# US 12,113,815 B1 · Systems and methods of using network traffic data to control data transmission > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,815 B1 - Document ID: US12113815B1 - Status: Granted - Kind: B1 - Application number: 17/546,865 - Filed: 2021-12-09 - Granted: 2024-10-08 - Earliest claimed: 2020-12-15 - Assignees: United Services Automobile Association (USAA) - Applicants: United Services Automobile Association (USAA) - Inventors: Justin Dax Haslam; Jose L. Romero, Jr.; Arthur Quentin Smith - Web page: https://patentgrep.com/patent/US12113815B1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 45/123: {Evaluation of link metrics (techniques for monitoring network metrics H04L43/08)} - H04L 45/20: {Hop count for routing purposes, e.g. TTL} - H04L 45/22: {Alternate routing} - H04L 63/0272: {Virtual private networks} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 4/025: {using location based information parameters} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method may include receiving, via a processor, a first set of data packets from a first computing device associated with a user over a first period of time. The method may then involve generating a network hop model indicative of one or more network hops traversed by the first set of data packets. The method may also include receiving a second set of data packets from the first computing device over a second period of time, determining whether the second set of data packets corresponds to the network hop model, and adjusting one or more operations associated with transmitting a third set of data packets to the first computing device in response to determining that the second set of data packets does not match the network hop model. ## Claims ### Claim 1 A method, comprising: receiving, via a processor, a first set of data packets from a first computing device associated with a user over a first period of time; generating, via the processor, a network hop model indicative of one or more network hops traversed by the first set of data packets; receiving, via the processor, a second set of data packets from the first computing device over a second period of time; determining, via the processor, whether the second set of data packets corresponds to the network hop model; adjusting, via the processor, one or more operations associated with transmitting a third set of data packets to the first computing device in response to determining that the second set of data packets does not match the network hop model, wherein the one or more operations comprise: generating an Internet Protocol (IP) tunnel configured to transmit the third set of data packets, sending the third set of data packets to the first computing device via the IP tunnel; generating a plurality of random pseudo bank data packets; sending the plurality of random pseudo bank data packets via one or more additional IP tunnels; and sending, via the processor, a notification to a second computing device associated with the user to authenticate the user in response to determining that the second set of data packets does not match the network hop model. ### Claim 2 (depends on 1) The method of claim 1, comprising restoring the one or more operations associated with one or more data transmissions to the first computing device in response to authenticating the user. ### Claim 3 (depends on 1) The method of claim 1, wherein the second computing device is different from the first computing device. ### Claim 4 (depends on 1) The method of claim 1, comprising halting one or more data transmissions to the first computing device in response to determining that the second set of data packets does not match the network hop model. ### Claim 5 (depends on 1) The method of claim 1, comprising throttling a data transmission rate of the third set of data packets being transmitted to the first computing device in response to determining that the second set of data packets does not match the network hop model. ### Claim 6 A non-transitory computer-readable medium comprising computer-executable instructions that, when executed by at least one processor, are configured to cause the at least one processor to perform operations comprising: receiving a first set of data packets from a first computing device associated with a user over a first period of time; generating a network hop model indicative of one or more network hops traversed by the first set of data packets; receiving a second set of data packets from the first computing device over a second period of time; determining whether the second set of data packets corresponds to the network hop model; adjusting one or more operations associated with transmitting a third set of data packets to the first computing device in response to determining that the second set of data packets does not match the network hop model, wherein the one or more operations comprises: generating an Internet Protocol (IP) tunnel configured to transmit the third set of data packet; sending the third set of data packets to the first computing device via the IP tunnel; generating a plurality of random pseudo bank data packets; sending the plurality of random pseudo bank data packets via one or more additional IP tunnels; and sending a push notification to a second computing device associated with the user to authenticate the user in response to determining that the second set of data packets does not match the network hop model. ### Claim 7 (depends on 6) The non-transitory computer-readable medium of claim 6, wherein the computer-executable instructions are further configured to cause the at least one processor to perform the operations comprising sending a notification to a second computing device associated with the user to authenticate the user in response to determining that the second set of data packets does not match the network hop model. ### Claim 8 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the computer-executable instructions are further configured to cause the at least one processor to perform the operations comprising: receiving location data associated with the second computing device; determining whether the location data corresponds to an expected location of the user; and resuming the one or more operations associated with transmitting a fourth set of data packets to the first computing device in response to determining that the location data corresponds to the expected location. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the second computing device comprises a wearable device or a mobile device. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the location data is determined based on an IP address associated with the second computing device. ### Claim 11 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the computer-executable instructions are further configured to cause the at least one processor to perform the operations comprising: receiving location data associated with the second computing device; determining whether the location data corresponds to an expected location of the user; and halting the one or more operations associated with transmitting a fourth set of data packets to the first computing device in response to determining that the location data does not correspond to the expected location. ### Claim 12 (depends on 6) The non-transitory computer-readable medium of claim 6, wherein the computer-executable instructions configured to cause the at least one processor to adjust one or more operations comprises transmitting the third set of data packets using layered encryptions, random network paths, or both. ### Claim 13 A system, comprising: a first computing device; a second computing device; and a server system configured to: receive a first set of data packets from the first computing device associated with a user over a first period of time; generating an Internet Protocol (IP) tunnel configured to transmit the first set of data packets: receive a second set of data packets from the first computing device over a second period of time; determine whether the second set of data packets corresponds to a network hop model; adjust one or more operations associated with transmitting a third set of data packets to the first computing device in response to determining that the second set of data packets does not match the network hop model, wherein the one or more operations comprise: generating an Internet Protocol (IP) tunnel configured to transmit the third set of data packet; sending the third set of data packets to the first computing device via the IP tunnel; generating a plurality of random pseudo bank data packets; sending the plurality of random pseudo bank data packets via one or more additional IP tunnels; and sending a notification to a second computing device associated with the user to authenticate the user in response to determining that the second set of data packets does not match the network hop model. ### Claim 14 (depends on 13) The system of claim 13, wherein the network hop model is generated based on network traffic data associated with the first computing device. ### Claim 15 (depends on 14) The system of claim 14, wherein the network hop model is generated by applying one or more machine learning algorithms to monitor the network traffic data and identifying one or more patterns in the network traffic data. ### Claim 16 (depends on 13) The system of claim 13, wherein the one or more operations are adjusted by: routing a first portion of the third set of data to the first computing device using a first route; and routing a second portion of the third set of data to the first computing device using a second route. ### Claim 17 (depends on 13) The system of claim 13, wherein the one or more operations are adjusted by: encrypting a first portion of the third set of data to the first computing device using a first encryption scheme; and encrypting a second portion of the third set of data to the first computing device using a second encryption scheme. ### Claim 18 (depends on 13) The system of claim 13, wherein the plurality of random pseudo bank data packets are used to detect a fraudulent activity associated with the first computing device.