US 11,748,757 B1
Network security systems and methods for detecting fraud
Mario Segal, Stamford, CT (US); and Ziying Li, Stamford, CT (US)
Assigned to Mastercard International Incorporated, Purchase, NY (US)
Filed by MASTERCARD INTERNATIONAL INCORPORATED, Purchase, NY (US)
Filed on Apr. 19, 2019, as Appl. No. 16/389,631.
Int. Cl. G06Q 20/40 (2012.01); G06N 20/00 (2019.01); H04W 12/12 (2021.01)
CPC G06Q 20/4016 (2013.01) [G06N 20/00 (2019.01); G06Q 20/409 (2013.01); H04W 12/12 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system for detecting fraud within a payment card network, the system comprising:
a memory storing historical transaction data; and
at least one processor configured to execute instructions that cause the at least one processor to:
prepare a set of historical transaction data for machine learning model training by:
labeling a first subset of historical transactions of the set of historical transaction data as test transactions, representing transactions having been fraudulently initiated by a fraudster to test validity of an underlying account, wherein the first subset of historical transactions have a transaction amount that falls below a predetermined threshold such that the transaction amount is configured to avoid notice of a legitimate holder of the underlying account; and
labeling a second subset of historical transactions of the set of historical transaction data as not test transactions, representing transactions that are not fraudulent test transactions,
train a machine learning model using the identified set of historical transaction data as labeled training data, the machine learning model is constructed as a classifier type model that accepts transaction data associated with an input transaction as input and classifies the input transaction as one of (A) a test transaction and (B) not a test transaction;
apply transaction data of a suspect transaction of a cardholder account as input to the trained machine learning model, wherein the trained machine learning model generates an output that classifies the suspect transaction as a test transaction;
mark the cardholder account as compromised based on classification of the suspect transaction as a test transaction;
receive, in real-time, a pending transaction associated with the cardholder account;
determine a time difference between the pending transaction and the test transaction; and
reject the pending transaction based on the cardholder account being marked as compromised and the time difference between the pending transaction and the test transaction.