Patent Issued for Systems and methods for generation of alerts based on fraudulent network activity (USPTO 11669844): United Services Automobile Association

2023 JUN 28 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- United Services Automobile Association (San Antonio, Texas, United States) has been issued patent number 11669844, according to news reporting originating out of Alexandria, Virginia, by NewsRx editors.

The patent’s inventors are Comeaux, Jansey (Youngsville, LA, US), Daughdrill, Stephen Bradley (San Antonio, TX, US), Sansone, Gregory (San Antonio, TX, US), Santiago, Veronica (San Antonio, TX, US).

This patent was filed on November 19, 2020 and was published online on June 6, 2023.

From the background information supplied by the inventors, news correspondents obtained the following quote: “Organizations strive to ensure secure and convenient user access to services or accounts. With the proliferation of identity theft, organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible. However, organizations in the relevant industries are faced with the daunting task of analyzing millions of transactions and documents to detect external and internal fraudulent activity.

“To combat fraud or other malicious behaviors, some organizations employ modern enterprise networks that utilize conventional fraud detection models to indicate potential malicious behavior, through a variety of channels. The development of these traditional fraud detection models typically requires a long period of time, and subsequent trainings upon model degradation may further leverage human capacity. This lengthy process of the development and training limits the amount of real-time insight that can be leveraged in the fraud detection model. Particularly for a security based purposes, such fraud detection model creates vast limitations as the threats are constantly adapting and such threats are not accounted for in these fraud detection models.”

Supplementing the background information on this patent, NewsRx reporters also obtained the inventors’ summary information for this patent: “Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough. Therefore, there is a need for an improvement to the fraud detection techniques to efficiently and timely capture potential threat or vulnerability information since a typical organization may otherwise be at risk of losing millions of dollars of its revenues to fraudulent activity.

“Disclosed herein are systems and methods capable of addressing the above-described shortcomings and may also provide any number of additional or alternative benefits and advantages. As described herein, embodiments of the present disclosure relate to systems, apparatuses, methods, and computer program products for integrated risk assessment and management by detecting probable fraudulent and malicious network activity, and subsequently generating alerts to prevent the execution of fraudulent and malicious network activity. Such systems, apparatuses, methods, and computer program products maximize fraud loss prevention by using models that learns from evolving fraud trends, increases speed of fraud detection by dynamically re-evaluating risk factors as new information becomes available, increases the available capacity of fraud detection systems by reducing false positives, and lastly provide scalable solution to serve growing membership with available fraud detection systems.

“Various devices of the present disclosure may provide security solutions by identifying fraudulent and malicious network activity, and then generating alerts to address the identified fraudulent and malicious events. For example, various devices hosting an enterprise website may be configured to report failed login attempts from a user, while firewalls may report blocked data traffic arriving from untrusted Internet Protocol (IP) addresses. The devices may then produce alerts containing potential threat or vulnerability information associated with their respective channels. These alerts may be assigned to a fraud analyst who is tasked with addressing the alerts. In a fraud detection context within a financial institution enterprise network, these alerts can often be associated with a user, where fraud analysts can sometimes identify an attack theme or scenario across the alerts, and provide their learning inputs based on these themes or scenarios to train the fraud detection models in order to reduce the detection of false events in the future.

“In an embodiment, a server-implemented method may include generating, by a server, an alert-generation model corresponding to each user using at least data from a behavior profile of each user where the behavior profile of the user comprises at least a record of events previously undertaken by the user in an account of the user. The server-implemented method may further include receiving, by a server, one or more fraud events from one or more fraud detection devices where each of the one or more fraud events comprises data fields associated a fraudulent activity. The server-implemented method may further include determining, by the server, a user identifier associated with a fraud event of the one or more fraud events based on the data associated with the fraudulent activity. The server-implemented method may further include determining, by the server, the alert-generation model applicable to the fraud event based on the user identifier associated with the fraud event. The server-implemented method may further include generating, by the server, an alert probability score corresponding to the fraud event, based on the execution of the alert-generation model applicable to the fraud event determined based on the user identifier associated with the fraud event, on the data fields associated with the fraudulent activity contained in the fraud event. The server-implemented method may further include generating, by the server, an alert associated with the fraud event upon determining that the alert probability score corresponding to the fraud event exceeds a pre-defined threshold score. The server-implemented method may further include, upon the server generating the alert for the fraudulent activity, the server-implemented method may further include generating, by the server, one or more instructions to cease execution of a request associated with the fraudulent activity; and updating, by the server, the behavior profile of the user with a record of fraud event in the account of the user, whereby the server trains the alert-generation model using the updated behavior profile.

