Malicious message classification using machine learning models
AssigneeIntuit Inc.
InventorYair Horesh
Life of this patent
Estimating the term…
Abstract
Knowledge about a user is used to determine whether one or more messages received by the user are malicious. The knowledge about the user may be based on the user's financial history such as transaction records. Particularly, a classifier model is trained on a supervised approach using a dataset containing, for example, a categorization of incoming messages (e.g., password change message), the user's aggregated transaction records, message attributes, user attributes, and corresponding classification labels. After the training, the classifier model is deployed to determine whether an incoming message is malicious.
Claims20
A method performed by a processor, the method comprising:
- classifying a plurality of messages into a plurality of categories, each category associated with a confidence score;
- aggregating transaction histories for a plurality of users that received the plurality of messages;
- training a classifier model on a dataset comprising:
- the plurality of categories and corresponding confidence scores, each confidence score indicating a probability of selecting a correct category,
- vendor attributes in the aggregated transaction histories, and
- message attributes of the plurality of messages;
- receiving a first message from a user;
- and
- deploying the classifier model and determining, based on the classifier model, whether the first message is a malicious message.
A system comprising:
- a non-transitory storage medium storing computer program instructions;
- and
- one or more processors configured to execute the computer program instructions to cause operations comprising:
- classifying a plurality of messages into a plurality of categories, each category associated with a confidence score;
- aggregating transaction histories for a plurality of users that received the plurality of messages;
- training a classifier model on a dataset comprising:
- the plurality of categories and corresponding confidence scores, each confidence score indicating a probability of selecting a correct category,
- vendor attributes in the aggregated transaction histories, and
- message attributes of the plurality of messages;
- receiving a first message from a user;
- and
- deploying the classifier model and determining, based on the classifier model, whether the first message is a malicious message.
Dependencies are inferred from the claim text.