US 11,750,639 B2
ATM-based anomaly and security threat detection
Shailendra Singh, Thane West (IN)
Assigned to Bank of America Corporation, Charlotte, NC (US)
Filed by Bank of America Corporation, Charlotte, NC (US)
Filed on Apr. 5, 2021, as Appl. No. 17/221,900.
Prior Publication US 2022/0321592 A1, Oct. 6, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06Q 20/38 (2012.01)
CPC H04L 63/1433 (2013.01) [G06Q 20/382 (2013.01); H04L 63/1466 (2013.01)] 20 Claims
OG exemplary drawing
 
1. An automated teller machine (ATM), comprising:
a memory operable to store a set of baseline features associated with the ATM, wherein:
the set of baseline features represents a unique electrical signature of electrical components of the ATM when the ATM is initiated to operate, and
the set of baseline features comprises at least one of expected electrical signal patterns communicated between the electrical components and expected electromagnetic radiation patterns propagated from the electrical components of the ATM; and
a processor, operably coupled with the memory, and configured to:
receive a first set of signals from the electrical components of the ATM while the ATM is in operation, wherein the first set of signals comprises:
intercommunication signals between the electrical components; and
expected serial numbers associated the with the electrical components of the ATM;
extract a set of test features from the first set of signals, wherein the set of test features represents a test profile of the electrical components of the ATM while the ATM is in operation and an unverified serial number associated with a particular component from among the electrical components of the ATM;
compare the set of test features with the set of baseline features;
determine whether there is a deviation between the set of test features and the set of baseline features, wherein determining whether there is the deviation between the set of test features and the set of baseline features comprises:
determine that the unverified serial number differs from the expected serial numbers;
determine whether more than a threshold percentage of test features from the set of test features are not within a threshold range from corresponding baseline features from the set of baseline features; and
in response to determining the that the unverified serial number differs from the expected serial numbers and that deviation between the set of test features and the set of baseline features:
determine that the particular component is an unverified component;
determine that the ATM is associated with a particular anomaly, wherein:
 determining that the ATM is associated with the particular anomaly comprises detecting an unexpected fluctuation in the electrical signal patterns and the electromagnetic radiation patterns in the first set of test features associated with the unverified electrical component with respect to the expected electrical signal patterns and the expected electromagnetic signal patterns in the first set of baseline features; and
 the particular anomaly corresponds to a security vulnerability making the ATM vulnerable to unauthorized access.