“In another embodiment, a system may include a server configured to generate an alert-generation model corresponding to each user using at least data from a behavior profile of each user where the behavior profile of the user comprises at least a record of events previously undertaken by the user in an account of the user. The server may be further configured to receive one or more fraud events from one or more fraud detection devices where each of the one or more fraud events comprises data fields associated a fraudulent activity. The server may be further configured to determine a user identifier associated with a fraud event of the one or more fraud events based on the data associated with the fraudulent activity. The server may be further configured to determine the alert-generation model applicable to the fraud event based on the user identifier associated with the fraud event. The server may be further configured to generate an alert probability score corresponding to the fraud event, based on the execution of the alert-generation model applicable to the fraud event determined based on the user identifier associated with the fraud event, on the data fields associated with the fraudulent activity contained in the fraud event. The server may be further configured to generate an alert associated with the fraud event upon determining that the alert probability score corresponding to the fraud event exceeds a pre-defined threshold score. Upon the server generating the alert for the fraudulent activity: the server may be further configured to generate one or more instructions to cease the execution of a request of the fraudulent activity; and update the behavior profile of the user with a record of fraud event by the user in the account of the user, whereby the server trains the alert-generation model using the updated behavior profile.”

The claims supplied by the inventors are:

“1. A method comprising: receiving, by a computing system, one or more fraud events comprising one or more fraud indicators associated with a fraudulent activity from one or more fraud detection devices, wherein each of the one or more fraud detection devices executes one or more fraud detection algorithms to identify data associated with the one or more fraud indicators based on one or more fraud scenarios; determining, by the computing system, a user identifier associated with each fraud event based on the data associated with the fraudulent activity; determining, by the computing system, an alert-generation model applicable to each fraud event based on the user identifier associated with each fraud event; generating, by the computing system, an alert probability score corresponding to each fraud event by executing the determined alert-generation model; updating, by the computing system, the one or more fraud detection algorithms by modifying the one or more fraud scenarios based on the alert probability score corresponding to each fraud event; generating, by the computing system, an alert associated with the fraud event upon determining that the alert probability score exceeds a pre-defined threshold score; and in response to the computing system generating the alert for the fraudulent activity: generating, by the computing system, one or more instructions to cease execution of a request associated with the fraudulent activity; and updating, by the computing system, a behavior profile of the user to include a record of the fraud event in the account of the user, whereby the computing system trains the alert-generation model using the updated behavior profile.

“2. The method according to claim 1, wherein the alert comprises one or more log files containing one or more descriptions of a fraud event associated with a data channel.

“3. The method according to claim 1 further comprising, in response to the computing system generating the alert for the fraudulent activity: transmitting, by the computing system to an administrator device, the one or more instructions to cease the execution of the request associated with the fraudulent activity.

“4. The method according to claim 1, further comprising, in response to the computer system generating the alert for the fraudulent activity: transmitting, by the computing system, one or more notifications to a user device alerting the user about the fraudulent activity in their account.

“5. The method according to claim 1, wherein the one or more fraud detection devices are configured to detect events associated with a type of the fraud detection device.

