US 11,715,106 B2
Systems and methods for real-time institution analysis based on message traffic
Joshua A. Allbright, Valley Park, MO (US)
Assigned to MASTERCARD INTERNATIONAL INCORPORATED, Purchase, NY (US)
Filed by Mastercard International Incorporated, Purchase, NY (US)
Filed on Apr. 1, 2020, as Appl. No. 16/837,838.
Prior Publication US 2021/0312452 A1, Oct. 7, 2021
Int. Cl. G06Q 20/40 (2012.01); G06F 7/08 (2006.01); G06F 16/23 (2019.01); G06N 20/00 (2019.01); G06N 5/04 (2023.01); G06Q 30/0204 (2023.01); G06Q 30/018 (2023.01)
CPC G06Q 20/4016 (2013.01) [G06F 7/08 (2013.01); G06F 16/2379 (2019.01); G06N 5/04 (2013.01); G06N 20/00 (2019.01); G06Q 30/0204 (2013.01); G06Q 30/018 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A message tracking computing device for identifying anomalous activity in real-time, the message tracking computing device comprising at least one processor in communication with at least one memory, the at least one processor programmed to:
receive, from a payment processing network, real-time transaction data including a plurality of real-time transaction records, each transaction record associated with a payment transaction conducted over the payment processing network;
sort the plurality of real-time transaction records into a plurality of channels, wherein each channel of the plurality of channels represents a different type of transaction, each type of transaction represented by one of the channels includes one of ATM transactions, card-not-present transactions, point-of-sale transactions, quasi transactions, cross-border transactions, approved transactions, and declined transactions, wherein each channel includes a plurality of transactions of the corresponding transaction type from a plurality of individuals and a plurality of institutions;
for each channel and corresponding type of transaction, compute, in real-time, a normalized velocity score by:
computing a streaming mean for at least one transaction record associated with the corresponding channel;
computing a streaming standard deviation for the at least one transaction record; and
computing the normalized velocity score based on the streaming mean, the streaming standard deviation, and a transaction ratio for the at least one transaction record;
analyze the computed normalized velocity score for each channel to detect anomalous activity;
automatically generate an alert message identifying the anomalous activity; and
transmit the alert message to a remote computing device.