Method, system and computer program for preventing malicious data transmission

Abstract

A method for preventing malicious data transmission may include receiving transaction data, the transaction data including at least one data packet associated with a payment transaction; extracting at least one of network layer data or transport layer data from a header of the at least one data packet; determining, using a classifier, a first probability that the at least one data packet belongs to a first category based on the at least one of the network layer data or the transport layer data. The method may also include determining, using the classifier, a second probability that the at least one data packet belongs to a second category based on the at least one of the network layer data or the transport layer data; and blocking the at least one data packet. A system and a computer program product are also disclosed.

Description

Technical Field

[0001] The subject matter of the present disclosure generally relates to methods, systems, and computer program products for preventing malicious data transmission and, in some specific embodiments, to a method, system, and computer program product for preventing malicious data transmission by blocking at least one data packet using a trained classifier. Background Art

[0002] Systems involved in processing payment transactions, such as those associated with transaction service providers, payment gateways, issuers, acquirers, and the like, may receive malicious data intended to consume the computing resources of such systems. While systems receiving malicious data can implement fraud detection systems configured to identify malicious data, these fraud detection systems may become overloaded depending on the volume of malicious data being processed. Consequently, subsequently received data associated with non-fraudulent payment transactions may be placed in a queue to be processed by the fraud detection system, thereby extending the time associated with authorizing payment transactions. Additionally or alternatively, systems receiving malicious data may allocate additional computing resources to identify the malicious data. Summary of the Invention

[0003] It is therefore an object of the presently disclosed subject matter to provide methods, systems, and computer program products for preventing malicious data transmissions.

[0004] According to non-limiting embodiments or aspects, a computer-implemented method for preventing malicious data transmission is provided. In some non-limiting embodiments, a computer-implemented method for preventing malicious data transmission may include: receiving, with at least one processor, transaction data including at least one data packet associated with a payment transaction; extracting, with at least one processor, at least one of network layer data or transport layer data from a header of the at least one data packet; determining, with at least one processor, a first probability indicating that the at least one data packet belongs to a first category based on at least one of the network layer data or the transport layer data; determining, with at least one processor, a second probability indicating that the at least one data packet belongs to a second category based on at least one of the network layer data or the transport layer data; and blocking, with at least one processor, at least one data packet.

[0005] According to non-limiting embodiments or aspects, a system for preventing malicious data transmission is provided. In some non-limiting embodiments, the system for preventing malicious data transmission may include at least one processor programmed or configured to: receive transaction data, the transaction data including at least one data packet associated with a payment transaction; extract at least one of network layer data or transport layer data from a header of the at least one data packet; determine, using a classifier, a first probability indicating that the at least one data packet belongs to a first category based on at least one of the network layer data or the transport layer data; determine, using the classifier, a second probability indicating that the at least one data packet belongs to a second category based on at least one of the network layer data or the transport layer data; and determine whether the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category, wherein, in response to determining that the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category, the at least one processor is programmed or configured to block the at least one data packet; and wherein, in response to determining that the first probability indicating that the at least one data packet belongs to the first category is less than the second probability indicating that the at least one data packet belongs to the second category, the at least one processor is programmed or configured to permit transmission of the at least one data packet for forwarding.

[0006] According to a non-limiting embodiment or aspect, a computer program product for preventing malicious data transmission is provided. The computer program product may include at least one non-transitory computer-readable medium including at least one instruction that, when executed by at least one processor, causes the at least one processor to: receive transaction data, the transaction data including at least one data packet associated with a payment transaction; extract at least one of network layer data or transport layer data from a header of at least one data packet; determine, using a classifier, a first probability indicating that the at least one data packet belongs to a first category based on at least one of the network layer data or the transport layer data; determine, using a classifier, a second probability indicating that the at least one data packet belongs to a second category based on at least one of the network layer data or the transport layer data; and determine whether the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category; extract at least one of session layer data, presentation layer data, or application layer data from at least one data packet; determine, using a classifier, based on at least one of the session layer data, presentation layer data, or application layer data and the network layer data; determining, using a classifier, a third probability indicating that the at least one packet belongs to a first category based on at least one of the session layer data, presentation layer data, or application layer data and at least one of the network layer data or transport layer data; determining, using a classifier, a fourth probability indicating that the at least one packet belongs to a second category based on at least one of the session layer data, presentation layer data, or application layer data and at least one of the network layer data or transport layer data; and determining, using a classifier, a fifth probability indicating that the at least one packet belongs to a third category based on at least one of the session layer data, presentation layer data, or application layer data and at least one of the network layer data or transport layer data, wherein, in response to determining that the first probability indicating that the at least one packet belongs to the first category is greater than the second probability indicating that the at least one packet belongs to the second category, the at least one instruction causes the at least one processor to block the at least one packet; and wherein, in response to determining that the first probability indicating that the at least one packet belongs to the first category is less than the second probability indicating that the at least one packet belongs to the second category, the at least one instruction causes the at least one processor to permit transmission of the at least one packet for forwarding.

[0007] Other embodiments are described in the following numbered clauses:

[0008] Clause 1: A computer-implemented method comprising: receiving, with at least one processor, transaction data comprising at least one data packet associated with a payment transaction; extracting, with at least one processor, at least one of network layer data or transport layer data from a header of the at least one data packet; determining, with at least one processor, using a classifier, a first probability indicating that the at least one data packet belongs to a first category based on the at least one of the network layer data or the transport layer data; determining, with at least one processor, using the classifier, a second probability indicating that the at least one data packet belongs to a second category based on the at least one of the network layer data or the transport layer data; and blocking, with at least one processor, the at least one data packet.

[0009] Clause 2: The computer-implemented method of clause 1, further comprising: determining that the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category, wherein blocking transmission of the at least one data packet comprises blocking the at least one data packet based on determining that the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category.

[0010] Clause 3: The computer-implemented method of clause 1 or 2, further comprising: determining that the first probability indicating that the at least one data packet belongs to the first category is less than the second probability indicating that the at least one data packet belongs to the second category; extracting at least one of session layer data, presentation layer data, or application layer data from the at least one data packet; using the classifier to determine a third probability indicating that the at least one data packet belongs to the first category based on at least one of the session layer data, the presentation layer data, or the application layer data and at least one of the network layer data or the transport layer data; using the classifier to determine a fourth probability indicating that the at least one data packet belongs to the second category based on at least one of the session layer data, the presentation layer data, or the application layer data and at least one of the network layer data or the transport layer data; and using the classifier to determine a fifth probability indicating that the at least one data packet belongs to the third category based on at least one of the session layer data, the presentation layer data, or the application layer data and at least one of the network layer data or the transport layer data.

[0011] Clause 4: The computer-implemented method of any of clauses 1 to 3, wherein blocking the at least one data packet comprises blocking the at least one data packet based on determining that the third probability is greater than the fourth probability and the fifth probability.

[0012] Clause 5: The computer-implemented method of any one of clauses 1 to 4, further comprising: determining that the fourth probability is greater than the third probability and the fifth probability; and forwarding the at least one data packet to a separate computing device based on determining that the third probability is greater than the fourth probability and the fifth probability.

[0013] Clause 6: The computer-implemented method of any one of clauses 1 to 5, further comprising: determining that the fifth probability is greater than the third probability and the fourth probability; and forwarding the at least one data packet to a separate computing device based on determining that the fifth probability is greater than the third probability and the fourth probability.

[0014] Clause 7: The computer-implemented method of any one of clauses 1 to 6, further comprising: determining that the fourth probability is greater than the third probability and the fifth probability; and forwarding the at least one data packet to a risk scoring platform.

[0015] Clause 8: The computer-implemented method of any one of clauses 1 to 7, further comprising: determining a score associated with the at least one data packet based on at least one of the third probability, the fourth probability, or the fifth probability; and adding the score to the header of the at least one data packet.

[0016] Item 9: A system, at least one processor being programmed or configured to: receive transaction data, the transaction data comprising at least one data packet associated with a payment transaction; extract at least one of network layer data or transport layer data from a header of the at least one data packet; determine, using a classifier, a first probability indicating that the at least one data packet belongs to a first category based on the at least one of the network layer data or the transport layer data; determine, using the classifier, a second probability indicating that the at least one data packet belongs to a second category based on the at least one of the network layer data or the transport layer data; and determine whether the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category, wherein, in response to determining that the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category, the at least one processor is programmed or configured to block the at least one data packet; and wherein, in response to determining that the first probability indicating that the at least one data packet belongs to the first category is less than the second probability indicating that the at least one data packet belongs to the second category, the at least one processor is programmed or configured to permit transmission of the at least one data packet for forwarding.

[0017] Clause 10: The system of clause 9, wherein the at least one processor is further programmed or configured to: determine that the first probability indicating that the at least one packet belongs to the first category is less than the second probability indicating that the at least one packet belongs to the second category; extract at least one of session layer data, presentation layer data, or application layer data from the at least one packet; determine, using the classifier, a third probability indicating that the at least one packet belongs to the first category based on at least one of the session layer data, the presentation layer data, or the application layer data and at least one of the network layer data or the transport layer data; determine, using the classifier, a fourth probability indicating that the at least one packet belongs to the second category based on at least one of the session layer data, the presentation layer data, or the application layer data and at least one of the network layer data or the transport layer data; and determine, using the classifier, a fifth probability indicating that the at least one packet belongs to the third category based on at least one of the session layer data, the presentation layer data, or the application layer data and at least one of the network layer data or the transport layer data.

[0018] Clause 11: The system of clause 9 or 10, wherein, when blocking the at least one data packet, the at least one processor is programmed or configured to: block the at least one data packet based on determining that the third probability is greater than the fourth probability and the fifth probability.

[0019] Clause 12: The system of any one of clauses 9 to 11, wherein the at least one processor is further programmed or configured to: determine that the fourth probability is greater than the third probability and the fifth probability; and forward the at least one data packet to a separate computing device based on determining that the third probability is greater than the fourth probability and the fifth probability.

[0020] Clause 13: The system of any one of clauses 9 to 12, wherein the at least one processor is further programmed or configured to: determine that the fifth probability is greater than the third probability and the fourth probability; and forward the at least one data packet to a separate computing device based on determining that the fifth probability is greater than the third probability and the fourth probability.

[0021] Clause 14: The system of any one of clauses 9 to 13, wherein the at least one processor is further programmed or configured to: determine that the fourth probability is greater than the third probability and the fifth probability; and forward the at least one data packet to a risk scoring platform.