“6. A computer-readable storage medium storing instructions that, when executed by a computing system, cause the computing system to perform a process comprising: receiving, by the computing system, one or more fraud events from one or more fraud detection devices, wherein each of the one or more fraud events comprises data associated with a fraudulent activity; determining, by the computing system, a user identifier associated with a fraud event of the one or more fraud events based on the data associated with the fraudulent activity; determining, by the computing system, an alert-generation model applicable to the fraud event based on the user identifier associated with the fraud event; generating, by the computing system, an alert probability score corresponding to the fraud event by executing the alert-generation model; generating, by the computing system, an alert associated with the fraud event upon determining that the alert probability score corresponding to the fraud event exceeds a pre-defined threshold score; and in response to the computing system determining that the alert probability score exceeds the pre-defined threshold score: generating, by the computing system, one or more instructions to cease execution of a request associated with the fraudulent activity; and updating, by the computing system, a behavior profile of the user with a record of the fraud event in the account of the user, whereby the computing system trains the alert-generation model using the updated behavior profile.

“7. The computer-readable storage medium according to claim 6, wherein the computing system trains the alert-generation model based on known false positive fraud identification.

“8. The computer-readable storage medium according to claim 6, wherein the one or more fraud events are associated with a particular type of fraud or attack and are determined by the one or more fraud detection devices based on one or more scenario attribute models.

“9. The computer-readable storage medium according to claim 6, wherein the process further comprises: sorting one or more alerts generated for the one or more fraud events according to their corresponding fraud probability scores.

“10. The computer-readable storage medium according to claim 6, wherein the behavior profile of each user further comprises personal data, financial data, and social network data.

“11. A computing system comprising: one or more processors; and one or more memories storing instructions that, when executed by the one or more processors, cause the computing system to perform a process comprising: receiving one or more fraud events from one or more fraud detection devices, wherein each of the one or more fraud events comprises data associated with a fraudulent activity; determining a user identifier associated with a fraud event of the one or more fraud events based on the data associated with the fraudulent activity; determining an alert-generation model applicable to the fraud event based on the user identifier associated with the fraud event; generating an alert probability score corresponding to the fraud event by executing the alert-generation model; generating an alert associated with the fraud event upon determining that the alert probability score corresponding to the fraud event exceeds a pre-defined threshold score; and upon the computing system generating the alert for the fraudulent activity: generating one or more instructions to cease the execution of a request associated with the fraudulent activity; and updating a behavior profile of the user with a record of the fraud event in the account of the user, whereby the computing system trains the alert-generation model using the updated behavior profile.

“12. The computing system according to claim 11, wherein an alert comprises log files containing data describing a fraud event associated with a data channel.

“13. The computing system according to claim 11, wherein the process further comprises: transmitting the one or more instructions to cease the execution of the request associated with the fraudulent activity.

“14. The computing system according to claim 11, wherein the process further comprises: transmitting one or more notifications to a user device alerting the user about the fraudulent activity in their account.

“15. The computing system according to claim 11, wherein the one or more fraud detection devices are configured to detect events associated with a type of the fraud detection device.

“16. The computing system according to claim 11, wherein the computing system trains the alert-generation model based on known false positive fraud identification.

“17. The computing system according to claim 11, wherein the one or more fraud events are associated with a particular type of fraud or attack and are determined by the one or more fraud detection devices based on one or more scenario attribute models.

“18. The computing system according to claim 11, wherein the process further comprises: sorting one or more alerts generated for the one or more fraud events according to their corresponding fraud probability scores.

“19. The computing system according to claim 18, wherein the process further comprises: presenting the one or more alerts on a graphical user interface (GUI) of an administrator device in order of priority as indicated by the relative fraud probability scores.

“20. The computing system according to claim 11, wherein the behavior profile of each user further comprises personal data, financial data, and social network data.”

For the URL and additional information on this patent, see: Comeaux, Jansey. Systems and methods for generation of alerts based on fraudulent network activity. U.S. Patent Number 11669844, filed November 19, 2020, and published online on June 6, 2023. Patent URL (for desktop use only): https://ppubs.uspto.gov/pubwebapp/external.html?q=(11669844)&db=USPAT&type=ids

(Our reports deliver fact-based news of research and discoveries from around the world.)