US 11,457,042 B1Granted

Multi-tiered system for detecting and reducing unauthorized network access

AssigneeWells Fargo Bank, N.A.

InventorMasoud Vakili

Life of this patent

Estimating the term…

Loading patent…

Abstract

Embodiments are disclosed for detecting and responding to potentially fraudulent transactions and other network access events via a system comprising a three-tiered network architecture. An example system comprises one or more user equipment devices configured with a thin client application (a first tier). The one or more user equipment devices are capable of communicating with a respective local authority controller and a local knowledge base (the second tier). The one or more local authority controllers and local knowledge bases are configured to interact with a master authority controller and master knowledge base (the third tier) to enable the efficient assessment of potentially localized fraudulent network activity and the passing of network access rule sets amongst the devices in each tier. Corresponding apparatuses and methods are also provided.

Claims17

Dependent claims

A method for detecting and reducing fraudulent network activity via a system arranged in a three-tiered architecture, the method comprising:

receiving, by escalation circuitry of a local authority controller, an escalation request from a user equipment device, the escalation request comprising a set of characteristics associated with a potentially fraudulent transaction detected by the user equipment device;
determining, by monitoring circuitry of the local authority controller and based at least in part on the escalation request, whether the local authority controller is capable of resolving the escalation request, wherein determining whether the local authority controller is capable of resolving the escalation request comprises comparing the set of characteristics associated with the potentially fraudulent transaction against one or more sets of characteristics associated with fraudulent activity received from a local knowledge base, wherein the local knowledge base is configured to store a set of characteristics of one or more fraudulent transactions associated with a particular geographic area;
in an instance in which the local authority controller is not capable of resolving the escalation request, transmitting, by communications circuitry of the local authority controller, the set of characteristics associated with the potentially fraudulent transaction to a master authority controller;
receiving, by the communications circuitry of the local authority controller, a set of instructions from the master authority controller in response to transmitting the set of characteristics of the potentially fraudulent transaction to the master authority controller;
generating, by abatement circuitry of the local authority controller, a network access rule set based on (i) the escalation request and (ii) the set of instructions received from the master authority controller, wherein the network access rule set comprises a set of actions to be taken by the user equipment device based at least in part on the set of characteristics of the potentially fraudulent transaction, wherein the network access rule set is at least indicative of whether the potentially fraudulent transaction is determined to be authentic or fraudulent;
and
causing, by the local authority controller, transmission of the network access rule set to the user equipment device.

4 more elements

An apparatus for detecting and reducing fraudulent network activity via a system arranged in a three-tiered architecture, the apparatus comprising a local authority controller including:

escalation circuitry configured to receive an escalation request from a user equipment device, the escalation request comprising a set of characteristics associated with a potentially fraudulent transaction detected by the user equipment device;
monitoring circuitry configured to determine, based at least in part on the escalation request, whether the local authority controller is capable of resolving the escalation request, wherein determining whether the local authority controller is capable of resolving the escalation request comprises comparing the set of characteristics associated with the potentially fraudulent transaction against one or more sets of characteristics associated with fraudulent activity received from a local knowledge base, wherein the local knowledge base is configured to store a set of characteristics of one or more fraudulent transactions associated with a particular geographic area;
communications circuitry configured to:
in an instance in which the local authority controller is not capable of resolving the escalation request, transmit the set of characteristics associated with the potentially fraudulent transaction to a master authority controller, and
receive a set of instructions from the master authority controller in response to transmitting the set of characteristics of the potentially fraudulent transaction to the master authority controller;
and
abatement circuitry configured to generate a network access rule set based on (i) the escalation and (ii) the set of instructions received from the master authority controller, wherein the network access rule set comprises a set of actions to be taken by the user equipment device based at least in part on the set of characteristics associated with the potentially fraudulent transaction, and wherein the network access rule set is at least indicative of whether the potentially fraudulent transaction is determined to be authentic or fraudulent,
wherein the communications circuitry is further configured to cause transmission of the network access rule set to the user equipment device.

5 more elements

A computer program product for detecting and reducing fraudulent network activity via a system arranged in a three-tiered architecture, the computer program product comprising at least one non-transitory computer-readable storage medium storing program instructions that, when executed, cause a local authority controller to:

receive an escalation request from a user equipment device, the escalation request comprising a set of characteristics associated with a potentially fraudulent transaction detected by the user equipment device;
determine, based at least in part on the escalation request, whether the local authority controller is capable of resolving the escalation request, wherein determining whether the local authority controller is capable of resolving the escalation request comprises comparing the set of characteristics associated with the potentially fraudulent transaction against one or more sets of characteristics associated with fraudulent activity received from a local knowledge base, wherein the local knowledge base is configured to store a set of characteristics of one or more fraudulent transactions associated with a particular geographic area;
in an instance in which the local authority controller is not capable of resolving the escalation request, transmit the set of characteristics associated with the potentially fraudulent transaction to a master authority controller;
receive a set of instructions from the master authority controller in response to transmitting the set of characteristics of the potentially fraudulent transaction to the master authority controller;
generate a network access rule set based on (i) the escalation request and (ii) the set of instructions received from the master authority controller, wherein the network access rule set comprises a set of actions to be taken by the user equipment device based at least in part on the characteristics associated with the potentially fraudulent transaction, and wherein the network access rule set is at least indicative of whether the potentially fraudulent transaction is determined to be authentic or fraudulent;
and
cause transmission of the network access rule set to the user equipment device.

4 more elements

Dependencies are inferred from the claim text.