# US 12,015,641 B1 · Malicious message classification using machine learning models

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,015,641 B1
- Document ID: US12015641B1
- Status: Granted
- Kind: B1
- Application number: 18/354,270
- Filed: 2023-07-18
- Granted: 2024-06-18
- Earliest claimed: 2023-01-26
- Assignees: Intuit Inc.
- Applicants: Intuit Inc.
- Inventors: Yair Horesh
- Web page: https://patentgrep.com/patent/US12015641B1

## CPC

- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- G06F 40/30: Semantic analysis
- G06F 40/40: Processing or translation of natural language (natural language analysis G06F40/20; semantic analysis G06F40/30)
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 40/289: Phrasal analysis, e.g. finite state techniques or chunking
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Knowledge about a user is used to determine whether one or more messages received by the user are malicious. The knowledge about the user may be based on the user's financial history such as transaction records. Particularly, a classifier model is trained on a supervised approach using a dataset containing, for example, a categorization of incoming messages (e.g., password change message), the user's aggregated transaction records, message attributes, user attributes, and corresponding classification labels. After the training, the classifier model is deployed to determine whether an incoming message is malicious.

## Claims

### Claim 1

A method performed by a processor, the method comprising:
classifying a plurality of messages into a plurality of categories, each category associated with a confidence score;
aggregating transaction histories for a plurality of users that received the plurality of messages;
training a classifier model on a dataset comprising:
the plurality of categories and corresponding confidence scores, each confidence score indicating a probability of selecting a correct category,
vendor attributes in the aggregated transaction histories, and
message attributes of the plurality of messages;
receiving a first message from a user; and
deploying the classifier model and determining, based on the classifier model, whether the first message is a malicious message.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
transmitting an alert to the user in response to determining that the first message is malicious.

### Claim 3 (depends on 1)

The method of claim 1, wherein the first message is in a screenshot form, the method further comprising:
performing an optical character recognition of the screenshot to extract text of the first message.

### Claim 4 (depends on 1)

The method of claim 1, wherein classifying the plurality of messages into the plurality of categories comprises classifying using a Sentence-Bidirectional Encoder Representations from Transformers (S-BERT) model.

### Claim 5 (depends on 1)

The method of claim 1, wherein training the classifier model comprises training an xgboost classifier model.

### Claim 6 (depends on 1)

The method of claim 1, wherein training the classifier model further comprises:
training the classifier model on the dataset comprising user attributes of the plurality of users.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
retraining the classifier model based on accuracy of predictions.

### Claim 8 (depends on 1)

The method of claim 1, wherein aggregating the transaction histories further comprises:
generating a transaction history table for each of the plurality of users.

### Claim 9 (depends on 1)

The method of claim 1, wherein aggregating the transaction histories further comprises:
retrieving transaction data from a plurality of financial institutions.

### Claim 10 (depends on 1)

The method of claim 1, wherein determining whether the first message is a malicious message further comprises generating a confidence score associated with the determination.

### Claim 11

A system comprising:
a non-transitory storage medium storing computer program instructions; and
one or more processors configured to execute the computer program instructions to cause operations comprising:
classifying a plurality of messages into a plurality of categories, each category associated with a confidence score;
aggregating transaction histories for a plurality of users that received the plurality of messages;
training a classifier model on a dataset comprising:
the plurality of categories and corresponding confidence scores, each confidence score indicating a probability of selecting a correct category,
vendor attributes in the aggregated transaction histories, and
message attributes of the plurality of messages;
receiving a first message from a user; and
deploying the classifier model and determining, based on the classifier model, whether the first message is a malicious message.

### Claim 12 (depends on 11)

The system of claim 11, wherein the operations further comprise:
transmitting an alert to the user in response to determining that the first message is malicious.

### Claim 13 (depends on 11)

The system of claim 11, wherein the first message is in a screenshot form, wherein the operations further comprise:
performing an optical character recognition of the screenshot to extract text of the message.

### Claim 14 (depends on 11)

The system of claim 11, wherein classifying the plurality of messages into the plurality of categories comprises classifying using a Sentence-Bidirectional Encoder Representations from Transformers (S-BERT) model.

### Claim 15 (depends on 11)

The system of claim 11, wherein training the classifier model comprises training an xgboost classifier model.

### Claim 16 (depends on 11)

The system of claim 11, wherein training the classifier model further comprises:
training the classifier model on the dataset comprising user attributes of the plurality of users.

### Claim 17 (depends on 11)

The system of claim 11, wherein the operations further comprise:
retraining the classifier model based on accuracy of predictions.

### Claim 18 (depends on 11)

The system of claim 11, wherein aggregating the transaction histories further comprises:
generating a transaction history table for each of the plurality of users.

### Claim 19 (depends on 11)

The system of claim 11, wherein aggregating the transaction histories further comprises:
retrieving transaction data from a plurality of financial institutions.

### Claim 20 (depends on 11)

The system of claim 11, wherein determining whether the first message is a malicious message further comprises generating a confidence score associated with the determination.