# US 11,909,749 B2 · Fraud detection based on analysis of frequency-domain data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,749 B2 - Document ID: US11909749B2 - Status: Granted - Kind: B2 - Application number: 17/215,610 - Filed: 2021-03-29 - Published: 2021-08-05 - Granted: 2024-02-20 - Earliest claimed: 2018-07-02 - Assignees: Paypal, Inc. - Applicants: Paypal, Inc. - Inventors: Zhen Xie; Kasra Vakilinia; Yang Chen; Hagar Oppenheim; Xing Ji - Web page: https://patentgrep.com/patent/US11909749B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F 16/2228: {Indexing structures} - G06F 16/258: {Data format conversion from or to a database} - G06Q 20/12: specially adapted for electronic shopping systems - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - H04W 12/61: Time-dependent - H04W 12/63: Location-dependent; Proximity-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A risk analysis system configures the decision engine to detect anomalous online activities by analyzing usage patterns associated with one or more user accounts across multiple frequencies. The risk analysis system obtains transaction log data representing transactions associated with one or more accounts, and extracts data from the transaction log data to generate time-series data along a time dimension. The time-series data may represent usage characteristics of one or more user accounts over a period of time. The risk analysis system derives pattern data representing usage patterns across multiple different frequencies based on the time-series data. The risk analysis system then configures the decision engine to detect anomalous account activities based on the derived pattern data. ## Claims ### Claim 1 A system, comprising: one or more hardware processors, one or more non-transitory computer-readable memories, with program instructions stored on the one or more non-transitory computer-readable memories, the one or more hardware processors configured to execute the program instructions to cause the system to perform operations comprising: generating first account data corresponding to a user account, wherein the first account data comprises time series data that corresponds to a first account attribute; deriving second account data from the first account data, wherein the second account data corresponds to a plurality of account usage frequencies; determining a plurality of pattern strength values corresponding to the plurality of account usage frequencies based on the second account data, wherein each pattern strength value in the plurality of pattern strength values indicates a corresponding strength of a pattern existing in the first account data according to a corresponding account usage frequency in the plurality of account usage frequencies; determining (i) a first pattern index based on a first portion of the plurality of pattern strength values that corresponds to a first account usage frequency range and (ii) a second pattern index based on a second portion of the plurality of pattern strength values that corresponds to a second corresponds to an account usage frequency range; and configuring a decision engine to produce an output indicating a likelihood of anomalous activity associated with the user account using the first pattern index and the second pattern index. ### Claim 2 (depends on 1) The system of claim 1, the operations further comprising: calculating a first statistical value based on the first portion of the plurality of pattern strength values that corresponds to the first account usage frequency range, wherein the first pattern index is determined further based on the first statistical value; and calculating a second statistical value based on the second portion of the plurality of pattern strength values that corresponds to the second account usage frequency range, wherein the second pattern index is determined further based on the second statistical value. ### Claim 3 (depends on 2) The system of claim 2, wherein the first statistical value is one of a maximum pattern strength value, a minimum pattern strength value, a mean value, or a standard deviation value calculated based on the first portion of the plurality of pattern strength values. ### Claim 4 (depends on 1) The system of claim 1, the operations further comprising: in response to receiving the output from the decision engine, modifying the user account based on the output. ### Claim 5 (depends on 4) The system of claim 4, wherein the modifying the user account based on the output includes adjusting a security level associated with the user account. ### Claim 6 (depends on 4) The system of claim 4, wherein the modifying the user account based on the output includes implementing an additional authentication requirement for accessing the user account. ### Claim 7 (depends on 1) The system of claim 1, wherein the operations further comprise: receiving a transaction request; and processing the transaction request based on the output of the decision engine. ### Claim 8 A method comprising: generating, by a computer system, first account data corresponding to a user account, wherein the first account data is a comprises time series data that corresponds to a first account attribute; deriving, by the computer system, second account data from the first account data, wherein the second account data corresponds to a plurality of account usage frequencies; determining, by the computer system, a plurality of pattern strength values corresponding to the plurality of account usage frequencies based on the second account data, wherein each pattern strength value in the plurality of pattern strength values indicates a corresponding strength of a pattern existing in the first account data according to a corresponding account usage frequency in the plurality of account usage frequencies; determining, by the computer system, (i) a first pattern index based on a first portion of the plurality of pattern strength values that corresponds to a first account usage frequency range and (ii) a second pattern index based on a second portion of the plurality of pattern strength values that corresponds to a second account usage frequency range; and configuring, by the computer system, a decision engine to output a likelihood of anomalous activity associated with the user account using the first pattern index and the second pattern index. ### Claim 9 (depends on 8) The method of claim 8, further comprising: calculating a first statistical value based on the first portion of the plurality of pattern strength values that corresponds to the first account usage frequency range, wherein the first pattern index is determined further based on the first statistical value; and calculating a second statistical value based on the second portion of the plurality of pattern strength values that corresponds to the second account usage frequency range, wherein the second pattern index is determined further based on the second statistical value. ### Claim 10 (depends on 9) The method of claim 9, wherein the first pattern index comprises a statistical value derived from a first set of pattern strength values that corresponds to a first set of account usage frequencies within the first account usage frequency range. ### Claim 11 (depends on 8) The method of claim 8, further comprising: in response to receiving an output from the decision engine, modifying the user account based on the output. ### Claim 12 (depends on 11) The method of claim 11, wherein the modifying the user account based on the output includes adjusting a security level associated with the user account. ### Claim 13 (depends on 11) The method of claim 11, wherein the modifying the user account based on the output includes implementing an additional authentication requirement for accessing the user account. ### Claim 14 (depends on 8) The method of claim 8, further comprising: receiving a transaction request; and processing the transaction request based on an output of the decision engine. ### Claim 15 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: generating first account data corresponding to a user account, wherein the first account data comprises time series data that corresponds to a first account attribute; deriving second account data from the first account data, wherein the second account data corresponds to a plurality of account usage frequencies; determining a plurality of pattern strength values corresponding to the plurality of account usage frequencies based on the second account data, wherein each pattern strength value in the plurality of pattern strength values indicates a corresponding strength of a pattern existing in the first account data according to a corresponding account usage frequency in the plurality of account usage frequencies; determining (i) a first pattern index based on a first potion of the plurality of pattern strength values that corresponds to a first account usage frequency range and (ii) a second pattern index based on a second portion of the plurality of pattern strength values that corresponds to a second account usage frequency range; and configuring a decision engine to generate an output indicating a likelihood of anomalous activity associated with the user account using the first pattern index and the second pattern index. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, the operations further comprising: calculating a first statistical value based on the first portion of the plurality of pattern strength values that corresponds to the first account usage frequency range, wherein the first pattern index is determined further based on the first statistical value; and calculating a second statistical value based on the second portion of the plurality of pattern strength values that corresponds to the second account usage frequency range, wherein the second pattern index is determined further based on the second statistical value. ### Claim 17 (depends on 15) The non-transitory machine-readable medium of claim 15, the operations further comprising: in response to receiving the output from the decision engine, modifying the user account based on the output. ### Claim 18 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein the modifying the user account based on the output includes adjusting a security level associated with the user account. ### Claim 19 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein the modifying the user account based on the output includes implementing an additional authentication requirement for accessing the user account. ### Claim 20 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the operations further comprise: receiving a transaction request; and processing the transaction request is based on the output of the decision engine.