# US 12,184,508 B2 · Detection of operational threats using artificial intelligence

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,184,508 B2
- Document ID: US12184508B2
- Status: Granted
- Kind: B2
- Application number: 16/948,525
- Filed: 2020-09-22
- Published: 2022-03-24
- Granted: 2024-12-31
- Earliest claimed: 2018-02-07
- Assignees: 4L Data Intelligence, Inc.
- Applicants: 4L Data Intelligence, Inc.
- Inventors: Theja Birur
- Web page: https://patentgrep.com/patent/US12184508B2

## CPC

- H04L 41/16: using machine learning or artificial intelligence
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- G06N 3/0895: Weakly supervised learning, e.g. semi-supervised or self-supervised learning
- G06N 3/09: Supervised learning
- H04L 41/06: Management of faults, events, alarms or notifications
- H04L 45/08: {Learning-based routing, e.g. using neural networks or artificial intelligence}
- H04L 45/123: {Evaluation of link metrics (techniques for monitoring network metrics H04L43/08)}
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 67/63: Routing a service request depending on the request content or context
- G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)}
- G06N 3/044: Recurrent networks, e.g. Hopfield networks
- G06N 20/00: Machine learning
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- H04L 63/102: {Entity profiles}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A set of resource requests that each includes authorization-supporting data for receiving a requested resource can be received. For each request, augmenting data associated with part of the data is retrieved, and it is determined whether access is authorized based on the augmenting data and the authorization-supporting data. A machine-learning model is trained using representations of the set of resource requests and the authorization determinations. Additional requests are processed by the trained model to generate corresponding authorization outputs. One or more identifiers to flag for inhibition of resource access are determined based on the authorization outputs. Upon detecting that a new resource request to access a particular resource includes an identifier of the one or more identifiers, a new authorization output is generated to inhibit access to the particular resource.

## Claims

### Claim 1

A system comprising:
one or more data processors; and
a non-transitory computer readable storage medium containing instructions which, when executed on the one or more data processors, cause the one or more data processors to perform actions including:
detecting receipt of each of a set of resource requests, wherein each resource request of the set of resource requests was received from a user device and includes:
an identification of a requested resource, the requested resource being a particular amount of payment from an insurance provider for one or more medical-service events; and
authorization-supporting data for receiving the requested resource, wherein the authorization-supporting data includes one or more characterizing parameters that characterize the one or more medical-service events;
identifying, for each of at least some resource requests, a plurality of medical-provider entities that are associated with the one or more medical-service events by performing a database look-up using a particular characterizing parameter of the one or more characterizing parameters included in a resource request to determine whether the resource request is preceded by another resource request associated with a different entity of the plurality of entities;
generating, for each of the at least some resource requests, an object for each medical-provider entity of the plurality of medical-provider entities within a directed graph and directed links connecting the objects;
determining, for each object of the directed graph, a link prevalence based on the directed links that are associated with the object and that were generated within a predefined time interval;
generating, for each object of the directed graph and based on the link prevalence, an augmenting value that represents an estimated probability that a resource request that identifies the medical-provider entity of the object accords with resource-access rules;
receiving a new resource request after the set of resource requests, the new resource request including:
an identification of a newly requested resource, the newly requested resource being another particular amount of payment from the insurance provider for one or more recent medical-service events; and
new authorization-supporting data for receiving the newly requested resource, wherein the authorization-supporting data includes one or more new characterizing parameters that characterize the one or more recent medical-service events;
detecting, from the new resource request, a set of medical-provider entities associated with the one or more recent medical-service events;
identifying a set of objects from the directed graph that correspond to the set of medical-provider entities;
retrieving, for each object of the set of objects, the augmenting value; and
generating a new authorization output based on the augmenting values of the set of objects, wherein the new authorization output includes generating and transmitting an instruction to avail at least some part of the requested resource, triggering transmission of at least some part of the requested resource, queuing the resource request for an agent review, generating and transmitting a response communication that identifies an extent to which access to the requested resource is approved and updating a data record associated with the resource request to include the new authorization output.

### Claim 2 (depends on 1)

The system of claim 1, wherein identifying, for each of at least some resource requests, the two or more medical-provider entities that are associated with the one or more medical-service events includes:
identifying a medical-provider first entity of the two or more medical-provider entities that referred a subject to a second medical-provider entity of the two or more medical-provider entities.