[0022] Clause 15: The system of any one of clauses 9 to 14, wherein the at least one processor is further programmed or configured to: determine a score associated with the at least one data packet based on at least one of the third probability, the fourth probability, or the fifth probability; and add the score to the header of the at least one data packet.

[0023] Clause 16: A computer program product comprising at least one non-transitory computer-readable medium, the at least one non-transitory computer-readable medium comprising one or more instructions that, when executed by at least one processor, cause the at least one processor to: receive transaction data, the transaction data comprising at least one data packet associated with a payment transaction; extract at least one of network layer data or transport layer data from a header of the at least one data packet; determine, using a classifier, a first probability indicating that the at least one data packet belongs to a first category based on the at least one of the network layer data or the transport layer data; determine, using the classifier, a second probability indicating that the at least one data packet belongs to a second category based on the at least one of the network layer data or the transport layer data; and determine whether the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category; extract at least one of session layer data, presentation layer data, or application layer data from the at least one data packet; determine, using the classifier, a second probability indicating that the at least one data packet belongs to a second category based on the at least one of the network layer data or the transport layer data; and determine whether the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category; determining, using the classifier, a third probability indicating that the at least one packet belongs to the first category based on at least one of the session layer data, the presentation layer data, or the application layer data and the at least one of the network layer data or the transport layer data; determining, using the classifier, a fourth probability indicating that the at least one packet belongs to the second category based on the at least one of the session layer data, the presentation layer data, or the application layer data and the at least one of the network layer data or the transport layer data; and determining, using the classifier, a fifth probability indicating that the at least one packet belongs to the third category based on the at least one of the session layer data, the presentation layer data, or the application layer data and the at least one of the network layer data or the transport layer data; wherein, in response to determining that the first probability indicating that the at least one packet belongs to the first category is greater than the second probability indicating that the at least one packet belongs to the second category, the one or more instructions cause the at least one processor to block the at least one packet; and wherein, in response to determining that the first probability indicating that the at least one packet belongs to the first category is less than the second probability indicating that the at least one packet belongs to the second category, the one or more instructions cause the at least one processor to permit transmission of the at least one packet for forwarding.

[0024] Clause 17: The computer program product of clause 16, wherein the one or more instructions that cause the at least one processor to block the at least one data packet cause the at least one processor to: block the at least one data packet based on determining that the third probability is greater than the fourth probability and the fifth probability.

[0025] Clause 18: A computer program product according to clause 16 or 17, wherein the one or more instructions further cause the at least one processor to: determine that the fifth probability is greater than the third probability and the fourth probability; and forward the at least one data packet to a separate computing device based on determining that the fifth probability is greater than the third probability and the fourth probability.

[0026] Clause 19: The computer program product of any one of clauses 16 to 18, wherein the one or more instructions further cause the at least one processor to: determine that the fourth probability is greater than the third probability and the fifth probability; and forward the at least one data packet to a risk scoring platform.

[0027] Clause 20: A computer program product according to any one of clauses 16 to 19, wherein the one or more instructions further cause the at least one processor to: determine a score associated with the at least one data packet based on at least one of the third probability, the fourth probability, or the fifth probability; and add the score to the header of the at least one data packet.

[0028] These and other features and characteristics of the presently disclosed subject matter, as well as the methods of operation and function of the related structural elements and combinations of parts, and the economies of manufacturing will become more apparent after consideration of the following description and the appended claims with reference to the accompanying drawings, all of which form a part of this specification wherein like reference numerals indicate corresponding parts in the various figures. It is to be expressly understood, however, that the drawings are for purposes of illustration and description only and are not intended as a definition of the limits of the disclosed subject matter. As used in this specification and claims, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Additional advantages and details of the disclosed subject matter are explained in more detail below with reference to exemplary embodiments shown in the accompanying drawings, in which:

[0030] Figure 1 is a diagram of a non-limiting embodiment of an environment in which the systems, methods, and / or computer program products described herein may be implemented according to the principles of the presently disclosed subject matter;

[0031] Figure 2 yes Figure 1diagrams of non-limiting embodiments of one or more devices and / or one or more systems;

[0032] Figure 3 is a flow chart of a non-limiting embodiment of a process for preventing malicious data transmission according to the principles of the presently disclosed subject matter;

[0033] Figures 4A-4C is a diagram of a non-limiting example of an implementation of a non-limiting example of a process for preventing malicious data transmission according to the principles of the presently disclosed subject matter; and

[0034] Figures 5A-5F is a diagram of a non-limiting example of an implementation of a non-limiting example of a process for preventing malicious data transmissions in accordance with the principles of the present disclosure. DETAILED DESCRIPTION

[0035] For descriptive purposes hereinafter, the terms "end," "upper," "lower," "right," "left," "vertical," "horizontal," "top," "bottom," "lateral," "longitudinal," and their derivatives shall refer to the disclosed subject matter as it is oriented in the accompanying drawings. However, it will be understood that the disclosed subject matter may employ various alternative variations and step sequences, unless expressly specified to the contrary. It will also be understood that the specific devices and processes illustrated in the accompanying drawings and described in the following specification are merely exemplary embodiments or aspects of the disclosed subject matter. Accordingly, specific dimensions and other physical characteristics related to the embodiments or aspects disclosed herein should not be considered as limiting unless otherwise indicated.

[0036] As used herein, aspects, components, elements, structures, actions, steps, functions, instructions, etc. should not be understood as being critical or necessary unless explicitly described as such. In addition, as used herein, the article "one" is intended to include at least one project and can be used interchangeably with "one or more" and "at least one". In addition, as used herein, the term "set" is intended to include at least one project (e.g., related projects, unrelated projects, a combination of related projects and unrelated projects, etc.), and can be used interchangeably with "one or more" or "at least one". In the case of wishing only one project, the term "one" or similar language is used. And, as used herein, the term "having" etc. is intended to be an open term. In addition, unless explicitly stated otherwise, the phrase "based on" is intended to mean "at least partially based on".

[0037] As used herein, the terms "communication" and "communication" may refer to the reception, acceptance, transmission, transfer, provision, etc. of information (e.g., data, signals, messages, instructions, commands, etc.). When a unit (e.g., a device, a system, a component of a device or system, a combination thereof, etc.) communicates with another unit, it means that the unit is able to directly or indirectly receive information from the other unit and / or transmit information to the other unit. This may refer to a direct or indirect connection (e.g., a direct communication connection, an indirect communication connection, etc.) that is wired and / or wireless in nature. In addition, even if the transmitted information can be modified, processed, relayed and / or routed between the first unit and the second unit, the two units may communicate with each other. For example, even if the first unit passively receives information and does not actively transmit the information to the second unit, the first unit may communicate with the second unit. For another example, if at least one intermediate unit (e.g., a third unit located between the first unit and the second unit) processes the information received from the first unit and transmits the processed information to the second unit, the first unit may communicate with the second unit. In some non-limiting embodiments, a message may refer to a network data packet (e.g., a data packet, etc.) that includes data. It will be appreciated that many other arrangements are possible.

[0038] As used herein, the terms "issuer institution," "payment device issuer," "issuer," or "issuer bank" may refer to at least one entity that provides an account to a customer for conducting transactions (e.g., payment transactions), such as initiating credit and / or debit payments. For example, an issuer institution may provide a customer with an account identifier, such as a primary account number (PAN), that uniquely identifies at least one account associated with the customer. The account identifier may be implemented on a physical financial instrument, such as a payment card, and / or may be electronic and used for electronic payments. The terms "issuer institution" and "issuer institution system" may also refer to at least one computer system operated by or on behalf of an issuer institution, such as a server computer executing at least one software application. For example, an issuer institution system may include at least one authorization server for authorizing transactions.

[0039] As used herein, the term "account identifier" may include at least one type of identifier associated with a user account (e.g., PAN, card number, payment card number, payment token, etc.). In some non-limiting embodiments, an issuing institution may provide a user with an account identifier (e.g., PAN, payment token, etc.) that uniquely identifies at least one account associated with the user. The account identifier may be embodied on a physical financial instrument (e.g., a portable financial instrument, a payment card, a credit card, a debit card, etc.), and / or may be electronic information transmitted to the user so that the user can use it for electronic payments. In some non-limiting embodiments, the account identifier may be an original account identifier, which is provided to the user when the account associated with the account identifier is created. In some non-limiting embodiments, the account identifier may be an account identifier provided to the user after the original account identifier is provided to the user (e.g., a supplemental account identifier). For example, if the original account identifier is forgotten, stolen, etc., the supplemental account identifier may be provided to the user. In some non-limiting embodiments, the account identifier may be directly or indirectly associated with the issuing institution, such that the account identifier may be a payment token mapped to a PAN or other type of identifier. The account identifier may be any combination of alphanumeric characters, symbols, and / or symbols, etc. The issuer institution may be associated with a bank identification number (BIN) that uniquely identifies the issuer institution.

[0040] As used herein, the term "payment token" or "token" may refer to an identifier that is used as a substitute or replacement identifier for an account identifier, such as a PAN. A token may be associated with a PAN or other account identifier in at least one data structure (e.g., at least one database, etc.) such that the token can be used to conduct transactions (e.g., payment transactions) without directly using an account identifier, such as a PAN. In some instances, an account identifier, such as a PAN, may be associated with multiple tokens for different individuals, different uses, and / or different purposes. For example, a payment token may include a series of numbers and / or alphanumeric characters that can be used as a substitute for the original account identifier. For example, the payment token "49000000 0000 0001" may be used in place of the PAN "4147 0900 0000 1234". In some non-limiting embodiments, a payment token may be "format-preserving" and may have a numeric format consistent with account identifiers used in existing payment processing networks (e.g., the ISO 8583 financial transaction message format). In some non-limiting embodiments, a payment token may be used in place of a PAN to initiate, authorize, settle, or otherwise resolve a payment transaction, or to represent an original credential in other systems where the original credential would typically be provided. In some non-limiting embodiments, a token value may be generated such that it may be computationally impossible to recover the original PAN or other account identifier from the token value. Furthermore, in some non-limiting embodiments, the token format may be configured to allow an entity receiving a payment token to identify it as a payment token and to identify the entity that issued the token.

[0041] As used herein, the term "provisioning" may refer to the process of enabling a device to use a resource or service. For example, provisioning may involve enabling a device to use an account to perform a transaction. Additionally or alternatively, provisioning may include adding provisioning data associated with account data (e.g., a payment token representing an account number) to the device.

