# US 2025/0094552 A1 · Generating a scaled impersonation attack prediction > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0094552 A1 - Document ID: US20250094552A1 - Status: Published application - Kind: A1 - Application number: 18/470,807 - Filed: 2023-09-20 - Published: 2025-03-20 - Earliest claimed: 2023-09-20 - Assignees: Capital One Services, LLC - Applicants: Capital One Services, LLC - Inventors: Kevin M. LOWE - Web page: https://patentgrep.com/patent/US20250094552A1 ## CPC - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/40: by quorum, i.e. whereby two or more security principals are required - G06F 21/554: {involving event detection and direct action} - G06F 2221/034: Test or assess a computer or a system - G06F 2221/2113: Multi-level security, e.g. mandatory access control - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In some implementations, a system may receive interaction information associated with a plurality of interactions, wherein each interaction in the plurality of interactions is associated with a respective user in a plurality of users. The system may retrieve passive user authentication information associated with the plurality of users. The system may compute a plurality of risk metrics based on the interaction information and the passive user authentication information, each risk metric in the plurality of risk metrics being associated with a respective interaction from the plurality of interactions. The system may generate a scaled attack prediction based on the plurality of risk metrics, the scaled attack prediction indicating an occurrence of a scaled attack. The system may perform a security action based on the scaled attack prediction indicating the occurrence of the scaled attack. ## Claims ### Claim 1 A system for generating a scaled impersonation attack prediction, the system comprising: one or more memories; and one or more processors, communicatively coupled to the one or more memories, configured to: receive a plurality of sets of interaction information, each set of interaction information in the plurality of sets of interaction information being associated with a respective interaction from a plurality of interactions, wherein each interaction in the plurality of interactions is associated with a respective user from a plurality of users; retrieve a plurality of sets of passive user authentication information, each set of passive user authentication information in the plurality of sets of passive user authentication information being associated with a respective user from the plurality of users; compute a plurality of impersonation risk metrics based on the plurality of sets of interaction information and the plurality of sets of passive user authentication information, each impersonation risk metric in the plurality of impersonation risk metrics being associated with a respective interaction from the plurality of interactions; generate a scaled impersonation attack prediction based on the plurality of impersonation risk metrics; and selectively perform a security action based on the scaled impersonation attack prediction. ### Claim 2 (depends on 1) The system of claim 1, wherein a set of passive user authentication information in the plurality of sets of passive user authentication information includes at least one of: caller identification data associated with a user in the plurality of users, application-based authentication data associated with the user, near-field communication radio frequency identification (RFID) chip data associated with the user, passive ultrahigh frequency RFID data associated with the user, or ultra-wideband tag data associated with the user. ### Claim 3 (depends on 1) The system of claim 1, wherein a set of passive user authentication information in the plurality of sets of passive user authentication information includes location data associated with a user in the plurality of users, wherein the location data comprises at least one of: global navigation satellite system (GNSS)-based location data, interaction-based location data, or Internet-of-things (IoT)-based location data. ### Claim 4 (depends on 1) The system of claim 1, wherein a set of passive user authentication information in the plurality of sets of passive user authentication information includes interaction data associated with a user in the plurality of users. ### Claim 5 (depends on 1) The system of claim 1, wherein a set of passive user authentication information in the plurality of sets of passive user authentication information includes background noise data associated with a user in the plurality of users. ### Claim 6 (depends on 1) The system of claim 1, wherein the one or more processors, to compute an impersonation risk metric associated with an interaction associated with a user, are configured to: compare a set of interaction information associated with the interaction and a set of passive user authentication information associated with the user, and determine the impersonation risk metric based on a result of the comparison of the set of interaction information and the set of passive user authentication information. ### Claim 7 (depends on 1) The system of claim 1, wherein the one or more processors, to generate the scaled impersonation attack prediction, are configured to: identify a quantity of impersonation risk metrics, from the plurality of impersonation risk metrics, that satisfy an individual risk threshold, determine whether the quantity of impersonation risk metrics that satisfy the individual risk threshold satisfies a scaled impersonation attack threshold, and generate the scaled impersonation attack prediction based on whether the quantity of impersonation risk metrics satisfies the scaled impersonation attack threshold. ### Claim 8 (depends on 1) The system of claim 1, wherein the one or more processors, to generate the scaled impersonation attack prediction, are configured to: identify a scaled impersonation risk pattern based on information associated with the plurality of impersonation risk metrics, and generate the scaled impersonation attack prediction based on the identification of the scaled impersonation risk pattern. ### Claim 9 (depends on 1) The system of claim 1, wherein the scaled