# US 10,484,415 B1 · Systems and methods for detecting security risks in network pages > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,415 B1 - Document ID: US10484415B1 - Status: Granted - Kind: B1 - Application number: 15/381,908 - Filed: 2016-12-16 - Granted: 2019-11-19 - Earliest claimed: 2016-12-16 - Assignees: Worldpay, LLC - Applicants: Vantiv, LLC - Inventors: Brant Peterson - Web page: https://patentgrep.com/patent/US10484415B1 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/554: {involving event detection and direct action} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06Q 20/401: {Transaction verification} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06Q 10/10: Office automation; Time management - G06Q 20/02: involving a neutral party, e.g. certification authority, notary or trusted third party [TTP] - G06Q 20/14: specially adapted for billing systems - G06Q 20/382: {insuring higher security of transaction} - G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists - G06Q 20/405: {Establishing or using transaction specific rules} - G06Q 20/4097: {using mutual authentication between devices and transaction partners} - G06Q 30/02: Marketing; Price estimation or determination; Fundraising - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Embodiments include methods and systems for detecting security risks in network pages, comprising providing at least one secure transaction page to a secure transaction provider, the secure transaction page enabling the secure transaction provider to request secure transactions, determining a request rate for the secure transaction page associated with the secure transaction provider, determining a predetermined threshold for a change in request rate for the secure transaction page by the secure transaction provider, determining that the predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded, and providing a notification to the secure transaction provider based on the determination that the predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded. ## Claims ### Claim 1 A method for detecting security risks in network pages, comprising: providing at least one secure transaction page to a secure transaction provider, the secure transaction page enabling the secure transaction provider to request secure transactions; determining an expected request rate for the secure transaction page by the secure transaction provider based on a history of request rate for the secure transaction page; determining an actual request rate for the secure transaction page by the secure transaction provider, the actual request rate being indicative of a number of calls for the secure transaction page over a predetermined time period; determining a first predetermined threshold for a change in request rate for the secure transaction page by the secure transaction provider, the change in request rate representing a difference between the expected request rate and the actual request rate; determining that the first predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded, with the actual request rate being lower than the expected request rate by an amount exceeding the first predetermined threshold; in response to determining that the first predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded, declining at least one of a new token request or a card-not-present (CNP) token request from the secure transaction provider; providing a notification to the secure transaction provider based on the determination that the first predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded; receiving secure transaction data from the secure transaction provider; and determining a second predetermined threshold, the second predetermined threshold being lower than the first predetermined threshold, for a change in request rate for the secure transaction page by the secure transaction provider, based on the secure transaction data from the secure transaction provider. ### Claim 2 (depends on 1) The method of claim 1, wherein determining the first predetermined threshold for the change in request rate comprises: comparing the actual request rate with the expected request rate to determine the first predetermined threshold for the change in request rate. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving sensitive data corresponding to an account via the secure transaction page from the secure transaction provider; generating a token corresponding to the sensitive data; and providing the token corresponding to the sensitive data to the secure transaction provider. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining whether the secure transaction page is functioning; receiving an electronic transaction request associated with the secure transaction provider; and in response to determining that the secure transaction page is not functioning, declining the electronic transaction request. ### Claim 5 (depends on 1) The method of claim 1, wherein the secure transaction provider is an online merchant. ### Claim 6 (depends on 1) The method of claim 1, wherein the secure transaction page is an iFrame hosted by a third party, such that sensitive data received via the secure transaction page is isolated from the secure transaction page. ### Claim 7 A system for detecting security risks in network pages, the system comprising: a data storage device storing instructions for detecting security risks in secure transaction pages; and a processor configured to execute the instructions to perform a method comprising: providing at least one secure transaction page to a secure transaction provider, the secure transaction page enabling the secure transaction provider to request secure transactions; determining an expected request rate for the secure transaction page by the secure transaction provider based on a history of request rate for the secure transaction page; determining an actual request rate for the secure transaction page by the secure transaction provider, the actual request rate being indicative of a number of calls for the secure transaction page over a