### Claim 3 (depends on 1)

The system of claim 1, wherein identifying, for each of at least some resource requests, the two or more medical-provider entities that are associated with the one or more medical-service events includes:
identifying a first medical-provider entity of the two or more medical-provider entities that corresponds to the resource request; and
determining that a characterizing parameter of the resource request is related to a preceding resource request; and
identifying a second medical-provider entity of the two or more medical-provider entities that corresponds to the preceding resource request.

### Claim 4 (depends on 1)

The system of claim 1, wherein the directed links identifies a type of relationship between two objects.

### Claim 5 (depends on 1)

The system of claim 1, wherein detecting each medical-provider entity associated with the one or more recent medical-service events includes:
generating a set of related resource requests by executing a lookup using at least one of the one or more new characterizing parameters; and
identifying each medical-provider entity associated with the set of related resource requests.

### Claim 6 (depends on 1)

The system of claim 1, wherein determining, for each object of the directed graph, the link prevalence based on the directed links associated with the object that were generated within a predefined time interval includes:
identifying a quantity of links associated with the object that were generated with the predefined time interval.

### Claim 7 (depends on 1)

The system of claim 1, wherein determining, for each object of the directed graph, the link prevalence based on the directed links associated with the object that were generated within a predefined time interval includes:
determining a fraction of resource requests of the set of resource requests that identified a medical-provider entity corresponding to the object.

### Claim 8 (depends on 1)

The system of claim 1, wherein the directed graph segments objects that represent entities with a same geographical area from other objects.

### Claim 9

A computer-implemented method comprising:
detecting receipt of each of a set of resource requests, wherein each resource request of the set of resource requests was received from a user device and includes:
an identification of a requested resource, the requested resource being a particular amount of payment from an insurance provider for one or more medical-service events; and
authorization-supporting data for receiving the requested resource, wherein the authorization-supporting data includes one or more characterizing parameters that characterize the one or more medical-service events;
identifying, for each of at least some resource requests, a plurality of medical-provider entities that are associated with the one or more medical-service events by performing a database look-up using a particular characterizing parameter of the one or more characterizing parameters included in a resource request to determine whether the resource request is preceded by another resource request associated with a different entity of the plurality of entities;
generating, for each of the at least some resource requests, an object for each medical-provider entity of the plurality of medical-provider entities within a directed graph and directed links connecting the objects;
determining, for each object of the directed graph, a link prevalence based on the directed links that are associated with the object and that were generated within a predefined time interval;
generating, for each object of the directed graph and based on a machine-learning model that uses the link prevalence, an augmenting value that represents an estimated probability that the resource request that identifies the medical-provider entity of the object accords with resource-access rules;
receiving a new resource request after the set of resource requests, the new resource request including:
an identification of a newly requested resource, the newly requested resource being another particular amount of payment from the insurance provider for one or more recent medical-service events; and
new authorization-supporting data for receiving the newly requested resource, wherein the authorization-supporting data includes one or more new characterizing parameters that characterize the one or more recent medical-service events;
detecting, from the new resource request, a set of medical-provider entities associated with the one or more recent medical-service events;
identifying a set of objects from the directed graph that correspond to the set of medical-provider entities;
retrieving, for each object of the set of objects, the augmenting value; and
generating a new authorization output based on the augmenting values of the set of objects, wherein the new authorization output includes generating and transmitting an instruction to avail at least some part of the requested resource, triggering transmission of at least some part of the requested resource, queuing the resource request for an agent review, generating and transmitting a response communication that identifies an extent to which access to the requested resource is approved and updating a data record associated with the resource request to include the new authorization output.

### Claim 10 (depends on 9)

The computer-implemented method of claim 9, wherein identifying, for each of at least some resource requests, the two or more medical-provider entities that are associated with the one or more medical-service events includes:
identifying a first medical-provider entity of the two or more medical-provider entities that referred a subject to a second medical-provider entity of the two or more medical-provider entities.

### Claim 11 (depends on 9)

The computer-implemented method of claim 9, wherein identifying, for each of at least some resource requests, the two or more medical-provider entities that are associated with the one or more medical-service events includes:
identifying a first medical-provider entity of the two or more medical-provider entities that corresponds to the resource request; and
determining that a characterizing parameter of the resource request is related to a preceding resource request; and
identifying a second medical-provider entity of the two or more medical-provider entities that corresponds to the preceding resource request.

