Primary

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06F16/90335

  Query processing · CPC title

• G06N20/00

  Machine learning · CPC title