# US 10,320,846 B2 · Systems and methods for generation and selection of access rules

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,846 B2
- Document ID: US10320846B2
- Status: Granted
- Kind: B2
- Application number: 15/365,389
- Filed: 2016-11-30
- Published: 2018-05-31
- Granted: 2019-06-11
- Earliest claimed: 2016-11-30
- Assignees: Visa International Service Association
- Applicants: Visa International Service Association
- Inventors: Haochuan Zhou; Hung-Tzaw Hu; Rong Zhang; Benjamin Scott Boding
- Web page: https://patentgrep.com/patent/US10320846B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/0263: {Rule management}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A resource security system may generate access rules for use in determining whether to grant or deny a request for access to a resource. In order to generate the access rules, the resource security system may select certain access request parameters and determine conditions associated with those parameters. The resource security system may generate mutually exclusive segments associated with a condition of each of the parameters. The resource security system may generate independent access rules based on the segments. The resource security system may then evaluate the performance of each of the access rules based on validity information corresponding to previously received access requests that satisfy the conditions of a particular access rule.

## Claims

### Claim 1

A method for generating access rules, the method comprising performing by a computer system:
storing access request information including a plurality of previous access requests, each previous access request having a plurality of access request parameters;
storing validity information corresponding to the plurality of previous access requests, the validity information indicating whether each access request is fraudulent or legitimate;
selecting a first parameter and a second parameter from the plurality of access request parameters, the first parameter associated with a first set of conditions, the second parameter associated with a second set of conditions;
determining a plurality of mutually exclusive segments based on the first set of conditions and the second set of conditions, each segment associated one condition of the first set of conditions and one condition of the second set of conditions;
generating a plurality of potential access rules, each potential access rule corresponding to a different segment of the plurality of mutually exclusive segments, each of the potential access rules having the conditions of the corresponding segment;
determining a predictive percentage for each of the potential access rules based on the validity information corresponding to previous access requests having one or more parameters that involve the conditions of the potential access rule;
selecting one or more of the potential access rules to be included in an operational set of access rules based on the predictive percentages for each of the potential access rules;
receiving, over a network from a plurality of devices, a plurality of real-time access requests;
accessing a system memory to obtain the operational set of access rules when one of the plurality of real-time access requests is received from a first device of the plurality of devices;
using the operational set of access rules to determine access request outcomes for the real-time access requests; and
providing access to a resource based on the access request outcomes.

### Claim 2 (depends on 1)

The method of claim 1, wherein the plurality of potential access rules are generated simultaneously in parallel, and wherein the predictive percentages for the plurality of potential access rules are determined simultaneously in parallel.

### Claim 3 (depends on 1)

The method of claim 1, wherein each of the plurality of previous access requests has parameters that involve the conditions of a single potential access rule of the plurality of potential access rules.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
determining the first set of conditions based on parameter values of the first parameter, each of the conditions of the first set of conditions being mutually exclusive to the other conditions of the first set of conditions; and
determining the second set of conditions based on parameter values of the second parameter, each of the conditions of the second set of conditions being mutually exclusive to the other conditions of the second set of conditions.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
determining, for each of the potential access rules, a set of previous access requests of the plurality of previous access requests having access request parameters that involve the conditions of the potential access rule; and
determining, for each of the sets of previous access requests, the validity information corresponding to each of the previous access requests in the set of previous access requests, wherein the determining of the predictive percentage for each of the potential access rules is based on the validity information corresponding to each of the previous access requests in the set of previous access requests.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
receiving, over a network from the first device, a first access request having access request parameters;
accessing the system memory to obtain the operational set of access rules in response to receiving the first access request;
determining a first access request outcome for the first access request based on a first access rule and the access request parameters of the first access request, the access request outcome for the first access request indicating to reject the first access request;
determining to accept the access request for evaluation of the first access rule; and
providing access to the resource based on determining to accept the access request.

### Claim 7 (depends on 6)

The method of claim 6, further comprising storing evaluation information in response to the determination to accept the access request, the evaluation information including an identifier of the first access request and an identifier of the first access rule.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
receiving a report of fraudulent access to the resource, the fraudulent access resulting from the first access request; and
adjusting validity information corresponding to the first access request based on the report of fraudulent access.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
determining a false positive percentage for the first access rule based on the evaluation information and the report of fraudulent access; and
adjusting the validity information corresponding to previous access requests that were rejected based on the first access rule using the false positive percentage for the first access rule.