[0042] As used herein, the term "token requester" may refer to an entity that attempts to implement tokenization in accordance with an embodiment of the presently disclosed subject matter. For example, a token requester may initiate a request to tokenize a PAN by submitting a token request message to a token service provider. Additionally or alternatively, once the requester has received a payment token in response to the token request message, the token requester may no longer need to store the PAN associated with the token. In some non-limiting embodiments, the requester may be an application, device, process, or system configured to perform actions associated with a token. For example, the requester may request registration with a network token system, request token generation, token activation, token deactivation, token exchange, other token lifecycle management related processes, and / or any other token related processes. In some non-limiting embodiments, the requester may connect to the network token system via any suitable communication network and / or protocol (e.g., using HTTPS, SOAP, and / or XML interfaces, etc.). For example, token requesters may include card-on-file merchants, acquirers, acquirer processors, payment gateways operating on behalf of merchants, payment enablers (e.g., original equipment manufacturers, mobile network operators, etc.), digital wallet providers, issuers, third-party wallet providers, payment processing networks, and the like. In some non-limiting embodiments, a token requester may request tokens for multiple domains and / or channels. Additionally or alternatively, a token service provider within the tokenization ecosystem may uniquely register and identify token requesters. For example, during token requester registration, the token service provider may formally process the token requester's application to participate in the token service system. In some non-limiting embodiments, the token service provider may collect information about the nature of the requester and the relevant use of the token to verify and formally approve the token requester and establish appropriate domain restriction controls. Additionally or alternatively, a successfully registered token requester may be assigned a token requester identifier, which may also be entered and maintained within the token repository. In some non-limiting embodiments, a token requester identifier may be revoked and / or a new token requester identifier may be assigned to the token requester. In some non-limiting embodiments, this information may be reported and audited by the token service provider.

[0043] As used herein, the term "token service provider" may refer to an entity, including at least one server computer in a token service system, that generates, processes, and maintains payment tokens. For example, a token service provider may include or communicate with a token repository that stores generated tokens. Additionally or alternatively, the token repository may maintain a one-to-one mapping between tokens and the PAN represented by the tokens. In some non-limiting embodiments, the token service provider is able to reserve authorized BINs as token BINs in order to issue tokens with PANs that can be submitted to the token service provider. In some non-limiting embodiments, various entities in the tokenization ecosystem may assume the role of a token service provider. For example, payment networks and issuers, or their agents, may become token service providers by implementing token services according to non-limiting embodiments of the presently disclosed subject matter. Additionally or alternatively, the token service provider may provide reports or data outputs to reporting tools regarding approved, pending, or rejected token requests, including any assigned token requestor IDs. The token service provider may provide data outputs related to token-based transactions to reporting tools and applications, and may present the tokens and / or PANs in the report outputs as needed. In some non-limiting embodiments, the EMVCo standards organization may publish specifications defining how the tokenization system may operate. For example, such specifications may be informational, but they are not intended to limit any presently disclosed subject matter.

[0044] As used herein, the term "token repository" may refer to a repository that maintains established token-to-PAN mappings. For example, the token repository may also maintain other attributes of the token requestor that may be determined at registration and / or may be used by the token service provider to apply domain restrictions or other controls during transaction processing. In some non-limiting embodiments, the token repository may be part of a token service system. For example, the token repository may be provided as part of the token service provider. Additionally or alternatively, the token repository may be a remote repository accessible to the token service provider. In some non-limiting embodiments, the token repository may be protected by strong underlying physical and logical security due to the sensitive nature of the data mappings stored and managed therein. Additionally or alternatively, the token repository may be operated by any suitable entity, including a payment network, an issuer, a clearing house, other financial institution, a transaction service provider, or the like.

[0045] As used herein, the term "merchant" may refer to at least one entity (e.g., the operator of a retail business that provides goods and / or services and / or access to goods and / or services to users (e.g., customers, consumers, customers of the merchant, etc.) based on transactions (e.g., payment transactions). As used herein, the term "merchant system" may refer to at least one computer system operated by or on behalf of a merchant, such as a server computer that executes at least one software application. As used herein, the term "product" may refer to at least one good and / or service provided by a merchant.

[0046] As used herein, the term "point of sale (POS) device" may refer to at least one device that can be used by a merchant to initiate a transaction (e.g., a payment transaction), participate in a transaction, and / or process a transaction. For example, a POS device may include at least one computer, a peripheral device, a card reader, a near-field communication (NFC) receiver, a radio frequency identification (RFID) receiver, and / or other contactless transceivers or receivers, contact-based receivers, a payment terminal, a computer, a server, an input device, and the like.

[0047] As used herein, the term "point of sale (POS) system" may refer to at least one computer and / or peripheral device used by a merchant to conduct transactions. For example, a POS system may include at least one POS device, and / or other similar devices that can be used to conduct payment transactions. A POS system (e.g., a merchant POS system) may also include at least one server computer programmed or configured to process online payment transactions via a webpage, mobile application, or the like.

[0048] As used herein, the term "transaction service provider" may refer to an entity that receives transaction authorization requests from merchants or other entities and, in some cases, provides payment assurance through an agreement between the transaction service provider and an issuer organization. In some non-limiting embodiments, the transaction service provider may include a credit card company, a debit card company, etc. As used herein, the term "transaction service provider system" may also refer to at least one computer system operated by or on behalf of the transaction service provider, such as a transaction processing server that executes at least one software application. The transaction processing server may include at least one processor and, in some non-limiting embodiments, may be operated by or on behalf of the transaction service provider.

[0049] As used herein, the term "acquirer" may refer to an entity that is authorized by a transaction service provider and approved by the transaction service provider to initiate a transaction (e.g., a payment transaction) using a payment device associated with the transaction service provider. As used herein, the term "acquirer system" may also refer to at least one computer system, computer device, etc. operated by or on behalf of an acquirer. Transactions that an acquirer may initiate may include payment transactions (e.g., purchases, original credit transactions (OCTs), account fund transactions (AFTs), etc.). In some non-limiting embodiments, an acquirer may be authorized by a transaction service provider to assign merchants or service providers to initiate transactions using the payment device of the transaction service provider. An acquirer may sign a contract with a payment service provider to enable the payment service provider to provide sponsorship to merchants. An acquirer may monitor the compliance of a payment service provider in accordance with transaction service provider regulations. An acquirer may conduct due diligence on a payment service provider and ensure that appropriate due diligence is conducted before signing a contract with a sponsored merchant. An acquirer may be responsible for all transaction service provider programs operated or sponsored by the acquirer. The acquirer may be responsible for the actions of the acquirer payment facilitator, merchants sponsored by the acquirer payment facilitator, etc. In some non-limiting embodiments, the acquirer may be a financial institution, such as a bank.

[0050] As used herein, the terms “electronic wallet,” “electronic wallet mobile application,” and “digital wallet” may refer to at least one electronic device and / or at least one software application that is configured to initiate and / or conduct transactions (e.g., payment transactions, electronic payment transactions, etc.). For example, an electronic wallet may include an application executed by a user device (e.g., a mobile device) for maintaining and providing transaction data to the user device and server-side software and / or databases. As used herein, the term “electronic wallet provider” may include an entity that provides and / or maintains an electronic wallet and / or electronic wallet mobile application for a user (e.g., a customer). Examples of electronic wallet providers include, but are not limited to, Google Android Apple and Samsung In some non-limiting examples, a financial institution (e.g., an issuer institution) may be an e-wallet provider. As used herein, the term "e-wallet provider system" may refer to at least one computer system, computer device, server, server group, etc. operated by or on behalf of an e-wallet provider.

[0051] As used herein, the term "payment device" may refer to a payment card (e.g., a credit or debit card), a gift card, a smart card, smart media, a payroll card, a healthcare card, a wristband, a machine-readable medium containing account information, a keychain device or fob, an RFID transponder, a retailer discount or loyalty card, a cellular phone, an electronic wallet mobile application, a personal digital assistant (PDA), a pager, a security card, a computer, an access card, a wireless terminal, a transponder, etc. In some non-limiting embodiments, a payment device may include volatile or non-volatile memory that stores information (e.g., an account identifier, an account holder's name, and / or the like).

[0052] As used herein, the term "payment gateway" may refer to an entity and / or a payment processing system operated by or on behalf of such an entity (e.g., a merchant service provider, a payment service provider, a payment facilitator, a payment facilitator contracted with an acquirer, a payment aggregator, etc.) that provides payment services (e.g., transaction service provider payment services, payment processing services, etc.) to at least one merchant. The payment services may be associated with the use of a payment device managed by the transaction service provider. As used herein, the term "payment gateway system" may refer to at least one computer system, computer device, server, server group, etc. operated by or on behalf of the payment gateway, and / or the payment gateway itself. As used herein, the term "payment gateway mobile application" may refer to at least one electronic device and / or at least one software application configured to provide payment services for a transaction (e.g., a payment transaction, an electronic payment transaction, etc.).

[0053] As used herein, the terms "client" and "client device" may refer to at least one client-side device or system (e.g., remote from a transaction service provider) used to initiate or facilitate a transaction (e.g., a payment transaction). As an example, a "client device" may refer to at least one POS device used by a merchant, at least one acquirer host computer used by an acquirer, at least one mobile device used by a user, and the like. In some non-limiting embodiments, a client device may be an electronic device configured to communicate with at least one network and initiate or facilitate a transaction. For example, a client device may include at least one computer, portable computer, notebook computer, tablet computer, mobile device, cellular phone, wearable device (e.g., watch, glasses, lenses, clothing, etc.), PDA, and the like. In addition, a "client" may also refer to an entity (e.g., merchant, acquirer, etc.) that owns, utilizes, and / or operates a client device for initiating a transaction (e.g., for initiating a transaction with a transaction service provider).

[0054] As used herein, the term "server" may refer to at least one computing device (e.g., a processor, a storage device, a similar computer component, etc.) that communicates with a client device and / or other computing devices over a network (e.g., a public network, the Internet, a private network, etc.) and, in some instances, facilitates communication between other servers and / or client devices. It should be understood that various other arrangements are possible. As used herein, the term "system" may refer to at least one computing device or a combination of computing devices (e.g., a processor, a server, a client device, a software application, a component of these computing devices, etc.). As used herein, references to "device," "server," "processor," etc. may refer to a previously stated device, server, or processor, a different server or processor, and / or a combination of servers and / or processors that is stated to perform a previous step or function. For example, as used in the specification and claims, a first server or first processor stated to perform a first step or first function may refer to the same or different server or the same or different processor stated to perform a second step or second function.

