Systems and methods for preventing unauthorized resource access

Patent metadata

Field	Value
Publication number	US-2025088529-A1
Application number	US-202318466276-A
Country	US
Kind code	A1
Filing date	Sep 13, 2023
Priority date	Sep 13, 2023
Publication date	Mar 13, 2025
Grant date	—

Abstract

Methods and systems for preventing unauthorized resource access. In some aspects, the system obtains, in real time, a first data stream between a user requesting access to resources in a user account and an agent. The system processes, using a first machine learning model, the first data stream to generate a confidence score. If the confidence score exceeds a threshold, the system generates a sandbox context configured to simulate output indicative of successful resource access. The system obtains a second data stream for the sandbox context and processes it using a second machine learning model to determine whether the communication between the agent and the user was malicious. If the communication was not malicious, the system removes the user account from the sandbox context and effects grant of resource access. Otherwise, the system reports the agent and the user account for further processing for attempts to obtain unauthorized user access.

First claim

What is claimed is:

1 . A system for preventing unauthorized resource access by simulating communications from a service to client devices associated with user accounts assigned a sandbox context, the system comprising:
one or more processors; and one or more non-transitory, computer-readable media comprising instructions that, when executed by the one or more processors, cause operations comprising:
obtaining, in real time, a first data stream for a first communication between a user associated with a user account and an agent of a service;
processing, using a first machine learning model, the first data stream to generate a confidence score regarding whether to assign a sandbox context to the user account, the first machine learning model trained to detect in real time from the first data stream a malicious intent of the user to obtain unauthorized resource access from the service;
in response to the confidence score exceeding a confidence threshold, generating a sandbox context for the user account, the sandbox context configured to receive input from the agent or the user related to resource access and simulate output indicative of resource access being successful, wherein the simulated output includes user-facing communication but does not effect grant of resource access by the service;
in response to obtaining a second data stream for a second communication for the sandbox context, processing, using a second machine learning model, the second data stream to determine whether the second communication between the agent and the user was malicious due to the user obtaining unauthorized resource access from the service;
in response to determining that the second communication was not malicious, removing the user account from the sandbox context and effecting grant of resource access by the service; and
in response to determining that the second communication was malicious, reporting the agent and the user account for further processing with respect to attempts for unauthorized user access.

2 . A method for preventing unauthorized resource access by simulating communications to client devices associated with user accounts assigned a sandbox context, the method comprising:
obtaining, in real time, a first data stream for a first communication between a user requesting access to resources in a user account and an agent; processing, using a first machine learning model, the first data stream to generate a confidence score; in response to the confidence score exceeding a confidence threshold, generating a sandbox context for the user account, the sandbox context configured to simulate output indicative of resource access being successful; in response to obtaining a second data stream for a second communication for the sandbox context, processing, using a second machine learning model, the second data stream to determine whether the second communication between the agent and the user was malicious; in response to determining that the second communication was not malicious, removing the user account from the sandbox context and effecting grant of resource access; and in response to determining that the second communication was malicious, reporting the agent and the user account for further processing with respect to attempts for unauthorized user access.

3 . The method of claim 2 , wherein the first machine learning model takes as input at least a portion of the first data stream for the first communication and a context vector comprising a location of the user, a current time, the user account, or the access to resources being requested.

4 . The method of claim 2 , wherein the sandbox context is configured to simulate output comprising a receipt indicating that resource access was successful, and wherein the sandbox context does not transfer any resources in association with the user account.

5 . The method of claim 4 , wherein in response to determining that the second communication was not malicious, effecting grant of resource access comprises:
requesting confirmation of the request for grant of resource access from the user; and transmitting, to a resource access system, a request for grant of resource access.

6 . The method of claim 2 , wherein the sandbox context is configured to simulate output comprising a decoy passcode which grants the user access to the user account and which disables transferring any resources in association with the user account.

7 . The method of claim 6 , wherein in response to determining that the second communication was not malicious, effecting grant of resource access comprises:
adding the decoy passcode to a list of known authentication methods associated with the user account and enabling transferring resources in association with the user account.

8 . The method of claim 2 , wherein the sandbox context is configured to simulate output comprising a notice indicating that resource access will be granted at a specified future time.

9 . The method of claim 8 , wherein in response to determining that the second communication was not malicious, effecting grant of resource access comprises:
sending a request to a clearinghouse system to implement the grant of resource access at the specified future time.

10 . The method of claim 2 , wherein the user account is disconnected from the first communication during the sandbox context and replaced by a first voice model trained on the user's voice, wherein the first voice model continues the second communication during the sandbox context to determine whether the agent has malicious intent.

11 . The method of claim 2 , wherein the agent is disconnected from the first communication during the sandbox context and replaced by a second voice model trained on the agent's voice, wherein the second voice model continues the second communication during the sandbox context to determine whether the user has malicious intent.

12 . The method of claim 2 , wherein the second machine learning model takes as input the second data stream, a user context vector, and an agent context vector, wherein the user context vector comprises past activity in the user account and past requests for resource access associated with the user account, and wherein the agent context vector comprises past requests for resource access associated with the agent.

13 . One or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors, cause operations comprising:
obtaining, in real time, a first data stream for a first communication between a user requesting access to resources in a user account and an agent; processing, using a first machine learning model, the first data stream to generate a confidence score; in response to the confidence score exceeding a confidence threshold, generating a sandbox context for the user account, the sandbox context configured to simulate output indicative of resource access being successful; in response to obtaining a second data stream for a second communication for the sandbox context, processing, using a second machine learning model, the second data stream to determine whether the second communication between the agent and the user was malicious; and in response to determining that the second communication was not malicious, removing the user account from the sandbox context and effecting grant of resource access.

14 . The one or more non-transitory computer-readable media of claim 13 , wherein the first machine learning model takes as input at least a portion of the first data stream for the first communication and a context vector comprising a location of the user,

Assignees

• Capital One Services Llc

Inventors

• Douglas Lawrence
• Rule Jeffrey
• Macomber Jackson

Classifications

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title