# US 2021/0243215 A1 · Fraud detection based on analysis of frequency-domain data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243215 A1 - Document ID: US20210243215A1 - Status: Published application - Kind: A1 - Application number: 17/215,610 - Filed: 2021-03-29 - Published: 2021-08-05 - Earliest claimed: 2018-07-02 - Assignees: Paypal, Inc. - Applicants: Paypal, Inc. - Inventors: Zhen Xie; Kasra Vakilinia; Yang Chen; Hagar Oppenheim; Xing Ji - Web page: https://patentgrep.com/patent/US20210243215A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F 16/2228: {Indexing structures} - G06F 16/258: {Data format conversion from or to a database} - G06Q 20/12: specially adapted for electronic shopping systems - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - H04W 12/61: Time-dependent - H04W 12/63: Location-dependent; Proximity-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A risk analysis system configures the decision engine to detect anomalous online activities by analyzing usage patterns associated with one or more user accounts across multiple frequencies. The risk analysis system obtains transaction log data representing transactions associated with one or more accounts, and extracts data from the transaction log data to generate time-series data along a time dimension. The time-series data may represent usage characteristics of one or more user accounts over a period of time. The risk analysis system derives pattern data representing usage patterns across multiple different frequencies based on the time-series data. The risk analysis system then configures the decision engine to detect anomalous account activities based on the derived pattern data. ## Claims ### Claim 1 (canceled) ### Claim 2 A system, comprising: one or more processors, one or more computer-readable memories, with program instructions stored on the one or more computer-readable memories, the one or more processors configured to execute the program instructions to cause the system to perform operations comprising: generating a first account data corresponding to a user account, wherein the first account data is a time series data, and wherein the first account data corresponds to a first account attribute; deriving a second set of account data from the first account data, wherein the second set of account data corresponds to a plurality of account usage frequencies; determining a plurality of pattern strength values corresponding to the plurality of account usage frequencies, wherein the plurality of pattern strength values indicate a strength of a corresponding pattern, and wherein each of the plurality of pattern strength values corresponds to an account usage frequency of the plurality of account usage frequencies; and using the determined plurality of pattern strength values to configure a decision engine to output a likelihood of anomalous activity associated with the user account. ### Claim 3 (depends on 2) The system of claim 2, the operations further comprising: grouping a first portion of the plurality of pattern strength values that correspond to a first account usage frequency range; grouping a second portion of the plurality of pattern strength values that correspond to a second account usage frequency range; determining a first pattern index based on the first portion of the plurality of pattern strength values, and determining a second pattern index based on the second portion of the plurality of pattern strength values; and wherein the first pattern index and the second pattern index are used to configure the decision engine. ### Claim 4 (depends on 3) The system of claim 3, wherein the first pattern index is a pattern strength value that corresponds to a set of account usage frequencies within the first account usage frequency range. ### Claim 5 (depends on 2) The system of claim 2, the operations further comprising: in response to receiving an output from the decision engine corresponding to the likelihood of anomalous activity associated with the user account, modifying the user account based on the output. ### Claim 6 (depends on 5) The system of claim 5, wherein the modifying the user account based on the output includes adjusting a security level associated with the user account. ### Claim 7 (depends on 5) The system of claim 5, wherein the modifying the user account based on the output includes implementing an additional authentication requirement for access to the user account. ### Claim 8 (depends on 2) The system of claim 2, wherein the using the determined plurality of pattern strength values to configure the decision engine is performed in response to a transaction request, and wherein an approval of the transaction request is based on an output of the decision engine. ### Claim 9 A method comprising: generating a first account data corresponding to a user account, wherein the first account data is a time series data, and wherein the first account data corresponds to a first account attribute; deriving a second set of account data from the first account data, wherein the second set of account data corresponds to a plurality of account usage frequencies; determining a plurality of pattern strength values corresponding to the plurality of account usage frequencies, wherein the plurality of pattern strength values indicate a strength of a corresponding pattern, and wherein each of the plurality of pattern strength values corresponds to an account usage frequency of the plurality of account usage frequencies; and using the determined plurality of pattern strength values to configure a decision engine to output a likelihood of anomalous activity associated with the user account. ### Claim 10 (depends on 9) The method of claim 9, further comprising: grouping a first portion of the plurality of pattern strength values that correspond to a first account usage frequency range; grouping a second portion of the plurality of pattern strength values that correspond to a second account usage frequency range; determining a first pattern index based on the first portion of the plurality of pattern strength values, and determining a second pattern index based on the second portion of the plurality of pattern strength values; and wherein the first pattern index and the second pattern index are used to configure the decision engine. ### Claim 11 (depends on 10) The method of claim 10, wherein the first pattern index is a pattern strength value that corresponds to a set of account usage frequencies within the first account usage frequency range. ### Claim 12 (depends on 9) The method of claim 9, further comprising: in response to receiving an output from the decision engine corresponding to the likelihood of anomalous activity associated with the user account, modifying the user account based on the output. ### Claim 13 (depends on 12) The method of claim 12, wherein the modifying the user account based on the output includes adjusting a security level associated with the user account. ### Claim 14 (depends on 12) The method of claim 12, wherein the modifying the user account based on the output includes implementing an additional authentication requirement for access to the user account. ### Claim 15 (depends on 9) The method of claim 9, wherein the using the determined plurality of pattern strength values to configure the decision engine is performed in response to a transaction request, and wherein an approval of the transaction request is based on an output of the decision engine. ### Claim 16 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: generating a first account data corresponding to a user account, wherein the first account data is a time series data, and wherein the first account data corresponds to a first account attribute; deriving a second set of account data from the first account data, wherein the second set of account data corresponds to a plurality of account usage frequencies; determining a plurality of pattern strength values corresponding to the plurality of account usage frequencies, wherein the plurality of pattern strength values indicate a strength of a corresponding pattern, and wherein each of the plurality of pattern strength values corresponds to an account usage frequency of the plurality of account usage frequencies; and using the determined plurality of pattern strength values to configure a decision engine to output a likelihood of anomalous activity associated with the user account. ### Claim 17 (depends on 16) The non-transitory machine-readable medium of claim 16, the operations further comprising: grouping a first portion of the plurality of pattern strength values that correspond to a first account usage frequency range; grouping a second portion of the plurality of pattern strength values that correspond to a second account usage frequency range; determining a first pattern index based on the first portion of the plurality of pattern strength values, and determining a second pattern index based on the second portion of the plurality of pattern strength values; and wherein the first pattern index and the second pattern index are used to configure the decision engine. ### Claim 18 (depends on 16) The non-transitory machine-readable medium of claim 16, the operations further comprising: in response to receiving an output from the decision engine corresponding to the likelihood of anomalous activity associated with the user account, modifying the user account based on the output. ### Claim 19 (depends on 18) The non-transitory machine-readable medium of claim 18, wherein the modifying the user account based on the output includes adjusting a security level associated with the user account. ### Claim 20 (depends on 18) The non-transitory machine-readable medium of claim 18, wherein the modifying the user account based on the output includes implementing an additional authentication requirement for access to the user account. ### Claim 21 (depends on 16) The non-transitory machine-readable medium of claim 16, wherein the using the determined plurality of pattern strength values to configure the decision engine is performed in response to a transaction request, and wherein an approval of the transaction request is based on an output of the decision engine.