# US 11,451,562 B2 · Recommending signals to monitor in a fraud prevention application > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,562 B2 - Document ID: US11451562B2 - Status: Granted - Kind: B2 - Application number: 16/864,470 - Filed: 2020-05-01 - Published: 2021-11-04 - Granted: 2022-09-20 - Earliest claimed: 2020-05-01 - Assignees: Mastercard Technologies Canada Ulc - Applicants: Mastercard Technologies Canada Ulc - Inventors: Hanhan Wu; Nicholas Desmond; Karen Rose Taylor - Web page: https://patentgrep.com/patent/US11451562B2 ## CPC - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - G06F 17/15: Correlation function computation {including computation of convolution operations (arithmetic circuits for sum of products per se, e.g. multiply-accumulators G06F7/5443; digital filters, e.g. FIR, IIR, adaptive filters H03H17/00)} - G06F 18/22: Matching criteria, e.g. proximity measures - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06N 5/04: Inference or reasoning models - G06V 40/10: Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING ## Abstract A system, method and computer-readable medium for recommending signals to monitor in a fraud prevention application, including a server including an electronic processor. The electronic processor is configured to calculate a similarity score for one or more clients, and, for one or more signals, determine, for each of the one or more clients, a signal weight associated with the signal. The electronic processor is also configured to multiply the signal weight by the similarity score associated with the client to generate a weighted similarity score and generate a total similarity score and, for each signal, a total weighted similarity score. The electronic processor is configured to, for each signal, generate a recommendation score based on the total weighted similarity score for the signal and the total similarity score for the signal and, based on the recommendation scores, generate one or more recommended signals for a first client. ## Claims ### Claim 1 A system for recommending signals to monitor in a fraud prevention application, the system comprising a server including an electronic processor, the electronic processor configured to receive a request for signal recommendations for a first client; calculate a similarity score for one or more clients different from the first client; for one or more signals, determine, for each of the one or more clients, a signal weight associated with the signal; multiply the signal weight by the similarity score associated with the client to generate a weighted similarity score associated with the signal and the client; generate a total similarity score and, for each signal, a total weighted similarity score; for each signal, generate a recommendation score based on the total weighted similarity score for the signal and the total similarity score for the signal; and based on the recommendation scores, generate one or more recommended signals for the first client. ### Claim 2 (depends on 1) The system according to claim 1, wherein the electronic processor is configured to calculate a confidence for each recommendation score; and send the confidence associated with the generated one or more recommended signals to an electronic device associated with the first client. ### Claim 3 (depends on 2) The system according to claim 2, wherein the electronic processor is configured to send a list of the one or more recommended signals to an electronic device associated with the first client, wherein the recommended signals are ranked based on their confidences. ### Claim 4 (depends on 1, 2) The system according to claim 2, wherein electronic processor is configured to calculate a confidence for each recommendation score using a minimum recommendation score calculated in claim 1 and a maximum recommendation score calculated in claim 1. ### Claim 5 (depends on 2) The system according to claim 2, wherein the electronic processor is configured to automatically configure the fraud prevention application to monitor, for the first client, a signal associated with a recommendation score having a confidence above a predetermined threshold. ### Claim 6 (depends on 1) The system according to claim 1, wherein the similarity score represents the similarity between the first client and a client included in the one or more clients and is calculated based on one or more features selected from at least one of the group comprising traffic pattern features, biometrics behavior features, and geological behavior features. ### Claim 7 (depends on 1) The system according to claim 1, wherein the electronic processor is configured to calculate a similarity score for one or more clients different from the first client by using a Pearson Correlation. ### Claim 8 (depends on 1) The system according to claim 1, wherein electronic processor is further configured to determine whether a combination of triggered signals is indicative of an attack. ### Claim 9 A method for recommending signals to monitor in a fraud prevention application, the method comprising receiving a request for signal recommendations for a first client; calculating a similarity score for one or more clients different from the first client; for one or more signals, determining, for each of the one or more clients, a signal weight associated with the signal; multiplying the signal weight by the similarity score associated with the client to generate a weighted similarity score associated with the signal and the client; generating a total similarity score and, for each signal, a total weighted similarity score; for each signal, generating a recommendation score based on the total weighted similarity score for the signal and the total similarity score for the signal; and based on the recommendation scores, generating one or more recommended signals for the first client. ### Claim 10 (depends on 9) The method according to claim 9, the method further comprising calculating a confidence for each recommendation score; and sending the confidence associated with the generated one or more recommended signals to an electronic device associated with the first client. ### Claim 11 (depends on 10) The method according to claim 10, the method further comprising sending a list of the one or more recommended signals to an electronic device associated with the first client, wherein the recommended signals are ranked based on their confidences. ### Claim 12 (depends on 8, 10) The method according to claim 10, wherein calculating a confidence for each recommendation score includes using a minimum recommendation score calculated in claim 8 and a maximum recommendation score calculated in claim 8. ### Claim 13 (depends on 9) The method according to claim 9, wherein the signal weight represents a frequency with which the signal is triggered and is calculated based on one or more features selected from at least one of the group comprising traffic pattern features, biometrics behavior features, and geological behavior features. ### Claim 14 (depends on 9) The method according to claim 9, wherein calculating a similarity score for one or more clients different from the first client includes using a Pearson Correlation. ### Claim 15 (depends on 9) The method according to claim 9, the method further comprising determining whether a combination of triggered signals is indicative of an attack. ### Claim 16 (depends on 9) The method according to claim 9, wherein the total weighted similarity score is a summation of the weighted similarity scores generated for each client and a single signal and the total similarity score is a summation of the similarity scores generated for each client. ### Claim 17 A non-transitory computer-readable medium with computer-executable instructions stored thereon executed by an electronic processor included in a server to perform the method of recommending signals to monitor in a fraud prevention application, comprising receiving a request for signal recommendations for a first client; calculating a similarity score for one or more clients different from the first client; for one or more signals, determining, for each of the one or more clients, a signal weight associated with the signal; multiplying the signal weight by the similarity score associated with the client to generate a weighted similarity score associated with the signal and the client; generating a total similarity score and, for each signal, a total weighted similarity score; for each signal, generating a recommendation score based on the total weighted similarity score for the signal and the total similarity score for the signal; and based on the recommendation scores, generating one or more recommended signals for the first client. ### Claim 18 (depends on 17) The non-transitory computer-readable medium according to claim 17, wherein the signal weight represents a frequency with which the signal is triggered and is calculated based on one or more features selected from at least one of the group comprising traffic pattern features, biometrics behavior features, and geological behavior features. ### Claim 19 (depends on 17) The non-transitory computer-readable medium according to claim 17, the method further comprising determining whether a combination of triggered signals is indicative of an attack. ### Claim 20 (depends on 17) The non-transitory computer-readable medium according to claim 17, the method further comprising calculating a confidence for each recommendation score; and sending the confidence associated with the generated one or more recommended signals to an electronic device associated with the first client.