# US 12,603,899 B2 · Device analytics engine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,899 B2 - Document ID: US12603899B2 - Status: Granted - Kind: B2 - Application number: 18/427,574 - Filed: 2024-01-30 - Published: 2024-08-22 - Granted: 2026-04-14 - Earliest claimed: 2020-12-17 - Assignees: Paypal, Inc. - Applicants: PayPal, Inc. - Inventors: Anupam Tarsauliya; Ravi Shanker Sandepudi; Yugal Sharma; Sai Krishna Pinna - Web page: https://patentgrep.com/patent/US12603899B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 8/31: {Programming languages or programming paradigms} - G06F 16/24558: {Binary matching operations} - G06F 21/44: Program or device authentication - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/73: by creating or determining hardware identification, e.g. serial numbers - G06F 2221/034: Test or assess a computer or a system - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and computer program products for identifying a fraudulent device. A device analytics engine receives device data from a computing device, the device data including parameters associated with the computing device. The device analytics engine selects a set of rules in a plurality of rules that indicate at least one parameter in the plurality of parameters in the device data for determining a device identifier. The set of rules are evaluated in order until the device identifier is determined from the at least one parameter indicated in the set of rules, the device data, and previously stored data from multiple computing devices. A score is generated for the computing device using one or more of the device identifier, device data, a set of rules, and previously receive device data that corresponds to the device identifier. A computing device is identified as a fraudulent computing device based on the score. ## Claims ### Claim 1 A system comprising: a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising: determining a device identifier for a computing device from device data and a set of rules by executing logic in the set of rules in a sequence until the device identifier is determined or all rules in the set of rules are executed, wherein the logic compares at least one parameter in the device data and at least one parameter in a previously received data wherein a first rule in the set of rules includes first logic for determining the device identifier using a user cookie parameter in the device data and a second rule in the set of rules includes second logic for determining the device identifier using a software development kit (SDK) parameter; determining a score for the computing device using one or more of the device identifier, the device data, and the previously received data; and determining whether the computing device is a fraudulent computing device based on the score. ### Claim 2 (depends on 1) The system of claim 1, wherein to determine the score, the operations further comprise: determining a plurality of scores by comparing one or more parameters in the device data to one or more parameters in the previously received data associated with the device identifier; and combining the plurality of scores into the score for the computing device. ### Claim 3 (depends on 1) The system of claim 1, wherein to determine the score the operations further comprise: determining a plurality of scoring rules; determining a plurality of scores from one or more parameters in the device data specified in the plurality of scoring rules, wherein the plurality of scores correspond to values of the parameters in the device data; and combining the plurality of scores into the score for the computing device. ### Claim 4 (depends on 3) The system of claim 3, wherein the plurality of scoring rules are associated with a plurality of weights, one weight for one rule; and wherein determining the plurality of scores is further based on the plurality of weights corresponding to the plurality of scoring rules. ### Claim 5 (depends on 1) The system of claim 1, wherein to determine the device identifier, the operations further comprise: generating the device identifier from a subset of parameters in the device data of the computing device when all the rules in the set of rules are executed without determining the device identifier. ### Claim 6 (depends on 1) The system of claim 1, wherein a rule in the set of rules includes logic for determining the device identifier using an SDK parameter and a subset of rules corresponding to a type of an SDK, wherein the subset of rules is different for different types of SDKs. ### Claim 7 (depends on 6) The system of claim 6, wherein the subset of rules include logic for identifying parameters from the device data, wherein the parameters comprise a local Internet Protocol parameter, a public Internet Protocol parameter, and one or more of a kernel architecture parameter, an operating system parameter, a browser platform parameter and a computing device model parameter; and further comprising combining the identified parameters; and generating a hash of the combined parameters, wherein the hash is the device identifier. ### Claim 8 A method, comprising: determining a software development kit (SDK) parameter from device data associated with a computing device; selecting, using the SDK parameter, a set of rules from a plurality of rules; determining a device identifier using the set of rules by executing logic in the set of rules in a sequence on the device data and previously received data until the device identifier is determined wherein a first rule in the set of rules includes first logic for determining the device identifier using a user cookie parameter in the device data and a second rule in the set of rules includes second logic for determining the device identifier using the SDK parameter; determining a score for the computing device associated with the device identifier using the device data and a previously received data; and determining whether the computing device is a fraudulent computing device based on the score. ### Claim 9 (depends on 8) The method of claim 8, wherein determining the score, further comprises: determining a plurality of scores by comparing parameters in the device data to parameters in the previously received data associated with the device identifier; and combining the plurality of scores into the score for the computing device. ### Claim 10 (depends on 8) The method of claim 8, wherein determining the score, further comprises: determining a plurality of scoring rules; determining a plurality of scores from parameters in the device data specified in the plurality of scoring rules and a plurality of weights associated with the parameters; and combining the plurality of scores into the score for the computing device. ### Claim 11 (depends on 8) The method of claim 8, wherein determining the device identifier, further comprises: generating the device identifier from at least one parameter in the device data of the computing device when all rules in the set of rules are executed. ### Claim 12 (depends on 8) The method of claim 8, wherein the set of rules is different for different types of SDKs specified in the SDK parameter. ### Claim 13 (depends on 8) The method of claim 8, wherein determining the device identifier from the device data further comprises: retrieving one or more parameters from the device data by executing the logic specified in the set of rules; combining the retrieved one or more parameters; generating a hash of the one or more parameters; and selecting the device identifier that matches the generated hash. ### Claim 14 (depends on 8) The method of claim 8, wherein determining the device identifier from the device data further comprises: determining that the device identifier was not determined using the set of rules; selecting, using the SDK parameter, a second set of rules from the plurality of rules; and determining the device identifier by executing second logic in the second set of rules. ### Claim 15 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations for determining whether a computing device is engaging in a fraudulent transaction, the operations comprising: selecting multiple sets of rules using a parameter in device data associated with the computing device; determining a device identifier from the device data and sets of rules by executing logic in the sets of rules in a sequence until the device identifier is determined using one of the sets of rules wherein a first rule in the set of rules includes first logic for determining the device identifier using a user cookie parameter in the device data and a second rule in the set of rules includes second logic for determining the device identifier using a software development kit (SDK) parameter; determining a score for the computing device using one or more of the device identifier, the device data, and previously received data; and determining whether the computing device is a fraudulent computing device based on the score. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein to determine the score, the operations further comprise: determining a plurality of scoring rules; determining a plurality of scores from parameters in the device data specified in the plurality of scoring rules; and combining the plurality of scores into the score for the computing device. ### Claim 17 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the parameter corresponds to a software development kit (SDK) parameter, and the sets of rules correspond to a type of and SDK associated with the SDK parameter. ### Claim 18 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the sets of rules include logic that compares one or more of a session identifier parameter, geographic location parameter, and a user identifier parameter in the device data with a session identifier parameter, a geographic location parameter, and a user identifier parameter in previously stored device data. ### Claim 19 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the sets of rules include logic that compares one or more of an international mobile equipment identifier (IMEI) parameter, a computing device type identifier parameter, and a media access control (MAC) in the device data with an IMEI parameter, a computing device type identifier parameter, and a MAC in previously stored device data.