# US 2021/0240837 A1 · Dynamic account risk assessment from heterogeneous events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240837 A1 - Document ID: US20210240837A1 - Status: Published application - Kind: A1 - Application number: 17/159,748 - Filed: 2021-01-27 - Published: 2021-08-05 - Earliest claimed: 2020-02-04 - Assignees: Pindrop Security, Inc. - Applicants: Pindrop Security, Inc. - Inventors: Hung Wei TSENG; Kailash PATIL - Web page: https://patentgrep.com/patent/US20210240837A1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 11/3082: {the data filtering being achieved by aggregating or compressing the monitored data} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06Q 10/0635: Risk analysis of enterprise or organisation activities - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 2201/835: Timestamp - G06F 2201/86: Event-based monitoring - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments described herein provide for performing a risk assessment. A computer identifies and stores heterogeneous events between a user and a provider system in which the user interacts with an account. The computer may store the heterogeneous events in a table. The stored event information normalizes the events associated with an account. The computer may determine static risk contributions associated with the event information of the account and store the static risk contributions in the table. The computer groups the static risk contributions into predetermined groups. The static risk contributions in each group are converted into dynamic risk contributions. The dynamic risk contributions of each group are aggregated, and the aggregate value of the dynamic risk contributions are fed to a machine learning model. The machine learning model determines a risk score associated with the account. ## Claims ### Claim 1 A computer-implemented method for account risk assessment, the method comprising: obtaining, by a computer, event data for one or more events to access a user account by one or more user devices via one or more channels, wherein the one or more channels include at least one telephony channel, the event data for each event including a set of risk contributions associated with communications from a user device via a channel of the one or more channels; applying, by the computer, a machine-learning model to the set of risk contributions associated with the one or more channels, the machine-learning model trained on a plurality of training account features corresponding to one or more training risk contributions for generating an account risk score; and generating, by the computer, the account risk score for the user account associated with the one or more events via the one or more channels based upon applying the machine-learning model to the set of risk contributions. ### Claim 2 (depends on 1) The method according to claim 1, further comprising grouping, by the computer, the set of risk contributions into one or more groups. ### Claim 3 (depends on 2) The method according to claim 2, further comprising aggregating, by the computer, the set of risk contributions of each of the one or more groups. ### Claim 4 (depends on 1) The method according to claim 1, further comprising, before applying the machine-learning model, converting, by the computer, each set of risk contributions based upon at least a timestamp associated with each event. ### Claim 5 (depends on 4) The method according to claim 4, wherein converting the set of risk contributions includes modifying, by the computer, the set of risk contributions according to a difference between a time of the event and a time that the computer converts the set of risk contributions. ### Claim 6 (depends on 1) The method according to claim 1, further comprising applying, by the computer, a forgetting factor to the set of risk contributions. ### Claim 7 (depends on 6) The method according to claim 6, wherein the forgetting factor is an exponential decay factor. ### Claim 8 (depends on 1) The method according to claim 1, further comprising: extracting, by the computer, a second set of risk contributions from the one or more events; and generating, by the computer, a second account risk score based upon applying the machine-learning model to the second set of risk contributions. ### Claim 9 (depends on 8) The method according to claim 8, further comprising: grouping, by the computer, the second set of risk contributions into one or more groups; and aggregating, by the computer, the set of risk contributions and the second set of risk contributions of each of the one or more groups. ### Claim 10 (depends on 8) The method according to claim 8, wherein converting the second set of risk contributions includes modifying the second set of risk contributions according to a second forgetting factor different than a forgetting factor modifying the set of risk contributions. ### Claim 11 A system comprising: a non-transitory storage medium configured to store computer program instructions; and a computing device comprising a processor that, when executing computer program instructions, is configured to: extract event data for one or more events to access a user account by one or more user devices via one or more channels, the event data for each event including a set of risk contributions associated with communications from a user device via a channel of the one or more channels, wherein the one or more channels include at least one telephony channel; apply a machine-learning model to the set of risk contributions, the machine-learning model trained on a plurality of training account features corresponding to one or more training risk contributions for generating an account risk score; and generate the account risk score for the user account associated with the one or more events via the one or more channels based upon applying the machine-learning model to the set of risk contributions. ### Claim 12 (depends on 11) The system according to claim 11, wherein the computer is further configured to group the set of risk contributions into one or more groups. ### Claim 13 (depends on 12) The system according to claim 12, wherein the computer is further configured to aggregate the set of risk contributions of each of the one or more groups. ### Claim 14 (depends on 11) The system according to claim 11, wherein the computer is further configured to, before applying the machine-learning model, convert each set of risk contributions based upon at least a timestamp associated with each event. ### Claim 15 (depends on 14) The system according to claim 14, wherein the computer converts according to a difference between a time of the event and a time that the computer converts the set of risk contributions. ### Claim 16 (depends on 14) The system according to claim 14, wherein the computer is further configured to apply a forgetting factor to the set of risk contributions. ### Claim 17 (depends on 16) The system according to claim 16, wherein the forgetting factor is an exponential decay factor. ### Claim 18 (depends on 11) The system according to claim 11, wherein the computer is further configured to: extract a second set of risk contributions from the one or more events; and generate a second account risk score based upon applying the machine-learning model to the second set of risk contributions. ### Claim 19 (depends on 18) The system according to claim 18, wherein the computer is further configured to: group the second set of risk contributions into one or more groups; and aggregate the set of risk contributions and the second set of risk contributions of each of the one or more groups. ### Claim 20 (depends on 18) The system according to claim 18, wherein the computer is further configured to modify the second set of risk contributions according to a second forgetting factor different than a forgetting factor modifying the set of risk contributions.