# US 10,482,466 B1 · Methods and arrangements to distribute a fraud detection model

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,482,466 B1
- Document ID: US10482466B1
- Status: Granted
- Kind: B1
- Application number: 16/112,209
- Filed: 2018-08-24
- Granted: 2019-11-19
- Earliest claimed: 2018-08-24
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Austin Grant Walters; Jeremy Edward Goodsitt; Fardin Abdi Taghi Abad; Reza Farivar
- Web page: https://patentgrep.com/patent/US10482466B1

## CPC

- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
- G06N 3/0464: Convolutional networks [CNN, ConvNet]
- G06N 3/08: Learning methods
- G06N 3/084: Backpropagation, e.g. using gradient descent
- G06N 3/09: Supervised learning
- G06N 3/098: Distributed learning, e.g. federated learning
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Logic may assign a customer identification to a model to associate a first customer with the model to detect fraudulent transactions. Logic may determine one or more clusters to associate with the first customer based on characteristics associated with the first customer. Logic may associate one or more cluster identifications with the first customer. Each cluster identification may identify one cluster of the one or more clusters. Each cluster may identify a group of customers based on characteristics associated with the group of customers. Logic may cause the model to transmit to a customer device associated with the first customer. Logic may receive transaction data for a transaction for one customer of the group of customers associated with a first cluster. And logic may communicate modified transaction data to customer devices of more than one customer of the group of customers associated with the first cluster.

## Claims

### Claim 1

An apparatus comprising:
memory; and
logic circuitry coupled with the memory to:
assign customer identifications to models to associate customers with the models, each of the models pretrained to detect fraudulent transactions;
determine one or more clusters to associate with the customers based on characteristics associated with the customers;
associate one or more cluster identifications with each of the customers, each cluster identification to identify one cluster of the one or more clusters, each cluster to identify a particular group of the customers of a plurality of groups of the customers, each group of customers having at least one different characteristic of the characteristics than other groups of the plurality of groups of customers;
communicate the models, to cause the models to transmit to customer devices associated with the customers, each customer device associated with one of the customers;
receive transaction data for a transaction for one customer, the one customer associated with a first cluster;
modify the transaction data to create modified transaction data;
communicate the modified transaction data to customer devices of customers associated with the first cluster; and
receive responses from the customer devices based on application of a model of the customer devices of customers associated with the first cluster on the modified transaction data, the responses received to identify the modified transaction as a fraudulent transaction or a non-fraudulent transaction.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the modified transaction data to comprise a hash of the customer identification associated with the one customer.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the modified transaction data communicated to a count of or a portion of a total number of customers in the group of customers associated with the first cluster.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein the logic circuitry is configured to determine that the modified transaction data represents a fraudulent transaction based on the responses and a vote threshold.

### Claim 5 (depends on 4)

The apparatus of claim 4, wherein the vote threshold is based on a count of responses that indicate that the modified transaction is fraudulent or a percentage of responses that indicate that the modified transaction is fraudulent.

### Claim 6 (depends on 4)

The apparatus of claim 4, wherein the logic circuitry is configured to determine to communicate with the one customer in response a determination that the modified transaction data represents a fraudulent transaction.

### Claim 7 (depends on 2)

The apparatus of claim 2, wherein the logic circuitry is configured to retrain the model of the models to detect fraudulent transactions with sets of transactions from the customers associated with the first group, wherein the models comprises a neural network, a statistical model, or a clustering model.

### Claim 8 (depends on 2)

The apparatus of claim 2, wherein the modified transaction comprises location information and value information.

### Claim 9 (depends on 1)

The apparatus of claim 1, wherein the characteristics comprise a location, an income level, a previous purchase, other characteristics associated with a customer profile, or a combination thereof.

### Claim 10

A non-transitory machine-readable medium containing instructions, which when executed by a processor, cause the processor to perform operations, the operations to:
associate customer identifications with models to assign the models to customers, each of the models to comprise a pretrained model to detect fraudulent transactions;
identify one or more clusters to associate with the customers based on characteristics associated with the customers;
assign each of the customers to the one or more clusters, each cluster to identify a group of customers based on the characteristics associated with the group of customers, and each group of customers having at least one different characteristic of the characteristics than other groups of the plurality of groups of customers;
cause the models to transmit to customer devices, each of the customer devices associated with one of the customers;
receive transaction data for a transaction for one customer, the one customer associated with a first cluster;
modify the transaction data to create modified transaction data;
communicate the modified transaction data to customer devices of customers associated with the first cluster; and
receive responses from the customer devices based on application of a model of the customer devices of customers associated with the first cluster on the modified transaction data, the responses received to identify the modified transaction as a fraudulent transaction or a non-fraudulent transaction.

### Claim 11 (depends on 10)

The machine-readable medium of claim 10, wherein the operations further comprise operations the modified transaction data to comprise a hash of the customer identification associated with the one customer.

### Claim 12 (depends on 10)

The machine-readable medium of claim 10, wherein the operations further comprise operations to determine that the modified transaction data represents a non-fraudulent transaction based on the responses and a vote threshold.

### Claim 13 (depends on 10)

The machine-readable medium of claim 10, wherein the operations further comprise operations to train a neural network to detect fraudulent transactions with sets of transactions from more than one customer, wherein the neural network is the model.

### Claim 14 (depends on 10)

The machine-readable medium of claim 10, wherein the operations further comprise operations to retrain the model, wherein the model is a mathematical model based on a classification algorithm or clustering algorithm, to detect fraudulent transactions with sets of transactions from more than one customer.

### Claim 15 (depends on 10)

The machine-readable medium of claim 10, wherein the characteristics comprise a location, an income level, a previous purchase, other characteristics associated with a customer profile, or a combination thereof.

### Claim 16 (depends on 10)

The machine-readable medium of claim 10, wherein the operations further comprise operations to encrypt a customer identification, a transaction identification, or both, in the transaction data to create the modified transaction data.

### Claim 17 (depends on 10)

The machine-readable medium of claim 10, wherein the operations further comprise operations to synthesize transaction data based on purchase histories of multiple customers.

### Claim 18

A computer-implemented method, comprising:
assigning customer identifications to models to associate customers with the models, each of the models pretrained to detect fraudulent transactions;
determining one or more clusters to associate with the customers based on characteristics associated with the customers;
associating one or more cluster identifications with each of the customers, each cluster identification to identify one cluster of the one or more clusters, each cluster to identify a particular group of the customers of a plurality of groups of the customers, each group of customers having at least one different characteristic of the characteristics than other groups of the plurality of groups of customers;
communicating the models, to cause the models to transmit to customer devices associated with the customers, each customer device associated with one of the customers;
receiving transaction data for a transaction for one customer of the group of the customers, the one customer associated with a first cluster;
modifying the transaction data to create modified transaction data;
communicating the modified transaction data to customer devices of customers associated with the first cluster; and
receiving responses from the customer devices based on application of models of the customer devices of customers associated with the first cluster on the modified transaction data, the responses received to identify the modified transaction as a fraudulent transaction or a non-fraudulent transaction.