[0055] Non-limiting embodiments of the disclosed subject matter relate to methods, systems, and computer program products for preventing malicious data transmission. The methods described herein may include, for example, receiving transaction data including at least one data packet associated with a payment transaction; extracting at least one of network layer data or transport layer data from a header of the at least one data packet; determining, using a classifier, a first probability that the at least one data packet belongs to a first category based on at least one of the network layer data or the transport layer data; determining, using the classifier, a second probability that the at least one data packet belongs to a second category based on at least one of the network layer data or the transport layer data; and blocking the at least one data packet.

[0056] Such embodiments provide techniques and systems for preventing the transmission of malicious data. Consequently, subsequently received data associated with non-fraudulent payment transactions can avoid being placed in a queue to be processed by a fraud detection system, thereby reducing the amount of time associated with determining whether to authorize a payment transaction. Additionally or alternatively, a system receiving malicious data can conserve computing resources that could otherwise be diverted to identifying malicious data and / or malicious data traffic.

[0057] For illustrative purposes, in the following description, although the presently disclosed subject matter is described with respect to systems, methods, and computer program products for preventing malicious data transmission, for example, based on trained classifiers, those skilled in the art will recognize that the disclosed subject matter is not limited to the illustrative embodiments. For example, the methods, systems, and computer program products described herein can be used with a wide variety of settings, such as for preventing malicious data transmission in any suitable setting, such as card-present payment transactions (e.g., via a POS system at a merchant's location), online payment transactions (e.g., via a merchant's website on the Internet), interacting with electronic content (e.g., via a website, search engine, mobile application, etc.), and the like.

[0058] Now refer to Figure 1 , Figure 1 is a diagram of a non-limiting embodiment of an environment 100 in which systems, products, and / or methods as described herein may be implemented. Figure 1 As shown, environment 100 may include a transaction service provider system 102 , an issuer system 104 , a user device 106 , a merchant system 108 , an acquirer system 110 , and a network 112 .

[0059] The transaction service provider system 102 may include at least one device capable of communicating with the issuer system 104, the user device 106, the merchant system 108, and / or the acquirer system 110 via a network 112. For example, the transaction service provider system 102 may include a computing device (e.g., a server, a server cluster, and / or other similar devices). In some non-limiting embodiments or aspects, the transaction service provider system 102 may be associated with a transaction service provider as described herein. In some non-limiting embodiments, the transaction service provider system 102 may be capable of communicating with a data storage device, which may be local or remote to the transaction service provider system 102. In some non-limiting embodiments, the transaction service provider system 102 may be capable of receiving data from the data storage device, storing data in the data storage device, transmitting data to the data storage device, or searching data stored in the data storage device. In some non-limiting embodiments or aspects, the transaction service provider system 102 may include at least one component implemented by the transaction service provider system 102, such as a first firewall 102-a, a second firewall 102-b, an application layer 102-c, a fraud detection system 102-d, and / or a classifier 102-e. In some non-limiting embodiments or aspects, the first firewall 102-a may be configured to analyze and block malicious data (e.g., at least one message, data packet, etc.) at Layer 3 and / or Layer 4 of the Open Systems Interconnection (OSI) model. In some non-limiting embodiments or aspects, the second firewall 102-b may be configured to analyze and block malicious data (e.g., at least one message, data packet, etc.) at Layers 3 through 7 of the OSI model. In some non-limiting embodiments or aspects, the application layer 102-c may be configured to analyze and block malicious data based on input represented as data included in at least one data packet (e.g., data associated with a PAN, an email address, a phone number, a user fingerprint representation, a user identifier, etc.). In some non-limiting embodiments or aspects, the application layer 102-c may decrypt the data included in the at least one data packet before analyzing and blocking the data. In some non-limiting embodiments or aspects, the fraud detection system 102-d may analyze and block malicious data based on determining a score for the data (e.g., a risk score as described herein). The score may be determined based on the data included in the at least one data packet. In some non-limiting embodiments or aspects, the classifier 102 - e may be configured to determine one or more probabilities (eg, a first probability, a second probability, a third probability, a fourth probability, a fifth probability, etc.).

[0060] The issuer system 104 may include at least one device capable of communicating with the transaction service provider system 102, the user device 106, the merchant system 108, and / or the acquirer system 110 via the network 112. For example, the issuer system 104 may include at least one computing device (e.g., a server, a server group, and / or other similar devices). In some non-limiting embodiments or aspects, the issuer system 104 may be associated with an issuer institution that issues payment accounts and / or instruments (e.g., credit accounts, debit accounts, credit cards, debit cards, etc.) to users (e.g., users associated with the user device 106, etc.).

[0061] The user device 106 may include at least one device capable of communicating with the issuer system 104, the merchant system 108, and / or the acquirer system 110 via the network 114. For example, the user device 106 may include a computing device such as a client device. The user device 106 may be configured to communicate with the issuer system 104, the merchant system 108, and / or the acquirer system 110 via an imaging system and / or a short-range wireless communication connection (e.g., an NFC communication connection, an RFID communication connection, communication connection, etc.) to transmit data to and / or receive data from the merchant system 108. In some non-limiting embodiments or aspects, the user device 106 can be associated with a user (eg, an individual operating the device).

[0062] The merchant system 108 may include a device capable of communicating with the transaction service provider system 102, the issuer system 104, the user device 106, and / or the acquirer system 110 via a network 112. For example, the merchant system 108 may include at least one computing device (e.g., a server, a server group, a client device, a client device group, and / or other similar devices). The merchant system 108 may be configured to transmit data to and / or receive data from the user device 106 via an imaging system and / or a short-range wireless communication connection. In some non-limiting embodiments or aspects, the merchant system 108 may include a point of sale (POS) device. In some non-limiting embodiments or aspects, the merchant system 108 may be associated with a merchant as described herein.

[0063] The acquirer system 110 may include at least one device capable of communicating with the transaction service provider system 102, the issuer system 104, the user device 106, the merchant system 108, and / or the acquirer system 110 via a network 112. For example, the acquirer system 110 may include a computing device (e.g., a server, a server group, and / or other similar devices). In some non-limiting embodiments or aspects, the acquirer system 110 may be associated with an acquirer as described herein.

[0064] The network 112 may include at least one wired and / or wireless network. For example, the network 112 may include a cellular network (e.g., a long-term evolution (LTE) network, a third-generation (3G) network, a fourth-generation (4G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), a private network (e.g., a private network associated with a transaction service provider), an ad hoc network, an intranet, the Internet, a fiber-optic-based network, a cloud computing network, etc., and / or combinations of these or other types of networks.

[0065] Provided as an example Figure 1 The number and arrangement of systems, devices, and / or networks shown in FIG. There may be additional systems, devices, and / or networks, fewer systems, devices, and / or networks, different systems, devices, and / or networks, and / or in a manner similar to that shown in FIG. Figure 1 The systems, devices and / or networks shown may be arranged in different ways. In addition, the systems, devices and / or networks may be implemented in a single system and / or device. Figure 1 Two or more systems or devices shown in, or Figure 1 The single system or device shown in the environment 100 may be implemented as multiple distributed systems or devices. Additionally or alternatively, one set of systems (e.g., at least one system) and / or one set of devices (e.g., at least one device) of the environment 100 may perform at least one function described as being performed by another set of systems or another set of devices of the environment 100.

[0066] Now refer to Figure 2 , Figure 2 is a diagram of example components of an apparatus 200. The apparatus 200 may correspond to at least one apparatus of the transaction service provider system 102, one or more components of the transaction service provider system 102 (e.g., the first firewall 102-a, the second firewall 102-b, the application layer 102-c, the fraud detection system 102-d, and / or the classifier 102-e), the issuer system 104, the user device 106, the merchant system 108, the acquirer system 108, and / or the network 112. In some non-limiting embodiments, the transaction service provider system 102, one or more components of the transaction service provider system 102 (e.g., the first firewall 102-a, the second firewall 102-b, the application layer 102-c, the fraud detection system 102-d, and / or the classifier 102-e), the issuer system 104, the user device 106, the merchant system 108, the acquirer system 108, and / or the network 112 may include at least one apparatus 200 and / or at least one component of the apparatus 200. Figure 2As shown, apparatus 200 may include a bus 202 , a processor 204 , a memory 206 , a storage component 208 , an input component 210 , an output component 212 , and a communication interface 214 .

[0067] The bus 202 may include components that permit communication between components of the device 200. In some non-limiting embodiments, the processor 204 may be implemented in hardware, software, or a combination of hardware and software. For example, the processor 204 may include a processor (e.g., a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), etc.), a microprocessor, a digital signal processor (DSP), and / or any processing component that can be programmed to perform a function (e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc.). The memory 206 may include random access memory (RAM), read-only memory (ROM), and / or another type of dynamic or static storage device (e.g., flash memory, magnetic memory, optical memory, etc.) that stores information and / or instructions for use by the processor 204.

[0068] The storage component 208 can store information and / or software related to the operation and use of the device 200. For example, the storage component 208 can include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optical disk, a solid-state disk, etc.), a compact disc (CD), a digital versatile disc (DVD), a floppy disk, a cassette, a magnetic tape, and / or another type of computer-readable medium, and a corresponding drive.

[0069] Input components 210 may include components that permit device 200 to receive information, for example, through user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, buttons, switches, a microphone, a camera, etc.). Additionally or alternatively, input components 210 may include sensors for sensing information (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, an actuator, etc.). Output components 212 may include components that provide output information from device 200 (e.g., a display, a speaker, at least one light emitting diode (LED), etc.).

[0070] The communication interface 214 may include a transceiver-type component (e.g., a transceiver, a separate receiver and transmitter, etc.) that enables the device 200 to communicate with other devices, for example, via a wired connection, a wireless connection, or a combination of wired and wireless connections. The communication interface 214 may permit the device 200 to receive information from another device and / or provide information to another device. For example, the communication interface 214 may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, interface, interface, interface, cellular network interface, etc.

[0071] Device 200 can perform at least one of the processes described herein. Device 200 can perform these processes based on processor 204 executing software instructions stored by a computer-readable medium, such as memory 206 and / or storage component 208. Computer-readable media (e.g., non-transitory computer-readable media) are defined herein as non-transitory memory devices. Non-transitory memory devices include memory space located within a single physical memory device or memory space distributed across multiple physical memory devices.

