US 12,225,026 B1
Detecting malicious activity using user-specific parameters
Rongrong Zhou, Washington, DC (US); and Ganesh Babu Gopal, Coppell, TX (US)
Assigned to Citibank, N.A., New York, NY (US)
Filed by Citibank, N.A., New York, NY (US)
Filed on Oct. 11, 2024, as Appl. No. 18/914,035.
Application 18/914,035 is a continuation in part of application No. 18/374,906, filed on Sep. 29, 2023.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1416 (2013.01) 17 Claims
OG exemplary drawing
 
1. A system for using user-specific parameters to detect malicious activity in an interaction, the system comprising:
a storage device; and
one or more processors communicatively coupled to the storage device storing instructions thereon, that cause the one or more processors to:
receive user action data representing user actions for a plurality of users relative to a plurality of applications;
extract, from the user action data, first user action data representing first user actions of a first user of the plurality of users;
generate, using the first user action data and without using other user action data representing other user actions for other users of the plurality of users, a plurality of parameters specific to the first user for determining whether interactions of the first user represent malicious activity, wherein each parameter of the plurality of parameters comprises a corresponding parameter identifier and a corresponding parameter value;
receive, for the first user, a request for a pending interaction with a particular application of the plurality of applications;
input, into a first user model, the pending interaction to cause the first user model to generate a plurality of parameter identifiers identifying a set of parameters within the plurality of parameters, wherein the set of parameters is more likely than another set of parameters within the plurality of parameters to identify the malicious activity, and wherein the first user model is trained for the first user using the first user action data and without using the other user action data; and
during pendency of the pending interaction;
determine, for the set of parameters, a corresponding set of interaction parameters, wherein the corresponding set of interaction parameters is extracted from the pending interaction that is received as part of the request;
determine whether the corresponding set of interaction parameters matches the set of parameters; and
based on determining that the corresponding set of interaction parameters matches the set of parameters, determine that the pending interaction is malicious.