predetermined time period; determining a first predetermined threshold for a change in request rate for the secure transaction page by the secure transaction provider, the change in request rate representing a difference between the expected request rate and the actual request rate; determining that the first predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded, with the actual request rate being lower than the expected request rate by an amount exceeding the first predetermined threshold; in response to determining that the first predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded, declining at least one of a new token request or a card-not-present (CNP) token request from the secure transaction provider; providing a notification to the secure transaction provider based on the determination that the first predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded; receiving secure transaction data from the secure transaction provider; and determining a second predetermined threshold, the second predetermined threshold being lower than the first predetermined threshold, for a change in request rate for the secure transaction page by the secure transaction provider, based on the secure transaction data from the secure transaction provider. ### Claim 8 (depends on 7) The system of claim 7, wherein determining the first predetermined threshold for the change in request rate comprises: comparing the actual request rate with the expected request rate to determine the first predetermined threshold for the change in request rate. ### Claim 9 (depends on 7) The system of claim 7, the processor executing a method further comprising: receiving sensitive data corresponding to an account via the secure transaction page from the secure transaction provider; generating a token corresponding to the sensitive data; and providing the token corresponding to the sensitive data to the secure transaction provider. ### Claim 10 (depends on 7) The system of claim 7, the processor executing a method further comprising: determining whether the secure transaction page is functioning; receiving an electronic transaction request associated with the secure transaction provider; and in response to determining that the secure transaction page is not functioning, declining the electronic transaction request. ### Claim 11 (depends on 7) The system of claim 7, wherein the secure transaction provider is an online merchant. ### Claim 12 (depends on 7) The system of claim 7, wherein the secure transaction page is an iFrame hosted by a third party, such that sensitive data received via the secure transaction page is isolated from the secure transaction page. ### Claim 13 A non-transitory computer-readable medium storing instructions that, when executed by a transaction processor, cause the transaction processor to perform a method for detecting security risks in network pages, the method comprising: providing at least one secure transaction page to a secure transaction provider, the secure transaction page enabling the secure transaction provider to request secure transactions; determining an expected request rate for the secure transaction page by the secure transaction provider based on a history of request rate for the secure transaction page; determining an actual request rate for the secure transaction page by the secure transaction provider, the actual request rate being indicative of a number of calls for the secure transaction page over a predetermined time period; determining a first predetermined threshold for a change in request rate for the secure transaction page by the secure transaction provider, the change in request rate representing a difference between the expected request rate and the actual request rate; determining that the first predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded, with the actual request rate being lower than the expected request rate by an amount exceeding the first predetermined threshold; in response to determining that the first predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded, declining at least one of a new token request or a card-not-present (CNP) token request from the secure transaction provider; providing a notification to the secure transaction provider based on the determination that the first predetermined threshold, for the change in request rate for the secure transaction page by the secure transaction provider, has been exceeded; receiving secure transaction data from the secure transaction provider; and determining a second predetermined threshold, the second predetermined threshold being lower than the first predetermined threshold, for a change in request rate for the secure transaction page by the secure transaction provider, based on the secure transaction data from the secure transaction provider. ### Claim 14 (depends on 13) The computer-readable medium of claim 13, wherein determining the first predetermined threshold for the change in request rate comprises: comparing the actual request rate with the expected request rate to determine the first predetermined threshold for the change in request rate. ### Claim 15 (depends on 13) The computer-readable medium of claim 13, the transaction processor performing a method further comprising: receiving sensitive data corresponding to an account via the secure transaction page from the secure transaction provider; generating a token corresponding to the sensitive data; and providing the token corresponding to the sensitive data to the secure transaction provider. ### Claim 16 (depends on 13) The computer-readable medium of claim 13, the transaction processor performing a method further comprising: determining whether the secure transaction page is functioning; receiving an electronic transaction request associated with the secure transaction provider; and in response to determining that the secure transaction page is not functioning, declining the electronic transaction request. ### Claim 17 (depends on 13) The computer-readable medium of claim 13, wherein the secure transaction provider is an online merchant.