[0072] The software instructions may be read into the memory 206 and / or storage component 208 from another computer-readable medium or from another device via the communication interface 214. When executed, the software instructions stored in the memory 206 and / or storage component 208 may cause the processor 204 to perform at least one process described herein. Additionally or alternatively, hard-wired circuitry may be used in place of or in combination with software instructions to perform at least one process described herein. Thus, the embodiments described herein are not limited to any specific combination of hardware circuitry and software.

[0073] Figure 2 The number and arrangement of components shown in FIG are provided as examples. In some non-limiting embodiments, the apparatus 200 may include Figure 2 , or components that are arranged differently than those shown in . Additionally or alternatively, one set of components (e.g., at least one component) of device 200 may perform at least one function described as being performed by another set of components of device 200.

[0074] Now refer to Figure 3 , Figure 3is a flow chart of a non-limiting embodiment of a process 300 for preventing malicious data transmission. In some non-limiting embodiments, at least one of the steps of process 300 can be performed (e.g., completely, partially, etc.) by transaction service provider system 102. In some non-limiting embodiments, at least one of the steps of process 300 can be performed (e.g., completely, partially, etc.) by another system, another device, another group of systems, or another group of devices that are separate from or include transaction service provider system 102 (e.g., issuer system 104 (e.g., at least one device of issuer system 104), user device 106, merchant system 108 (e.g., at least one device of merchant system 108), acquirer system 110 (e.g., at least one device of acquirer system 110), etc.). In some non-limiting embodiments or aspects, at least one of the steps of process 300 may be performed (e.g., completely, partially, etc.) by at least one component implemented by the transaction service provider system 102, such as the first firewall 102-a, the second firewall 102-b, the application layer 102-c, the fraud detection system 102-d and / or the classifier 102-e.

[0075] like Figure 3 As shown, at step 302, process 300 may include receiving transaction data. For example, transaction service provider system 102 may receive transaction data from acquirer system 110. The transaction data may be used for a payment transaction involving a user associated with user device 106 and a merchant associated with merchant system 108. In another example, transaction service provider system 102 may receive transaction data from issuer system 104, merchant system 108, a payment gateway system associated with a payment gateway described herein, and / or other similar systems involved in processing payment transactions. In some non-limiting embodiments or aspects, transaction service provider system 102 may receive a message including data as described herein. For example, transaction service provider system 102 may receive a message including transaction data (e.g., an authorization request message). In this example, the transaction data may include at least one data packet, as described herein.

[0076] In some non-limiting embodiments or aspects, the transaction data may include at least one data packet associated with a payment transaction. Additionally or alternatively, the transaction data may include multiple data packets associated with the at least one payment transaction. For example, the at least one payment transaction may correspond to at least one data packet among the multiple data packets included in the transaction data. In some non-limiting embodiments or aspects, the at least one data packet included in the transaction data may include a header (e.g., a Hypertext Transfer Protocol (HTTP) header, etc.). For example, the at least one data packet included in the transaction data may include a header that includes data, such as network layer data (e.g., data associated with the network layer) and / or transport layer data (e.g., data associated with the transport layer). Additionally or alternatively, the at least one data packet included in the transaction data may include at least one of session layer data (e.g., data associated with a session), presentation layer data (e.g., data associated with formatting and passing information to the application layer for further processing and display), and / or application layer data (e.g., data associated with the application layer of a shared communication protocol and interface method used by hosts in a specified network).

[0077] like Figure 3 As shown, at step 304, process 300 may include extracting network layer data and / or transport layer data. For example, transaction service provider system 102 may extract network layer data and / or transport layer data from at least one data packet included in the transaction data. In this example, transaction service provider system 102 may extract network layer data and / or transport layer data from a header of at least one data packet included in the transaction data. In some non-limiting embodiments or aspects, transaction service provider system 102 may extract network layer data and / or transport layer data based on receipt of the transaction data by transaction service provider system 102.

[0078] like Figure 3As shown, at step 306, process 300 may include determining probabilities associated with a first category, a second category, and / or a third category. For example, transaction service provider system 102 may determine a first probability indicating that at least one data packet is associated with a first category, the first category being associated with data packets that should be blocked from further transmission (e.g., further transmission between one or more components implemented in transaction service provider system 102 and / or from transaction service provider system 102 to at least one other system, such as issuer system 104). Transaction service provider system 102 may determine a second probability indicating that at least one data packet is associated with a second category, the second category being associated with data packets that should be permitted to be transmitted (e.g., permitted to be transmitted between one or more components implemented in transaction service provider system 102 and / or from transaction service provider system 102 to at least one other system, such as issuer system 104). The transaction service provider system 102 may determine a fifth probability indicating that the at least one data packet is associated with a third category, wherein the third category is associated with the data packet that should be further analyzed before further transmission (e.g., further transmission between one or more components implemented in the transaction service provider system 102 and / or from the transaction service provider system 102 to at least one other system, such as the issuer system 104).

[0079] In some non-limiting embodiments or aspects, the transaction service provider system 102 may determine the first probability, the second probability, and / or the fifth probability based on data extracted from a header of at least one data packet. For example, the transaction service provider system 102 may determine the first probability, the second probability, and / or the fifth probability based on at least one of network layer data or transport layer data. Additionally or alternatively, the transaction service provider system 102 may determine the first probability, the second probability, and / or the fifth probability based on data extracted from the at least one data packet by the transaction service provider system 102. For example, in addition to or instead of determining the first probability, the second probability, and / or the fifth probability based on at least one of session layer data, presentation layer data, or application layer data. In some non-limiting embodiments or aspects, the transaction service provider system 102 may determine the first probability, the second probability, and / or the fifth probability based on the transaction service provider system 102 receiving transaction data at a component of the transaction service provider system 102 (e.g., the first firewall 102-a, the second firewall 102-b, the application layer 102-c, the fraud detection system 102-d, the classifier 102-e, etc.).

[0080] In some non-limiting embodiments or aspects, the transaction service provider system 102 may use the classifier 102-e to determine the first probability, the second probability, and / or the fifth probability. For example, the transaction service provider system 102 may use the classifier 102-e to determine the first probability, the second probability, and / or the fifth probability based on the transaction service provider system 102 causing data extracted from the transaction data (e.g., at least one of network layer data, transport layer data, session layer data, presentation layer data, and / or application layer data) to be provided to the classifier 102-e. In this example, the transaction service provider system 102 may cause at least one component of the transaction service provider system 102 to provide the data extracted from the transaction data to the classifier 102-e, so that the classifier determines the first probability, the second probability, and / or the fifth probability based on (e.g., in response to) the at least one component receiving the data extracted from the transaction data. The at least one component of the transaction service provider system 102 may then receive the first probability, the second probability, and / or the fifth probability from the classifier 102-e. The transaction service provider system 102 may determine a first probability, a second probability, and / or a fifth probability that the data extracted from the transaction data and provided to the classifier 102-e corresponds to the transaction data and / or at least one data packet included in the transaction data based on the transaction service provider system 102 determining that the data corresponding to the transaction data and / or at least one data packet included in the transaction data.

[0081] In some non-limiting embodiments or aspects, the transaction service provider system 102 may train the classifier 102-e. For example, the transaction service provider system 102 may execute a supervised learning algorithm based on transaction data associated with malicious network traffic and transaction data associated with non-malicious network traffic. Thus, after training, the classifier 102-e may then receive transaction data and make at least one prediction (e.g., determining at least one probability as described herein). The prediction may then be transmitted to at least one component of the transaction service provider system 102 that requested the prediction.

[0082] In some non-limiting embodiments or aspects, the transaction service provider system 102 may compare the first probability, the second probability, and / or the fifth probability. For example, the transaction service provider system 102 may compare the first probability, the second probability, and / or the fifth probability, and may determine whether the first probability, the second probability, or the fifth probability is greater than or not greater than one or more of the other probabilities. In this example, the transaction service provider system 102 may compare the first probability with the second probability, and may determine whether the first probability is greater than or not greater than the second probability based on the comparison. In another example, the transaction service provider system 102 may compare the first probability and / or the second probability with a fifth probability, and may determine whether the fifth probability is greater than or not greater than the first probability and / or the second probability based on the comparison.

[0083] In some non-limiting embodiments or aspects, the transaction service provider system 102 may determine that the transaction data is associated with a first category, a second category, and / or a third category. For example, the transaction service provider system 102 may determine that the transaction data and / or at least one data packet included in the transaction data is associated with the first category based on the transaction service provider system 102 determining that the first probability is greater than the second probability and / or the fifth probability. In another example, the transaction service provider system 102 may determine that the transaction data and / or at least one data packet included in the transaction data is associated with the second category based on the transaction service provider system 102 determining that the second probability is greater than the first probability and / or the fifth probability. In another example, the transaction service provider system 102 may determine that the transaction data and / or at least one data packet included in the transaction data is associated with the third category based on the transaction service provider system 102 determining that the fifth probability is greater than the first probability and / or the second probability.

[0084] like Figure 3As shown, at step 308, process 300 may include blocking based on probability. For example, transaction service provider system 102 may block transmission of transaction data and / or at least one data packet included in the transaction data based on transaction service provider system 102 determining that a first probability is greater than a second probability and / or a fifth probability. In this example, transaction service provider system 102 may determine that the transaction data and / or at least one data packet included in the transaction data is associated with a first category based on the first probability, the second probability, and / or the fifth probability, and transaction service provider system 102 may block transmission of the at least one data packet included in the transaction data associated with the first category. In some non-limiting embodiments or aspects, transaction service provider system 102 may forgo blocking the transaction data and / or at least one data packet included in the transaction data. For example, transaction service provider system 102 may forgo blocking the transaction data and / or at least one data packet included in the transaction data based on transaction service provider system 102 determining that the transaction data is associated with the second category and / or the third category.

[0085] like Figure 3 As shown, at step 310, process 300 may include extracting session layer data, presentation layer data, and / or application layer data. For example, transaction service provider system 102 may extract session layer data, presentation layer data, and / or application layer data from at least one data packet included in the transaction data. In some non-limiting embodiments or aspects, transaction service provider system 102 may extract the session layer data, presentation layer data, and / or application layer data based on (e.g., in response to and / or after) transaction service provider system 102 determining that the transaction data and / or at least one data packet included in the transaction data is associated with the second category and / or the third category.

