# US 11,451,590 B2 · Systems and methods for determining access outcomes using access request scoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,590 B2 - Document ID: US11451590B2 - Status: Granted - Kind: B2 - Application number: 17/083,086 - Filed: 2020-10-28 - Published: 2021-02-11 - Granted: 2022-09-20 - Earliest claimed: 2018-10-15 - Assignees: Visa International Service Association - Applicants: Visa International Service Association - Inventors: Hung-Tzaw Hu; Haochuan Zhou; Ge Wen; Benjamin Scott Boding - Web page: https://patentgrep.com/patent/US11451590B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)} - G06F 16/2462: {Approximate or statistical queries} - G06F 16/9017: {using directory or table look-up (use of a directory or look-up table in file systems G06F16/13)} - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/102: {Entity profiles} - H04L 63/105: {Multiple levels of security} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 67/60: Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70) - G06F 16/24578: {using ranking} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Resources can be secured by a resource security system. The resource security system can determine whether to grant or deny access to resources using authorization information in an access request. The resource security system can also determine whether the access request is legitimate or fraudulent using risk scoring models. A score transformation table can be used to provide consistency in the risk level for a particular score over time. The score transformation table can be based on a target score profile and a precision format (e.g., integer or floating point). The score transformation table can dynamically adapt based on the trending top percent of risk and can account for changes in the distribution of scores over time or by weekday. The scores can be used to determine an access request outcome. Access to the resource can be accepted or rejected based on the outcome. ## Claims ### Claim 1 A method for processing access requests, the method comprising performing, by an access server: receiving, from a computing device over a network, a request message including first access request information corresponding to a first access request, the first access request requesting access to a resource; determining a first raw score for the first access request using a scoring model, the scoring model determining the first raw score based on features of the first access request information, the first raw score being within a set of potential output values of the scoring model; determining, based on the first access request information, a first trending top percent risk table and a first target score profile table to use for the first access request, the first trending top percent risk table being determined based on a distribution of raw scores for a plurality of previous access requests across the set of potential output values; determining, using the first trending top percent risk table, a first trending top percent value for the first raw score; determining, using the first target score profile table, a first abbreviated score for the first trending top percent value; generating a response message using the first abbreviated score; and providing the response message over the network, thereby providing access to the resource based on the first abbreviated score. ### Claim 2 (depends on 1) The method of claim 1, wherein the response message is provided to a resource provider computer that controls the access to the resource. ### Claim 3 (depends on 1) The method of claim 1, wherein determining the first abbreviated score for the first trending top percent value comprises: determining a corresponding abbreviated score having a target top risk value that is within a threshold of the first trending top percent value. ### Claim 4 (depends on 1) The method of claim 1, wherein determining the first abbreviated score for the first trending top percent value comprises: determining a corresponding abbreviated score based on the first raw score being greater than a second raw score associated with the corresponding abbreviated score and less than a third raw score associated with a next abbreviated score after the corresponding abbreviated score. ### Claim 5 (depends on 1) The method of claim 1, wherein generating the response message includes: determining an access request outcome based on the first abbreviated score. ### Claim 6 (depends on 1) The method of claim 1, wherein the first access request is sent to a resource provider computer or a request computer. ### Claim 7 (depends on 1) The method of claim 1, further comprising: storing a plurality of trending top percent risk tables and a plurality of target score profile tables, wherein the request message includes an identifier, and wherein determining the first trending top percent risk table and the first target score profile table includes: selecting, based on the identifier, the first trending top percent risk table from the plurality of trending top percent risk tables and the first target score profile table from the plurality of target score profile tables. ### Claim 8 (depends on 7) The method of claim 7, further comprising: periodically updating the first trending top percent risk table based on a new distribution of raw scores for a new set of previous access requests. ### Claim 9 (depends on 1) The method of claim 1, wherein the first access request information includes a time parameter for when the first access request was made, and wherein the first trending top percent risk table is determined based on the time parameter. ### Claim 10 (depends on 1) The method of claim 1, wherein the first trending top percent risk table associates each potential output value of the set of potential output values with a trending top percent value, the trending top percent value for a particular potential output value being based on a percentage of raw scores for the plurality of previous access requests that are equal to or greater than the potential output value. ### Claim 11 An access server, comprising: a processor; and a non-transitory computer-readable storage medium coupled to the processor and storing code executable by the processor for performing operations comprising: receiving, from a computing device over a network, a request message including first access request information corresponding to a first access request, the first access request requesting access to a resource; determining a first raw score for the first access request using a scoring model, the scoring model determining the first raw score based on features of the first access request information, the first raw score being within a set of potential output values of the scoring model; determining, based on the first access request information, a first trending top percent risk table and a first target score profile table to use for the first access request, the first trending top percent risk table being determined based on a distribution of raw scores for a plurality of previous access requests across the set of potential output values; determining, using the first trending top percent risk table, a first trending top percent value for the first raw score; determining, using the first target score profile table, a first abbreviated score for the first trending top percent value; generating a response message using the first abbreviated score; and providing the response message over the network, thereby providing access to the resource based on the first abbreviated score. ### Claim 12 (depends on 11) The access server of claim 11, wherein the response message is provided to a resource provider computer that controls the access to the resource. ### Claim 13 (depends on 11) The access server of claim 11, wherein determining the first abbreviated score for the first trending top percent value comprises: determining a corresponding abbreviated score having a target top risk value that is within a threshold of the first trending top percent value. ### Claim 14 (depends on 11) The access server of claim 11, wherein determining the first abbreviated score for the first trending top percent value comprises: determining a corresponding abbreviated score based on the first raw score being greater than a second raw score associated with the corresponding abbreviated score and less than a third raw score associated with a next abbreviated score after the corresponding abbreviated score. ### Claim 15 (depends on 11) The access server of claim 11, wherein generating the response message includes: determining an access request outcome based on the first abbreviated score. ### Claim 16 (depends on 11) The access server of claim 11, wherein the first access request is sent to a resource provider computer or a request computer. ### Claim 17 (depends on 11) The access server of claim 11, wherein the operations further comprise: storing a plurality of trending top percent risk tables and a plurality of target score profile tables, wherein the request message includes an identifier, and wherein determining the first trending top percent risk table and the first target score profile table includes: selecting, based on the identifier, the first trending top percent risk table from the plurality of trending top percent risk tables and the first target score profile table from the plurality of target score profile tables. ### Claim 18 (depends on 17) The access server of claim 17, wherein the operations further comprise: periodically updating the first trending top percent risk table based on a new distribution of raw scores for a new set of previous access requests. ### Claim 19 (depends on 11) The access server of claim 11, wherein the first access request information includes a time parameter for when the first access request was made, and wherein the first trending top percent risk table is determined based on the time parameter. ### Claim 20 (depends on 11) The access server of claim 11, wherein the first trending top percent risk table associates each potential output value of the set of potential output values with a trending top percent value, the trending top percent value for a particular potential output value being based on a percentage of raw scores for the plurality of previous access requests that are equal to or greater than the potential output value.