### Claim 12 (depends on 9)

The computer-implemented method of claim 9, wherein the directed links identifies a type of relationship between two objects.

### Claim 13 (depends on 9)

The computer-implemented method of claim 9, wherein detecting each medical-provider associated with the one or more recent medical-service events includes:
generating a set of related resource requests by executing a lookup using at least one of the one or more new characterizing parameters; and
identifying each medical-provider entity associated with the set of related resource requests.

### Claim 14 (depends on 9)

The computer-implemented method of claim 9, wherein determining, for each object of the directed graph, the link prevalence based on the directed links associated with the object that were generated within a predefined time interval includes:
identifying a quantity of links associated with the object that were generated with the predefined time interval.

### Claim 15 (depends on 9)

The computer-implemented method of claim 9, wherein determining, for each object of the directed graph, the link prevalence based on the directed links associated with the object that were generated within a predefined time interval includes:
determining a fraction of resource requests of the set of resource requests that identified a medical-provider entity corresponding to the object.

### Claim 16

A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause one or more data processors to perform actions including:
detecting receipt of each of a set of resource requests, wherein each resource request of the set of resource requests was received from a user device and includes:
an identification of a requested resource, the requested resource being a particular amount of payment from an insurance provider for one or more medical-service events; and
authorization-supporting data for receiving the requested resource, wherein the authorization-supporting data includes one or more characterizing parameters that characterize the one or more medical-service events;
identifying, for each of at least some resource requests, a plurality of medical-provider entities that are associated with the one or more medical-service events by performing a database look-up using a particular characterizing parameter of the one or more characterizing parameters included in a resource request to determine whether the resource request is preceded by another resource request associated with a different entity of the plurality of entities;
generating, for each of the at least some resource requests, an object for each medical-provider entity of the plurality of medical-provider entities within a directed graph and directed links connecting the objects;
determining, for each object of the directed graph, a link prevalence based on the directed links that are associated with the object and that were generated within a predefined time interval;
generating, for each object of the directed graph and based on a machine-learning model that uses the link prevalence, an augmenting value that represents an estimated probability that the resource request that identifies the medical-provider entity of the object accords with resource-access rules;
receiving a new resource request after the set of resource requests, the new resource request including:
an identification of a newly requested resource, the newly requested resource being another particular amount of payment from the insurance provider for one or more recent events; and
new authorization-supporting data for receiving the newly requested resource, wherein the authorization-supporting data includes one or more new characterizing parameters that characterize the one or more recent medical-service events;
detecting, from the new resource request, a set of medical-provider entities associated with the one or more recent medical-service events;
identifying a set of objects from the directed graph that correspond to the set of medical-provider entities;
retrieving, for each object of the set of objects, the augmenting value; and
generating a new authorization output based on the augmenting values of the set of objects, wherein the new authorization output includes generating and transmitting an instruction to avail at least some part of the requested resource, triggering transmission of at least some part of the requested resource, queuing the resource request for an agent review, generating and transmitting a response communication that identifies an extent to which access to the requested resource is approved and updating a data record associated with the resource request to include the new authorization output.

### Claim 17 (depends on 16)

The computer-program product of claim 16, wherein identifying, for each of at least some resource requests, the two or more medical-provider entities that are associated with the one or more medical-service events includes:
identifying a first medical-provider entity of the two or more medical-provider entities that referred a subject to a second medical-provider entity of the two or more medical-provider entities.

### Claim 18 (depends on 16)

The computer-program product of claim 16, wherein identifying, for each of at least some resource requests, the two or more medical-provider entities that are associated with the one or more medical-service events includes:
identifying a first medical-provider entity of the two or more medical-provider entities that corresponds to the resource request; and
determining that a characterizing parameter of the resource request is related to a preceding resource request; and
identifying a second medical-provider entity of the two or more medical-provider entities that corresponds to the preceding resource request.

### Claim 19 (depends on 16)

The computer-program product of claim 16, wherein the directed links identifies a type of relationship between two objects.

### Claim 20 (depends on 16)

The computer-program product of claim 16, wherein detecting each medical-provider entity associated with the one or more recent medical-service events includes:
generating a set of related resource requests by executing a lookup using at least one of the one or more new characterizing parameters; and
identifying each medical-provider entity associated with the set of related resource requests.