[0086] like Figure 3As shown, at step 312, process 300 may include determining probabilities associated with the first, second, and / or third categories. For example, transaction service provider system 102 may determine the third, fourth, and / or fifth probabilities based on data extracted from the transaction data. In some non-limiting embodiments or aspects, transaction service provider system 102 may determine the third, fourth, and / or fifth probabilities based on at least one of session layer data, presentation layer data, and / or application layer data. Additionally or alternatively, transaction service provider system 102 may determine the third, fourth, and / or fifth probabilities based on data extracted by transaction service provider system 102 from a header of at least one data packet. For example, in addition to or instead of determining the third, fourth, and / or fifth probabilities based on at least one of network layer data and / or transport layer data, transaction service provider system 102 may determine the third, fourth, and / or fifth probabilities based on at least one of session layer data, presentation layer data, and / or application layer data. In some non-limiting embodiments or aspects, the transaction service provider system 102 may determine the third probability, the fourth probability, and / or the fifth probability based on the transaction service provider system 102 receiving the transaction data. In this example, the transaction service provider system 102 may cause at least one component of the transaction service provider system 102 to determine the third probability, the fourth probability, and / or the fifth probability based on the transaction service provider system 102 receiving the transaction data at the second firewall 102-b.

[0087] In some non-limiting embodiments or aspects, the transaction service provider system 102 may use the classifier 102-e to determine the third, fourth, and / or fifth probabilities. For example, the transaction service provider system 102 may use the classifier 102-e to determine the third, fourth, and / or fifth probabilities based on the transaction service provider system 102 providing data extracted from the transaction data (e.g., at least one of network layer data, transport layer data, session layer data, presentation layer data, and / or application layer data) to the classifier 102-e. In this example, the transaction service provider system 102 may cause at least one component of the transaction service provider system 102 to provide the data extracted from the transaction data to the classifier 102-e, so that the classifier 102-e determines the third, fourth, and / or fifth probabilities based on (e.g., in response to) the at least one component receiving the data extracted from the transaction data. The at least one component of the transaction service provider system 102 may then receive the third, fourth, and / or fifth probabilities from the classifier 102-e. The transaction service provider system 102 may determine a third probability, a fourth probability, and / or a fifth probability that the data extracted from the transaction data and provided to the classifier 102-e corresponds to the transaction data and / or at least one data packet included in the transaction data based on the transaction service provider system 102 determining that the data corresponding to the transaction data and / or at least one data packet included in the transaction data.

[0088] In some non-limiting embodiments or aspects, the transaction service provider system 102 may compare the third probability, the fourth probability, and / or the fifth probability. For example, the transaction service provider system 102 may compare the third probability, the fourth probability, and / or the fifth probability, and may determine whether the third probability, the fourth probability, or the fifth probability is greater than or not greater than one or more of the other probabilities. In this example, the transaction service provider system 102 may compare the third probability with the fourth probability, and may determine whether the third probability is greater than or not greater than the fourth probability based on the comparison. In another example, the transaction service provider system 102 may compare the third probability and / or the fourth probability with the fifth probability, and may determine whether the fifth probability is greater than or not greater than the first probability and / or the second probability based on the comparison.

[0089] In some non-limiting embodiments or aspects, the transaction service provider system 102 may determine that the transaction data is associated with the first category, the second category, and / or the third category. For example, the transaction service provider system 102 may determine that the transaction data and / or at least one data packet included in the transaction data is associated with the first category based on the transaction service provider system 102 determining that the third probability is greater than the fourth probability and / or the fifth probability. In this example, Figure 3As shown, at step 314, the transaction service provider system 102 may block or separate the transaction data based on the probability (e.g., the transaction service provider system 102 may block the transmission of the transaction data and / or one or more data packets included in the transaction data). In another example, the transaction service provider system 102 may determine that the transaction data and / or at least one data packet included in the transaction data is associated with the second category based on the transaction service provider system 102 determining that the fourth probability is greater than the third probability and / or the fifth probability. In another example, the transaction service provider system 102 may determine that the transaction data and / or at least one data packet included in the transaction data is associated with the third category based on the transaction service provider system 102 determining that the fifth probability is greater than the third probability and / or the fourth probability.

[0090] like Figure 3 As shown, at step 316, process 300 may include determining a score (e.g., a risk score indicating the likelihood that the transaction data and / or at least one data packet included in the transaction data is associated with at least one fraudulent payment transaction). For example, transaction service provider system 102 may determine the score based on the third probability, the fourth probability, and / or the fifth probability. In some non-limiting embodiments or aspects, transaction service provider system 102 may determine the score based on (e.g., in response to and / or after) transaction service provider system 102 determines the third probability, the fourth probability, and / or the fifth probability. In some non-limiting embodiments or aspects, transaction service provider system 102 may add the score to the transaction data. For example, transaction service provider system 102 may include the score in a header of at least one data packet included in the transaction data.

[0091] In some non-limiting embodiments or aspects, transaction service provider system 102 may cause a separate computing system and / or a computing system included in transaction service provider system 102 to confirm whether the transaction data and / or at least one data packet included in the transaction data is associated with a fraudulent payment transaction. For example, transaction service provider system 102 may determine that the transaction data and / or at least one data packet included in the transaction data is associated with a third category. In this example, transaction service provider system 102 may transmit a message to the separate computing system and / or a computing system included in transaction service provider system 102 to confirm that the transaction data and / or at least one data packet included in the transaction data is not associated with a fraudulent payment transaction. In this example, the separate computing system and / or a computing system included in transaction service provider system 102 may transmit a message to user device 106 to cause user device 106 to display an input prompt indicating that the user associated with user device 106 is human (e.g., not a robot and / or automated system). The separate computing system and / or the computing system included in the transaction service provider system 102 may receive input from the user device 106 and determine whether the transaction data and / or at least one data packet included in the transaction data is associated with a fraudulent payment transaction based on the input received from the user device 106. If the separate computing system and / or the computing system included in the transaction service provider system 102 determines that the transaction data and / or at least one data packet included in the transaction data is associated with a fraudulent payment transaction, the separate computing system and / or the computing system included in the transaction service provider system 102 may transmit a message to the transaction service provider system 102 including an indication that the transaction data and / or at least one data packet included in the transaction data is associated with the fraudulent payment transaction. If the separate computing system and / or the computing system included in the transaction service provider system 102 determines that the transaction data and / or at least one data packet included in the transaction data is not associated with a fraudulent payment transaction, the separate computing system and / or the computing system included in the transaction service provider system 102 may transmit a message to the transaction service provider system 102 including an indication that the transaction data and / or at least one data packet included in the transaction data is not associated with a fraudulent payment transaction.

[0092] Now refer to Figures 4A-4C , Figures 4A-4C is a diagram of an implementation 400 of a non-limiting embodiment of a process for preventing malicious data transmission. In some non-limiting embodiments or aspects, the process may be Figure 3 The process 300 shown is the same or similar. Figures 4A-4CAs shown, embodiment 400 may include a transaction service provider system 402 and an acquirer system 410. In some non-limiting embodiments or aspects, transaction service provider system 402 may be the same as or similar to transaction service provider system 102. In some non-limiting embodiments or aspects, acquirer system 410 may be the same as or similar to acquirer system 110, issuer system 104, and / or merchant system 108.

[0093] like Figure 4A As shown at 415 in FIG. 4 , the acquirer system 410 may transmit transaction data associated with the payment transaction to the transaction service provider system 402. For example, the acquirer system 410 may transmit transaction data associated with the payment transaction to the transaction service provider system 402 based on (e.g., in response to) a user device (e.g., Figure 1 In one embodiment, a user device (e.g., a user device that is the same as or similar to user device 106) communicates with a merchant system (e.g., a merchant system that is the same as or similar to merchant system 108) to transmit transaction data associated with a payment transaction to transaction service provider system 402 to initiate a payment transaction involving a user associated with the user device and a merchant associated with the merchant system. In this example, the merchant system may communicate with acquirer system 410 to provide data associated with the payment transaction to be processed. Acquirer system 410 may then generate and / or transmit payment transaction data associated with the payment transaction to transaction service provider system 402.

[0094] like Figure 4B As shown in FIG4 , transaction service provider system 402 may determine whether transaction data associated with a payment transaction is fraudulent transaction data associated with a fraudulent payment transaction. For example, transaction service provider system 402 may transmit at least one data packet to first firewall 402-a, then transmit the data packet from first firewall 402-a to second firewall 402-b, then transmit the data packet from second firewall 402-b to application layer 402-c, and then transmit the data packet from application layer 402-c to fraud detection system 402-d. In this example, transaction service provider system 402 may determine whether the transaction data associated with the payment transaction is fraudulent transaction data associated with a fraudulent payment transaction based on analyzing the transaction data associated with the payment transaction. In some non-limiting embodiments or aspects, transaction service provider system 402 may determine a score indicating a likelihood that the transaction data associated with the payment transaction is fraudulent transaction data associated with a fraudulent payment transaction, and transaction service provider system 402 may compare the score to a fraudulent transaction score threshold. The transaction service provider system 402 may then determine that the transaction data associated with the payment transaction is fraudulent transaction data associated with a fraudulent payment transaction based on comparing the score to the fraudulent transaction score threshold.

[0095] In some non-limiting embodiments or aspects, the transaction service provider system 402 may forgo transmitting the transaction data associated with the payment transaction to the at least one computing device. For example, the transaction service provider system 402 may forgo transmitting the transaction data associated with the payment transaction to the at least one computing device based on the transaction service provider system 402 determining that the transaction data associated with the payment transaction is fraudulent transaction data associated with a fraudulent payment transaction. In this example, the transaction service provider system 402 may forgo transmitting the transaction data associated with the payment transaction to the issuer system (e.g., an issuer system) based on the transaction service provider system 402 determining that the transaction data associated with the payment transaction is fraudulent transaction data associated with a fraudulent payment transaction. Figure 1 Issuer system 104 that is the same as or similar to the issuer system).

[0096] like Figure 4C As shown at reference numeral 425 in FIG, transaction service provider system 402 may transmit transaction response data associated with the payment transaction to acquirer system 410. For example, transaction service provider system 402 may transmit transaction response data associated with the payment transaction to acquirer system 410 to indicate that the transaction data associated with the payment transaction is fraudulent transaction data associated with a fraudulent payment transaction. In some non-limiting embodiments or aspects, transaction service provider system 402 may transmit transaction response data associated with the payment transaction to an issuer system (e.g., an issuer system that is the same as or similar to issuer system 104) to indicate that the transaction data associated with the payment transaction is fraudulent transaction data associated with a fraudulent payment transaction.