### Claim 10 (depends on 9)

The method of claim 9, wherein the validity information is used in the determining of the predictive percentage for each of the potential access rules.

### Claim 11

A computer system, comprising:
a non-transitory computer readable storage medium storing a plurality of instructions; and
one or more processors for executing the instructions stored on the computer readable storage medium to:
store access request information including a plurality of previous access requests, each previous access request having a plurality of access request parameters;
store validity information corresponding to the plurality of previous access requests, the validity information indicating whether each access request is fraudulent or legitimate;
select a first parameter and a second parameter from the plurality of access request parameters, the first parameter associated with a first set of conditions, the second parameter associated with a second set of conditions;
determine a plurality of mutually exclusive segments based on the first set of conditions and the second set of conditions, each segment associated one condition of the first set of conditions and one condition of the second set of conditions;
generate a plurality of potential access rules, each potential access rule corresponding to a different segment of the plurality of mutually exclusive segments, each of the potential access rules having the conditions of the corresponding segment;
determine a predictive percentage for each of the potential access rules based on the validity information corresponding to previous access requests having one or more parameters that involve the conditions of the potential access rule;
select one or more of the potential access rules to be included in an operational set of access rules based on the predictive percentages for each of the potential access rules;
receive, over a network from a plurality of devices, a plurality of real-time access requests;
access a system memory to obtain the operational set of access rules when one of the plurality of real-time access requests is received from a first device of the plurality of devices;
use the operational set of access rules to determine access request outcomes for the real-time access requests; and
provide access to a resource based on the access request outcomes.

### Claim 12 (depends on 11)

The computer system of claim 11, wherein the plurality of potential access rules are generated simultaneously in parallel, and wherein the predictive percentages for the plurality of potential access rules are determined simultaneously in parallel.

### Claim 13 (depends on 11)

The computer system of claim 11, wherein each of the plurality of previous access requests has parameters that involve the conditions of a single potential access rule of the plurality of potential access rules.

### Claim 14 (depends on 11)

The computer system of claim 11, further comprising instructions to:
determine the first set of conditions based on parameter values of the first parameter, each of the conditions of the first set of conditions being mutually exclusive to the other conditions of the first set of conditions; and
determine the second set of conditions based on parameter values of the second parameter, each of the conditions of the second set of conditions being mutually exclusive to the other conditions of the second set of conditions.

### Claim 15 (depends on 11)

The computer system of claim 11, further comprising instructions to:
determine, for each of the potential access rules, a set of previous access requests of the plurality of previous access requests having access request parameters that involve the conditions of the potential access rule; and
determine, for each of the sets of previous access requests, the validity information corresponding to each of the previous access requests in the set of previous access requests, wherein the determining of the predictive percentage for each of the potential access rules is based on the validity information corresponding to each of the previous access requests in the set of previous access requests.

### Claim 16 (depends on 11)

The computer system of claim 11, further comprising instructions to:
receive, over a network from the first device, a first access request having access request parameters;
access the system memory to obtain the operational set of access rules in response to receiving the first access request;
determine a first access request outcome for the first access request based on a first access rule and the access request parameters of the first access request, the access request outcome for the first access request indicating to reject the first access request;
determine to accept the access request for evaluation of the first access rule; and
providing access to the resource based on determining to accept the access request.

### Claim 17 (depends on 16)

The computer system of claim 16, further comprising instructions to store evaluation information in response to the determination to accept the access request, the evaluation information including an identifier of the first access request and an identifier of the first access rule.

### Claim 18 (depends on 17)

The computer system of claim 17, further comprising instructions to:
receive a report of fraudulent access to the resource, the fraudulent access resulting from the first access request; and
adjust validity information corresponding to the first access request based on the report of fraudulent access.

### Claim 19 (depends on 18)

The computer system of claim 18, further comprising instructions to:
determine a false positive percentage for the first access rule based on the evaluation information and the report of fraudulent access; and
adjust the validity information corresponding to previous access requests that were rejected based on the first access rule using the false positive percentage for the first access rule.

### Claim 20 (depends on 19)

The computer system of claim 19, wherein the validity information is used in the determining of the predictive percentage for each of the potential access rules.