# US 10,484,426 B2 · Auto-generated synthetic identities for simulating population dynamics to detect fraudulent activity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,426 B2
- Document ID: US10484426B2
- Status: Granted
- Kind: B2
- Application number: 16/298,170
- Filed: 2019-03-11
- Published: 2019-09-12
- Granted: 2019-11-19
- Earliest claimed: 2018-03-12
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Timur Sherif; Hannes Jouhikainen; Steve Blanchet
- Web page: https://patentgrep.com/patent/US10484426B2

## CPC

- H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment}
- G06Q 50/265: {Personal security, identity or safety}
- H04L 63/102: {Entity profiles}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04W 12/12: Detection or prevention of fraud
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Embodiments disclosed herein generally relate to a system and method for detecting fraudulent computer activity. A computing system generates a plurality of synthetic identities. Each of the plurality of synthetic identities mimics information associated with a verified identity. The computing system receives, from a user, an input attempt. The input attempt includes a synthetic identity of the plurality of synthetic identities. The computing system compares input information in the input attempt to the plurality of synthetic identities. The computing system determines that the input information in the input attempt includes information from the plurality of synthetic identities, if it does, the computing system rejects the input attempt.

## Claims

### Claim 1

A method, comprising:
generating, by a computing system using a machine learning model, a synthetic identity model by learning a plurality of characteristics associated with a verified identity using a training data set comprising sets of verified information;
generating, by the computing system, a plurality of synthetic identities using the synthetic identity model, wherein each synthetic identity mimics information associated with a verified identity;
receiving, by the computing system from a client device, an input attempt comprising input information associated with a synthetic identity of the plurality of synthetic identities;
comparing the input information in the input attempt to the plurality of synthetic identities;
determining that the input information in the input attempt comprises information from the plurality of synthetic identities; and
rejecting the input attempt.

### Claim 2 (depends on 1)

The method of claim 1, wherein generating, by the computing system using the machine learning model, the synthetic identity model by learning the plurality of characteristics associated with the verified identity using the training data set, comprises:
learning how to create synthetic identities that mimic information associated with verified identities.

### Claim 3 (depends on 1)

The method of claim 1, wherein generating, by the computing system, the plurality of synthetic identities using the synthetic identity model, comprises:
referencing each generated synthetic identity against one or more third party data sources to verify that a candidate synthetic identity does not correspond to a verified identity.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
identifying, by the computing system, an Internet protocol (IP) address of the user attempting to use information from the plurality of synthetic identities;
identifying, by the computing system, a further input attempt originating from the IP address; and
blocking, by the computing system, the further input attempt.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
uploading, by the computing system, the plurality of synthetic identities into a darkweb accessible web page.

### Claim 6 (depends on 1)

The method of claim 1, wherein generating, by the computing system using the machine learning model, the synthetic identity model by learning the plurality of characteristics associated with a verified identity comprises:
scanning a plurality of sources of verified identity information to identify characteristics of verified identities.

### Claim 7 (depends on 1)

The method of claim 1, wherein generating, by the computing system, the plurality of synthetic identities using the synthetic identity model comprises:
injecting indicia or combinations of indicia into each synthetic identity such that each synthetic identity is detectable by the computing system.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
receiving, by the computing system from the client device, a footprint associated with the input attempt; and
referencing, by the computing system, the footprint in analysis of further input attempts.

### Claim 9

A system, comprising:
a processor; and
a memory having programming instructions stored thereon, which, when executed by the processor, perform operations comprising:
generating, using a machine learning model, a synthetic identity model by learning a plurality of characteristics associated with a verified identity using a training data set comprising sets of verified information;
generating a plurality of synthetic identities using the synthetic identity model, wherein each synthetic identity mimics information associated with a verified identity;
receiving, from a client device, an input attempt comprising input information associated with a synthetic identity of the plurality of synthetic identities;
comparing the input information in the input attempt to the plurality of synthetic identities;
determining that the input information in the input attempt comprises information from the plurality of synthetic identities; and
rejecting the input attempt.

### Claim 10 (depends on 9)

The system of claim 9, wherein generating, using the machine learning model, the synthetic identity model by learning the plurality of characteristics associated with the verified identity using the training data set, comprises:
learning how to create synthetic identities that mimic information associated with verified identities.

### Claim 11 (depends on 9)

The system of claim 9, wherein generating the plurality of synthetic identities using the synthetic identity model, comprises:
referencing each generated synthetic identity against one or more third party data sources to verify that a candidate synthetic identity does not correspond to a verified identity.

### Claim 12 (depends on 9)

The system of claim 9, wherein the operations further comprise:
identifying an Internet protocol (IP) address of the user attempting to use information from the plurality of synthetic identities;
identifying a further input attempt originating from the IP address; and
blocking the further input attempt.

### Claim 13 (depends on 9)

The system of claim 9, wherein the operations further comprise:
uploading the plurality of synthetic identities into a darkweb accessible web page.

### Claim 14 (depends on 9)

The system of claim 9, wherein generating, using the machine learning model, the synthetic identity model by learning the plurality of characteristics associated with a verified identity comprises:
scanning a plurality of sources of verified identity information to identify characteristics of verified identities.

### Claim 15 (depends on 9)

The system of claim 9, wherein generating the plurality of synthetic identities using the synthetic identity model comprises:
injecting indicia or combinations of indicia into each synthetic identity such that each synthetic identity is detectable by the system.

### Claim 16 (depends on 9)

The system of claim 9, wherein the operations comprises:
receiving, by a client device, a footprint associated with the input attempt; and
referencing the footprint in analysis of further input attempts.