[0097] Now refer to Figures 5A-5F , Figures 5A-5F is a diagram of an implementation 500 of a non-limiting embodiment related to a process for preventing malicious data transmission. In some non-limiting embodiments or aspects, the process may be Figure 3 The process 300 shown is the same or similar. Figures 5A-5F As shown, embodiment 500 may include a transaction service provider system 502, an acquirer system 510, and a computing system 514. In some non-limiting embodiments or aspects, transaction service provider system 502 may be the same as or similar to transaction service provider system 102 and / or transaction service provider system 402. In some non-limiting embodiments or aspects, acquirer system 510 may be the same as or similar to acquirer system 410, acquirer system 110, issuer system 104, and / or merchant system 108.

[0098] In some non-limiting embodiments or aspects, computing system 514 may be a computing system outside of the communication path for processing payment transactions. For example, the communication path for processing payment transactions may be associated with a network that includes acquirer system 410 and transaction service provider system 402 in a communication path (e.g., a communication path, a communication channel, a communication network, etc.). As an example, the network included in the communication path may process (e.g., initiate, conduct, authorize, etc.) an electronic payment transaction via the communication path between acquirer system 410 and transaction service provider system 402. In some non-limiting embodiments or aspects, the network that includes acquirer system 410 and transaction service provider system 402 in the communication path may additionally and / or alternatively include an issuer system (e.g., an issuer system that is the same as or similar to issuer system 104), a user device (e.g., a user device that is the same as or similar to user device 106), a merchant system (e.g., a merchant system that is the same as or similar to merchant system 108), and / or other similar systems described herein that may be involved in processing electronic payment transactions.

[0099] like Figure 5A As shown at 515 in FIG. 5 , the acquirer system 510 may transmit transaction data associated with the payment transaction to the transaction service provider system 502. For example, the acquirer system 510 may be based on (e.g., in response to) a user device (e.g., a user device connected to a payment service provider). Figure 1 In one embodiment, a user device (e.g., a user device 106 that is the same as or similar to the user device 106) communicates with a merchant system (e.g., a merchant system that is the same as or similar to the merchant system 108) to transmit transaction data associated with the payment transaction to the transaction service provider system 502 to initiate a payment transaction involving a user associated with the user device and a merchant associated with the merchant system. In this example, the merchant system may communicate with the acquirer system 510 to provide data associated with the payment transaction to be processed. The acquirer system 510 may then generate and / or transmit payment transaction data associated with the payment transaction to the transaction service provider system 502.

[0100] like Figure 5BAs shown in FIG5 , transaction service provider system 502 may use classifier 502-e to determine a first probability and a second probability. For example, transaction service provider system 502 may determine the first probability and the second probability based on transaction service provider system 502 receiving transaction data associated with a payment transaction at first firewall 502-a. The first probability may indicate a likelihood that at least one packet included in the transaction data belongs to a first category (e.g., a category of payment transactions associated with fraudulent payment transactions to be blocked). The second probability may indicate a likelihood that at least one packet included in the transaction data belongs to a second category (e.g., a category of payment transactions associated with non-fraudulent transactions). In this example, transaction service provider system 502 may extract at least one of network layer data or transport layer data from a header of at least one packet included in the transaction data at first firewall 502-a. Transaction service provider system 502 may then transmit at least one of the network layer data or transport layer data to classifier 502-e, causing classifier 502-e to determine the first probability and the second probability based on the at least one of the network layer data or transport layer data.

[0101] In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data from the network layer data and / or transport layer data as described herein, and the transaction service provider system 502 may provide the data derived from the network layer data and / or transport layer data to the classifier 502-e. Additionally or alternatively, the classifier 502-e may derive data from the network layer data and / or transport layer data as described herein. For example, the transaction service provider system 502 may derive data from the network layer data and / or transport layer data by querying at least one database to derive data from the network layer data and / or transport layer data. In this example, the transaction service provider system 502 may derive data associated with a history of total payment amounts associated with Internet Protocol (IP) addresses involved in payment transactions initiated by user devices from the network layer data and / or transport layer data. The history may extend over a period of time (e.g., a week, a month, etc.). The transaction service provider system 502 may then derive a Bayesian network value based on the data derived from the network layer data and / or transport layer data. In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data associated with a history of malicious data originating from an IP address (e.g., transaction data associated with fraudulent payment transactions, etc.) from the network-layer data and / or transport-layer data. For example, the transaction service provider system 502 may submit an IP address (e.g., an IP address associated with a physical address, an IP address associated with a region (e.g., a town, state, country, etc.)) to a database of IP addresses associated with malicious data transmissions to query the database and receive an indication from the database of whether to block the IP address. In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data associated with a history of authorization requests involving the IP address from the network-layer data and / or transport-layer data. For example, the transaction service provider system 502 may query a database of IP addresses associated with authorization requests and / or authorization responses and receive an indication from the database of whether the IP address is associated with a volume of authorization requests exceeding a threshold (e.g., a predetermined threshold of authorization requests granted within a period of time). In some non-limiting embodiments or aspects, the transaction service provider system 502 may determine whether the IP address is included on a block list (e.g., a list of IP addresses from which payment transactions are not permitted). For example, the transaction service provider system 502 may query a database of IP addresses associated with blocked IP addresses (e.g., IP addresses associated with malicious traffic). The block list may be a database maintained by the transaction service provider system 502 and / or a database included in a different computing device (e.g., Figure 1In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data associated with a threat intelligence risk score from the network layer data and / or the transport layer data, the threat intelligence risk score being associated with an indication of whether an IP address is associated with spam messages and / or data, malicious messages and / or data, messages and / or data that cannot be attributed to a device (e.g., anonymous messages, anonymized data, etc.), phishing data and / or messages, etc. In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data associated with traffic associated with at least one application involved in processing transaction data from the network layer data and / or the transport layer data. For example, the transaction service provider system 502 may determine whether the at least one application is a critical application (e.g., an application that directly affects whether a payment transaction is authorized). The transaction service provider system 502 may then determine that a volume of data packets transmitted to the at least one application exceeds a data packet threshold (e.g., a threshold associated with a volume of data packets that the application is configured to process within a period of time). In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data associated with passive fingerprinting (e.g., operating system fingerprinting) from the network layer data and / or transport layer data, such as TCP flags, time-to-live (TTL) labels, packet size, a do-not-fragment (DF) flag, whether the data and / or at least one packet included in the data is disguised as originating from a different operating system, and / or the like. It should be understood that some and / or all of the data described as being derived from the network layer data and / or transport layer data may additionally or alternatively be derived from session layer data, presentation layer data, or application layer data included in at least one packet included in the transaction data. Additionally or alternatively, some and / or all of the data described as being derived from session layer data, presentation layer data, and / or application layer data included in at least one packet may be derived from the network layer data and / or transport layer data.

[0102] like Figure 5BAs shown by reference numeral 525 in FIG, the transaction service provider system 502 may use the classifier 502-e to determine that at least one data packet is more likely to belong to the second category. For example, the transaction service provider system 502 may determine that at least one data packet is more likely to belong to the second category than the first category based on the transaction service provider system 502 receiving the first probability and the second probability from the classifier 502-e. In this example, the transaction service provider system 502 may compare the first probability with the second probability at the first firewall 502-a. If the transaction service provider system 502 determines that the first probability is greater than the second probability, the transaction service provider system 502 may cause the first firewall 502-a to block the at least one data packet. Alternatively, if the transaction service provider system 502 determines that the first probability is not greater than the second probability, as shown in FIG. Figure 5C As shown at reference numeral 530 in FIG. , the transaction service provider system 502 may permit the first firewall 502 - a to transmit at least one data packet.

[0103] like Figure 5DAs shown in FIG5 , at reference numeral 535, the transaction service provider system 502 may use the classifier 502-e to determine a third probability, a fourth probability, and / or a fifth probability. For example, the transaction service provider system 502 may determine the third probability, the fourth probability, and / or the fifth probability based on the transaction service provider system 502 receiving transaction data associated with the payment transaction at the second firewall 502-b. The third probability may indicate a likelihood that at least one packet included in the transaction data belongs to the first category. The fourth probability may indicate a likelihood that at least one packet included in the transaction data belongs to the second category. The fifth probability may indicate a likelihood that at least one packet included in the transaction data belongs to the third category (e.g., a category of payment transactions that may be fraudulent payment transactions and should be subject to additional scrutiny to verify whether the payment transaction is a fraudulent payment transaction). In this example, the transaction service provider system 502 may extract at least one of session layer data, presentation layer data, or application layer data from a header of at least one packet included in the transaction data at the second firewall 502-b. The transaction service provider system 502 may then transmit at least one of the session layer data, presentation layer data, or application layer data to the classifier 502-e, causing the classifier 502-e to determine a third probability, a fourth probability, and / or a fifth probability based on at least one of the session layer data, presentation layer data, or application layer data and / or at least one of the network layer data or transport layer data. If the transaction service provider system 502 determines that the third probability is greater than the fourth probability and the fifth probability, the transaction service provider system 502 may cause the second firewall 502-b to block the at least one data packet. If the transaction service provider system 502 determines that the fourth probability is greater than the third probability and the fifth probability, the transaction service provider system 502 may forgo causing the second firewall 502-b to block the at least one data packet. If the transaction service provider system 502 determines that the fifth probability is greater than the third probability and the fourth probability, as shown in FIG. Figure 5D As shown in FIG5 , the transaction service provider system 502 may determine that at least one data packet is more likely to belong to the third category. In the case where the transaction service provider system 502 determines that at least one data packet is more likely to belong to the third category, as shown in FIG5 . Figure 5E As shown in FIG5 , the transaction service provider system 502 may cause the second firewall 502-b to transmit at least one data packet to the computing system 514 and request the computing system 514 to determine whether the at least one data packet is associated with a fraudulent payment transaction or a non-fraudulent payment transaction. In some non-limiting embodiments or aspects, the computing system 514 may be included in the transaction service provider system 502 and / or at least one system of the transaction service provider system 502 (e.g., the first firewall 502-a, the second firewall 502-b, the application layer 502-c, and / or the fraud detection system 502-d).