impersonation attack prediction indicates an ongoing scaled impersonation attack, and selectively performing the security action comprises performing a termination action with respect to one or more interactions in the plurality of interactions. ### Claim 10 (depends on 1) The system of claim 1, wherein the scaled impersonation attack prediction indicates an ongoing scaled impersonation attack, and selectively performing the security action comprises performing an authentication action with respect to one or more interactions in the plurality of interactions. ### Claim 11 (depends on 1) The system of claim 1, wherein the scaled impersonation attack prediction indicates an ongoing scaled impersonation attack, and selectively performing the security action comprises intervening with respect to one or more interactions in the plurality of interactions using conversational artificial intelligence. ### Claim 12 (depends on 1) The system of claim 1, wherein the scaled impersonation attack prediction indicates an ongoing scaled impersonation attack, and selectively performing the security action comprises performing an attack pattern identification based on at least one of the plurality of sets of interaction information, the plurality of sets of passive user authentication information, or the plurality of impersonation risk metrics. ### Claim 13 (depends on 1) The system of claim 1, wherein the one or more processors are further configured to: receive feedback information associated with the scaled impersonation attack prediction, and update a prediction model associated with generating the scaled impersonation attack prediction based on the feedback information. ### Claim 14 A method for generating a scaled attack prediction, comprising: receiving, by a system, interaction information associated with a plurality of interactions, wherein each interaction in the plurality of interactions is associated with a respective user from a plurality of users; retrieving, by the system, passive user authentication information associated with the plurality of users; computing, by the system, a plurality of risk metrics based on the interaction information and the passive user authentication information, each risk metric in the plurality of risk metrics being associated with a respective interaction from the plurality of interactions; generating, by the system, a scaled attack prediction based on the plurality of risk metrics, the scaled attack prediction indicating an occurrence of a scaled attack; and performing, by the system, a security action based on the scaled attack prediction indicating the occurrence of the scaled attack. ### Claim 15 (depends on 14) The method of claim 14, wherein the passive user authentication information includes at least one of: caller identification data associated with one or more users in the plurality of users, application-based authentication data associated with one or more users in the plurality of users, near-field communication radio frequency identification (RFID) chip data associated with one or more users in the plurality of users, passive ultrahigh frequency RFID data associated with one or more users in the plurality of users, ultra-wideband tag data associated with one or more users in the plurality of users, location data associated with one or more users in the plurality of users, or interaction data associated with one or more users in the plurality of users. ### Claim 16 (depends on 14) The method of claim 14, wherein generating the scaled attack prediction comprises: identifying a quantity of risk metrics, from the plurality of risk metrics, that satisfy an individual risk threshold, determining whether the quantity of risk metrics that satisfy the individual risk threshold satisfies a scaled attack threshold, and generating the scaled attack prediction based on whether the quantity of risk metrics satisfies the scaled attack threshold. ### Claim 17 (depends on 14) The method of claim 14, wherein generating the scaled attack prediction comprises: identifying a scaled risk pattern based on information associated with the plurality of risk metrics, and generating the scaled attack prediction based on the identification of the scaled risk pattern. ### Claim 18 (depends on 14) The method of claim 14, wherein the security action comprises at least one of: an action associated with terminating one or more interactions in the plurality of interactions, an action associated with authenticating one or more interactions in the plurality of interactions, or an action associated with identifying an attack associated with the scaled attack. ### Claim 19 A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a system, cause the system to: compute a plurality of risk metrics based on a plurality of sets of interaction information and a plurality of sets of passive user authentication information, wherein each set of interaction information in the plurality of sets of interaction information is associated with a respective interaction from a plurality of interactions, wherein each set of passive user authentication information in the plurality of sets of passive user authentication information is associated with a respective user from a plurality of users, wherein each interaction in the plurality of interactions is associated with a respective user from the plurality of users, and wherein each risk metric in the plurality of risk metrics is associated with a respective interaction from the plurality of interactions; generate a scaled attack prediction based on the plurality of risk metrics, the scaled attack prediction indicating a likelihood of an ongoing scaled attack; and perform an action based on the scaled attack prediction. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the one or more instructions, that cause the system to generate the scaled attack prediction, cause the system to: identify a quantity of risk metrics, from the plurality of risk metrics, that satisfy an individual risk threshold, determine whether the quantity of risk metrics that satisfy the individual risk threshold satisfies a scaled attack threshold, and generate the scaled attack prediction based on whether the quantity of risk metrics satisfies the scaled attack threshold.