US 2023/0141627 A1Published application

Real-time account takeover detection using behavior sequence clustering

AssigneePaypal, Inc.

InventorsShenjie Bao, Yan Zhang, Huan Li, Yuanyuan Tang

Life of this patent

Estimating the term…

Loading patent…

Abstract

Computer security improvements relating to defenses for real-time account takeover detection using behavior sequence clustering are disclosed. A service provider may utilize a framework having computing operations for detecting and protecting from account takeovers by malicious entities that may utilize compromised accounts. In this regard, the service provider may utilize an account takeover framework and processing pipeline that may identify account behaviors executed by computing devices when using accounts with the service provider. These behaviors may be clustered into behavior sequences that may be verified as sufficiently occurring with other accounts of the service provider. If so, the behavior sequences may be identified as risky and may be used with a real-time detection system to monitor for those behavior sequences. If detected, security operations may be automatically executed to prevent further account takeover risk by malicious entities.

Claims20

Dependent claims

A system comprising:

a non-transitory memory;
and
one or more hardware processors coupled to the non-transitory memory and configured to execute instructions from the non-transitory memory to cause the system to perform operations comprising:
accessing account data for accounts having fraudulent transaction processing alerts previously flagged for the accounts;
determining, using the account data, targeted accounts that are targeted by the accounts when the fraudulent transaction processing alerts occur;
clustering, using the account data for the accounts, account behaviors by the accounts into one or more behavior sequences, wherein the account behaviors comprise computing operations executed by one or more respective user interface commands on computing devices when utilizing the accounts, and wherein the computing operations are performed by the computing devices with the targeted accounts for the fraudulent transaction processing alerts;
marking a first behavior sequence of the one or more behavior sequences by a first account as a risky behavior sequence based on the fraudulent transaction processing alerts for the accounts;
and
clustering at least a portion of the accounts having the fraudulent transaction processing alerts based on the first behavior sequence being executed by the computing devices associated with the at least the portion of the accounts, wherein the clustering results in a first account cluster comprising the portion of the accounts having the fraudulent transaction alerts.

6 more elements

A method comprising:

accessing digital account data for a plurality of accounts that have an account alert that indicates a fraudulent activity engaged in by each of the plurality of accounts, wherein the digital account data comprise a plurality of account behaviors executed by computing devices using the plurality of accounts with a plurality of targeted accounts for the fraudulent activity;
identifying the plurality of account behaviors by the plurality of accounts with the plurality of targeted accounts based on the digital account data;
clustering a plurality of behavior sequences by the plurality of accounts with the plurality of targeted accounts using the digital account data, wherein each of the plurality of behavior sequences comprise one or more of the plurality of account behaviors;
selecting a first behavior sequence of the plurality of behavior sequences as a potential risk sequence for the fraudulent activity;
clustering, using the digital account data, the plurality of accounts based on the first behavior sequence being executed by the computing devices using the plurality of accounts;
verifying, based on the clustering the plurality of accounts, that the first behavior sequence meets or exceeds a threshold occurrence rate by the plurality of accounts for the fraudulent activity performed with the plurality of targeted accounts;
and
preventing, with at least one additional account, the fraudulent activity when the first behavior sequence is detected as being performed by the at least one additional account.

5 more elements

Dependencies are inferred from the claim text.