US 10,567,402 B1Granted

Systems and methods of detecting and mitigating malicious network activity

AssigneeUnited Services Automobile Association (USAA)

InventorsJansey Comeaux, Michael Scott McQuarrie, Gregory Sansone, Veronica Santiago

Life of this patent

Estimating the term…

Loading patent…

Abstract

Disclosed herein are systems and methods executing a security server that perform various processes using alert elements containing various data fields indicating threats of fraud or attempts to penetrate an enterprise network. Using alert elements, the security server generate integrated alerts that are associated with customers of the system and assign a risk score for the integrated alerts, which the security server uses to store and sort the integrated alerts according to a priority, based on the relative risk scores. Analyst computers may query and fetch integrated alerts from an integrate alert database, and then present the integrate alerts to be addressed by an analyst according to the priority level of the respective integrated alerts. This allows to ensure that the right customer, is worked by the right analyst, at the right time, to maximize fraud prevention and minimize customer impact.

Claims20

Dependent claims

A computer-implemented method comprising:

receiving, by a computer, a set of one or more alert elements containing a customer identifier from one or more alert-generating systems configured to generate a corresponding alert element;
generating, by the computer, in an integrated alert database an integrated alert associated with the customer identifier, the integrated alert comprising one or more data fields containing data from the set of one or more alert elements associated with the customer identifier in the alert element database, wherein the integrated alert database is configured to store a plurality of integrated alerts associated with a plurality of customer identifiers;
generating, by the computer, a first learning algorithm configured to determine a risk associated with each of the set of one or more alert elements, wherein the first learning algorithm receives an input of a first learning algorithm dataset based on data associated with a set of one or more scenario attribute models, wherein each of the set of one or more scenario attribute models is associated with a different rate of fraud;
iteratively updating, by the computer, the first learning algorithm dataset based on updated data associated with the set of one or more scenario attribute models, wherein the computer periodically queries a database to receive the updated data associated with the set of one or more scenario attribute models;
executing, by the computer, the first learning algorithm on each integrated alert stored in the integrated alert database to generate a risk score for each respective integrated alert, the risk score of the integrated alert based upon the one or more data fields in the integrated alert;
and
upon the computer receiving a second alert element associated with the customer identifier from an alert-generating system:
identifying, by the computer, in the integrated alert database the integrated alert associated with the customer identifier;
and
updating, by the computer, the risk score for the integrated alert based upon the one or more data fields of the second alert element and the set of one or more alert elements, upon determining that the integrated alert is not marked as completed.

7 more elements

A system comprising:

one or more alert-generating systems configured to generate an alert element;
an alert element database configured to store a plurality of alert elements;
and
a computer configured to:
receive a set of one or more alert elements containing a customer identifier from the one or more alert-generating systems configured to generate a corresponding alert element;
store each alert element into the alert element database configured to store the plurality of alert elements associated with a plurality of customer identifiers;
generate in an integrated alert database an integrated alert associated with the customer identifier, the integrated alert comprising one or more data fields containing data from the set of one or more alert elements associated with the customer identifier in the alert element database, wherein the integrated alert database is configured to store a plurality of integrated alerts associated with a plurality of customer identifiers;
generate a risk score for each respective integrated alert stored in the integrated alert database, the risk score of the integrated alert based upon the one or more data fields in the integrated alert;
and
upon the computer receiving a second alert element associated with the customer identifier from an alert-generating system:
identify in the integrated alert database the integrated alert associated with the customer identifier;
and
update the risk score for the integrated alert based upon the one or more data fields of the second alert element and the set of one or more alert elements, upon determining that the integrated alert is not marked as completed.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/952,443Filed 13 Apr 2018 · us provisional application
Priority: 13 Apr 2017
Granted: 18 Feb 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification22 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06F 16/951
Retrieval from the web: indexing; Web crawling techniques
G06F 16/955
Retrieval from the web: using information identifiers, e.g. uniform resource locators [URL]
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action