# US 2020/0396239 A1 · Security Risk Evaluation for User Accounts > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396239 A1 - Document ID: US20200396239A1 - Status: Published application - Kind: A1 - Application number: 16/438,756 - Filed: 2019-06-12 - Published: 2020-12-17 - Earliest claimed: 2019-06-12 - Assignees: Paypal, Inc. - Applicants: PayPal, Inc. - Inventors: George Chen Kaidi - Web page: https://patentgrep.com/patent/US20200396239A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/102: {Entity profiles} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are disclosed relating to account security operations based on security risk values that are modified based on one or more security risk criteria. In some embodiments, a system stores a plurality of key-value pairs in a datastore. Each key may specify a set of multiple access attributes corresponding to an origin computing system from which one or more access attempts were initiated and each value may include access information for one or more access attempts whose access attributes match a corresponding key. In some embodiments, the access information includes one or more account identifiers and result indications. In some embodiments, the system modifies security risk values based on multiple security risk criteria associated with different granularities of information in the datastore. A first criterion may be evaluated at a key granularity based on access attempts that match all of the multiple access attributes for a key. A second criterion may be evaluated at an account granularity based on the access attempts to the account. ## Claims ### Claim 1 A method, comprising: storing, by a computer system, for a user account, a security risk value; processing, by the computer system, multiple access attempts for multiple user accounts; storing in a datastore, by the computer system, a plurality of key-value pairs: wherein each key specifies a set of multiple access attributes corresponding to an origin computing system from which one or more access attempts were initiated; wherein each value includes access information for one or more access attempts whose access attributes match a corresponding key, wherein the access information includes one or more account identifiers for the one or more access attempts and result indications for the one or more access attempts; modifying, by the computer system, the security risk value for the account based on multiple security risk criteria associated with different granularities of information in the datastore, including: a first criterion that is evaluated at a key granularity based on access attempts that match all of the multiple access attributes for a key; and a second criterion that is evaluated at an account granularity for the account based on access attempts to the account; and performing one or more account security operations based on the modified security risk value. ### Claim 2 (depends on 1) The method of claim 1, wherein the first criterion specifies a threshold number of different accounts accessed with access attributes corresponding to the same key. ### Claim 3 (depends on 1) The method of claim 1, wherein the second criterion specifies a threshold amount of time between access attempts for a given account. ### Claim 4 (depends on 1) The method of claim 1, wherein the second criterion specifies a threshold number of failed access attempts for a given account. ### Claim 5 (depends on 1) The method of claim 1, wherein the multiple security risk criteria further include: a third criterion that is evaluated at a sub-key granularity based on access attempts that match only a subset of the set of multiple access attributes for a key. ### Claim 6 (depends on 5) The method of claim 5, wherein the third criterion specifies a threshold number of different accounts having access attempts matching a particular subset of the set of multiple access attributes. ### Claim 7 (depends on 1) The method of claim 1, wherein the multiple access attributes include: an interne protocol (IP) address, a hardware device signature, a browser user agent, cookie data, a referral entity, and a web endpoint used for an access attempt. ### Claim 8 (depends on 1) The method of claim 1, wherein the access information further includes one or more of: information indicating an access attempt time or information indicating a number of access attempts. ### Claim 9 A non-transitory computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising: storing for a user account, a security risk value; processing multiple access attempts for multiple user accounts; storing in a datastore a plurality of key-value pairs: wherein each key specifies a set of multiple access attributes corresponding to an origin computing system from which one or more access attempts were initiated; wherein each value includes access information for one or more access attempts whose access attributes match a corresponding key, wherein the access information includes one or more account identifiers for the one or more access attempts and result indications for the one or more access attempts; modifying the security risk value for the account based on multiple security risk criteria associated with different granularities of information in the datastore, including: a first criterion that is evaluated at a key granularity based on access attempts that match all of the multiple access attributes for a key; and a second criterion that is evaluated at an account granularity for the account based on access attempts to the account; and performing one or more account security operations based on the modified security risk value. ### Claim 10 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the first criterion specifies a threshold number of failed access attempts for a given key. ### Claim 11 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the first criterion specifies a threshold number of different accounts accessed with access attributes corresponding to the same key. ### Claim 12 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the first criterion specifies a number of access attempts, whose account identifiers meet a threshold similarity, that occur within a time interval and have access attributes that correspond to the same key. ### Claim 13 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the first criterion specifies a threshold number of access attempts that use invalid account identifiers and have access attributes that correspond to the same key. ### Claim 14 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the multiple security risk criteria further include: a third criterion that is evaluated at a sub-key granularity based on access attempts that match only a subset of the set of multiple access attributes for a key. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the third criterion specifies a threshold number of accounts having access attempts with access attributes that match a subset of the set of multiple access attributes, wherein the subset has not been used for access attempts within a threshold time interval. ### Claim 16 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the multiple access attributes include: an internet protocol (IP) address, a hardware device signature, a browser user agent, cookie data, a referral entity, and a web endpoint used for an access attempt. ### Claim 17 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the access information further includes one or more of: information indicating an access attempt time or information indicating a number of access attempts. ### Claim 18 An apparatus, comprising: one or more processors; and one or more storage elements having program instructions stored thereon that are executable by the one or more processors to: store for a user account, a security risk value; process multiple access attempts for multiple user accounts; store in a datastore a plurality of key-value pairs: wherein each key specifies a set of multiple access attributes corresponding to an origin computing system from which one or more access attempts were initiated; wherein each value includes access information for one or more access attempts whose access attributes match a corresponding key, wherein the access information includes one or more account identifiers for the one or more access attempts and result indications for the one or more access attempts; modify the security risk value for the account based on multiple security risk criteria associated with different granularities of information in the datastore, including: a first criterion that is evaluated at a key granularity based on access attempts that match all of the multiple access attributes for a key; and a second criterion that is evaluated at an account granularity for the account based on access attempts to the account; and perform one or more account security operations based on the modified security risk value. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the first criterion specifies a threshold number of different accounts accessed within a threshold time interval with access attributes corresponding to the same key. ### Claim 20 (depends on 18) The apparatus of claim 18, wherein the first criterion specifies a threshold number of failed access attempts within a threshold time interval with access attributes corresponding to the same key.