For early detection of a merchant data breach through machine-learning analysis

A system for early detection of and response to a merchant data breach through machine-learning analysis, the system comprising at least one server computer including at least one processor, the at least one server computer programmed and/or configured to:

• receive transaction authorization request data associated with a plurality of transaction authorization requests processed by a transaction service provider in an electronic payment processing network;
• receive fraudulent transaction data associated with at least one previously identified data-breach incident;
• receive clearing and settlement data associated with a plurality of transactions processed by the transaction service provider;
• receive fraud report data associated with prior fraud reported by financial device holders;
• receive merchant data for a plurality of merchants;
• generate at least one metric based on a percentage of security-testing transaction activity associated with a plurality of personal account numbers (PANs) that transacted with one or more merchants of the plurality of merchants;
• generate a plurality of features for training one or more machine-learning models, the plurality of features based on the transaction authorization request data, the fraudulent transaction data, the clearing and settlement data, the fraud report data, the merchant data, and the at least one metric;
• generate a first model input dataset based on the plurality of features and associated with the plurality of merchants;
• generate a second model input dataset based on the plurality of features and associated with at least one previously breached merchant of the plurality of merchants;
• train a first machine-learning prediction model of an ensembled model and a second machine-learning prediction model of the ensembled model to associate merchants with a likelihood of data breach, the first machine-learning prediction model comprising a neural network machine-learning model, and the second machine-learning prediction model comprising a gradient boosted decision tree model, wherein, when training the first machine-learning prediction model and the second machine-learning prediction model, the at least one server computer is programmed and/or configured to:
• compare the first model input dataset to the second model input dataset;
• determine at least one difference between at least one feature of the first model input dataset and at least one feature of the second model input dataset based on the comparing of the first model input dataset to the second model input dataset;
• and
• train the first machine-learning prediction model and the second machine-learning prediction model to associate merchants with a likelihood of data breach based on the at least one difference;
• determine, based at least partly on the transaction authorization request data and at least partly on an output of the ensembled model, at least one breached merchant, wherein, when determining the at least one breached merchant, the at least one server computer is programmed and/or configured to:
• combine a first output of the first machine-learning prediction model and a second output of the second machine-learning prediction model to produce an ensembled score;
• compare the ensembled score to a threshold;
• and
• in response to the ensembled score satisfying the threshold, determining that the at least one breached merchant experienced a data breach;
• in response to determining the at least one breached merchant:
• automatically freeze at least one transaction in the electronic payment processing network;
• and
• automatically deactivate at least one portable financial device used for at least one prior transaction with the at least one breached merchant, wherein, when deactivating the at least one portable financial device, the at least one server computer is programmed and/or configured to suspend the at least one portable financial device from completing future transactions associated with future transaction authorization requests in the electronic payment processing network;
• retrain the first machine-learning prediction model and the second machine-learning prediction model based on transaction data associated with the at least one breached merchant that was determined based on the ensembled model, to produce an updated first machine-learning prediction model and an updated second machine-learning prediction model;
• and
• determine at least one other breached merchant based on the updated first machine-learning prediction model and the updated second machine-learning prediction model.

A computer program product for early detection of and response to a merchant data breach through machine-learning analysis, the computer program product comprising at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to:

• receive transaction authorization request data associated with a plurality of transaction authorization requests processed by a transaction service provider in an electronic payment processing network;
• receive fraudulent transaction data associated with at least one previously identified data-breach incident;
• receive clearing and settlement data associated with a plurality of transactions processed by the transaction service provider;
• receive fraud report data associated with prior fraud reported by financial device holders;
• receive merchant data for a plurality of merchants;
• generate at least one metric based on a percentage of security-testing transaction activity associated with a plurality of personal account numbers (PANs) that transacted with one or more merchants of the plurality of merchants;
• generate a plurality of features for training one or more machine-learning models, the plurality of features based on the transaction authorization request data, the fraudulent transaction data, the clearing and settlement data, the fraud report data, the merchant data, and the at least one metric;
• generate a first model input dataset based on the plurality of features and associated with the plurality of merchants;
• generate a second model input dataset based on the plurality of features and associated with at least one previously breached merchant of the plurality of merchants;
• train a first machine-learning prediction model of an ensembled model and a second machine-learning prediction model of the ensembled model to associate merchants with a likelihood of data breach, the first machine-learning prediction model comprising a neural network machine-learning model, and the second machine-learning prediction model comprising a gradient boosted decision tree model, wherein the program instructions that cause the at least one processor to train the first machine-learning prediction model and the second machine-learning prediction model cause the at least one processor to:
• compare the first model input dataset to the second model input dataset;
• determine at least one difference between at least one feature of the first model input dataset and at least one feature of the second model input dataset based on the comparing of the first model input dataset to the second model input dataset;
• and
• train the first machine-learning prediction model and the second machine-learning prediction model to associate merchants with a likelihood of data breach based on the at least one difference;
• determine, based at least partly on the transaction authorization request data and at least partly on an output of the ensembled model, at least one breached merchant, wherein the program instructions that cause the at least one processor to determine the at least one breached merchant cause the at least one processor to:
• combine a first output of the first machine-learning prediction model and a second output of the second machine-learning prediction model to produce an ensembled score;
• compare the ensembled score to a threshold;
• and
• in response to the ensembled score satisfying the threshold, determining that the at least one breached merchant experienced a data breach;
• in response to determining the at least one breached merchant:
• automatically freeze at least one transaction in the electronic payment processing network;
• and
• automatically deactivate at least one portable financial device used for at least one prior transaction with the at least one breached merchant, wherein the program instructions that cause the at least one processor to deactivate the at least one portable financial device cause the at least one processor to suspend the at least one portable financial device from completing future transactions associated with future transaction authorization requests in the electronic payment processing network;
• retrain the first machine-learning prediction model and the second machine-learning prediction model based on transaction data associated with the at least one breached merchant that was determined based on the ensembled model, to produce an updated first machine-learning prediction model and an updated second machine-learning prediction model;
• and
• determine at least one other breached merchant based on the updated first machine-learning prediction model and the updated second machine-learning prediction model.