[0104] In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data from the session layer data, presentation layer data, and / or application layer data as described herein, and the transaction service provider system 502 may provide the data derived from the session layer data, presentation layer data, or application layer data to the classifier 502-e. Additionally or alternatively, the classifier 502-e may derive data from the session layer data, presentation layer data, or application layer data as described herein. In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data associated with passive fingerprinting (e.g., operating system fingerprinting) performed by, for example, TCP flags, a time-to-live (TTL) label, packet size, a do-not-fragment (DF) flag, whether the data and / or at least one packet included in the data is disguised as originating from a different operating system, from the session layer data, presentation layer data, and / or application layer data. In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data associated with at least one HTTP header from the session layer data, presentation layer data, and / or application layer data. For example, the transaction service provider system 502 may derive data associated with at least one header from the session layer data, presentation layer data, and / or application layer data, and the transaction service provider system 502 may determine whether the data packet has an expected header (e.g., a header associated with decrypted data and / or traffic, a header associated with an expected operating system and / or an unexpected operating system, etc.). In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data associated with a fuzzy hash of an input value from the session layer data, presentation layer data, and / or application layer data. For example, the transaction service provider system 502 may derive data associated with the fuzzy hash from the session layer data, presentation layer data, and / or application layer data, and the transaction service provider system 502 may compare percentages of inputs and / or normalized traffic that are normalized in a similar manner. In some non-limiting embodiments or aspects, the transaction service provider system 502 may derive data associated with at least one fraud value from the session layer data, presentation layer data, and / or application layer data. For example, the transaction service provider system 502 may derive data associated with email addresses, phone numbers, device fingerprints, etc. that are marked as fraudulent or non-fraudulent (e.g., in at least one database described herein) from the session layer data, presentation layer data, and / or application layer data.

[0105] In some non-limiting embodiments or aspects, the transaction service provider system 502 may provide at least one of the network layer data, transport layer data, session layer data, presentation layer data, and / or application layer data to the application layer 502-c to enable the application layer 502-c to determine whether the transaction data and / or at least one data packet included in the transaction data is associated with the first category, the second category, or the third category. For example, the transaction service provider system 502 may derive a decrypted value, such as a PAN, a user identifier, a transaction amount, etc., from at least one of the network layer data, transport layer data, session layer data, presentation layer data, and / or application layer data and provide the decrypted value to the application layer 502-c. The application layer 502-c may then determine whether the transaction data and / or at least one data packet included in the transaction data is associated with the first category, the second category, or the third category and transmit or forgo transmission of the transaction data and / or at least one data packet included in the transaction data as described herein.

[0106] In some non-limiting embodiments or aspects, the transaction service provider system 502 may provide at least one of the network layer data, transport layer data, session layer data, presentation layer data, and / or application layer data to the fraud detection system 502-d, so that the fraud detection system 502-d can determine whether the transaction data and / or at least one packet included in the transaction data is associated with the first category, the second category, or the third category. For example, the transaction service provider system 502 may derive a decryption value from at least one of the network layer data, transport layer data, session layer data, presentation layer data, and / or application layer data as described herein and provide the decryption value to the fraud detection system 502-d. The application layer 502-c may then determine whether the transaction data and / or at least one packet included in the transaction data is associated with the first category, the second category, or the third category, and transmit or forgo transmitting the transaction data and / or at least one packet included in the transaction data as described herein.

[0107] like Figure 5E As shown at 550 in FIG. 5 , the transaction service provider system 502 may receive a response that the at least one data packet is associated with a fraudulent payment transaction. For example, the transaction service provider system 502 may receive a response that the at least one data packet is associated with a fraudulent payment transaction based on the computing system 514 determining that the at least one data packet is associated with a fraudulent payment transaction. In this example, the computing system 514 may transmit a message to a user device (e.g., a user device) participating in the payment transaction. Figure 1 106) to cause the user device to display an input prompt indicating that the user is a valid user (e.g., by In addition or alternatively, computing system 514 may notify the user device to determine whether the transaction data has passed through one or more proxies, and / or computing system 514 may query a database to determine whether the IP address associated with the user device is associated with malicious data and / or messages. Computing system 514 may then determine a score associated with whether the user associated with the user device is human and / or an indication of the likelihood that the transaction data and / or at least one data packet included in the transaction data is associated with malicious data and / or malicious data packets based on the presence or absence of input provided by the user device, and provide the score and / or the indication that the user is or is not human to transaction service provider system 502. In some non-limiting embodiments or aspects, transaction service provider system 502 may determine whether the payment transaction is a fraudulent payment transaction based on the score and / or the indication that the user is or is not human.

[0108] like Figure 5F As shown at reference numeral 555 in FIG, transaction service provider system 502 may block transmission of at least one data packet. For example, transaction service provider system 502 may block transmission of at least one data packet based on transaction service provider system 502 determining that at least one data packet is associated with a fraudulent payment transaction. Additionally or alternatively, transaction service provider system 502 may forgo blocking transmission of at least one data packet based on transaction service provider system 502 determining that at least one data packet is not associated with a fraudulent payment transaction.

[0109] Although the disclosed subject matter has been described in detail for purposes of illustration based on what are presently considered to be the most practical and preferred embodiments, it should be understood that such details are provided for that purpose only and that the disclosed subject matter is not limited to the disclosed embodiments but, on the contrary, is intended to cover modifications and equivalent arrangements within the spirit and scope of the appended claims. For example, it should be understood that the presently disclosed subject matter contemplates that at least one feature of any embodiment can be combined with at least one feature of any other embodiment to the extent possible.

Claims

1. A computer-implemented method comprising: receiving, with at least one processor, transaction data comprising at least one data packet associated with a payment transaction; extracting, with at least one processor, at least one of network layer data or transport layer data from a header of the at least one data packet; determining, with at least one processor, using a classifier based on the at least one of the network layer data or the transport layer data, a first probability indicating that the at least one data packet belongs to a first category; determining, with at least one processor, using the classifier based on the at least one of the network layer data or the transport layer data, a second probability indicating that the at least one data packet belongs to a second category; determining that the first probability indicating that the at least one packet belongs to the first category is less than the second probability indicating that the at least one packet belongs to the second category; extracting at least one of session layer data, presentation layer data, or application layer data from the at least one data packet based on determining that the first probability indicating that the at least one data packet belongs to the first category is less than the second probability indicating that the at least one data packet belongs to the second category; determining, using the classifier, a third probability indicating that the at least one packet belongs to the first category based on the at least one of the session layer data, the presentation layer data, or the application layer data and at least one of the network layer data or the transport layer data; determining, using the classifier, a fourth probability indicating that the at least one packet belongs to the second category based on the at least one of the session layer data, the presentation layer data, or the application layer data and the at least one of the network layer data or the transport layer data; as well as determining, using the classifier, a fifth probability indicating that the at least one packet belongs to a third category based on the at least one of the session layer data, the presentation layer data, or the application layer data and the at least one of the network layer data or the transport layer data; as well as Based on determining that the third probability is greater than the fourth probability and the fifth probability, the at least one data packet is blocked using at least one processor.

2. The computer-implemented method of claim 1 , further comprising: determining that the first probability indicating that the at least one data packet belongs to the first category indicates the second probability that the at least one data packet belongs to the second category; Wherein preventing transmission of the at least one data packet comprises preventing the at least one data packet based on determining that the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category.

3. The computer-implemented method of claim 1 , further comprising: determining that the fourth probability is greater than the third probability and the fifth probability; as well as The at least one data packet is forwarded to a separate computing device based on a determination that the third probability is greater than the fourth probability and the fifth probability.

4. The computer-implemented method of claim 1 , further comprising: determining that the fifth probability is greater than the third probability and the fourth probability; as well as The at least one data packet is forwarded to a separate computing device based on a determination that the fifth probability is greater than the third probability and the fourth probability.

5. The computer-implemented method of claim 1 , further comprising: determining that the fourth probability is greater than the third probability and the fifth probability; as well as The at least one data packet is forwarded to a risk scoring platform.

6. The computer-implemented method of claim 1 , further comprising: determining a score associated with the at least one data packet based on at least one of the third probability, the fourth probability, or the fifth probability; as well as The score is added to the header of the at least one data packet.

7. A system comprising: at least one processor programmed or configured to: receiving transaction data, the transaction data comprising at least one data packet associated with a payment transaction; extracting at least one of network layer data or transport layer data from a header of the at least one data packet; determining, using a classifier, a first probability indicating that the at least one data packet belongs to a first category based on the at least one of the network layer data or the transport layer data; determining, using the classifier, a second probability indicating that the at least one data packet belongs to a second category based on the at least one of the network layer data or the transport layer data; and determining whether the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category, wherein, in response to determining that the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category, the at least one processor is programmed or configured to block the at least one data packet; and The at least one processor is further programmed or configured to: determining that the first probability indicating that the at least one packet belongs to the first category is less than the second probability indicating that the at least one packet belongs to the second category; extracting at least one of session layer data, presentation layer data, or application layer data from the at least one data packet based on determining that the first probability indicating that the at least one data packet belongs to the first category is less than the second probability indicating that the at least one data packet belongs to the second category; determining, using the classifier, a third probability indicating that the at least one packet belongs to the first category based on the at least one of the session layer data, the presentation layer data, or the application layer data and at least one of the network layer data or the transport layer data; determining, using the classifier, a fourth probability indicating that the at least one packet belongs to the second category based on the at least one of the session layer data, the presentation layer data, or the application layer data and the at least one of the network layer data or the transport layer data; and determining, using the classifier, a fifth probability indicating that the at least one packet belongs to a third category based on the at least one of the session layer data, the presentation layer data, or the application layer data and the at least one of the network layer data or the transport layer data; and Based on determining that the third probability is greater than the fourth probability and the fifth probability, the at least one data packet is blocked.

8. The system of claim 7, wherein the at least one processor is further programmed or configured to: determining that the fourth probability is greater than the third probability and the fifth probability; and The at least one data packet is forwarded to a separate computing device based on a determination that the third probability is greater than the fourth probability and the fifth probability.

9. The system of claim 7, wherein the at least one processor is further programmed or configured to: determining that the fifth probability is greater than the third probability and the fourth probability; and The at least one data packet is forwarded to a separate computing device based on a determination that the fifth probability is greater than the third probability and the fourth probability.

10. The system of claim 7, wherein the at least one processor is further programmed or configured to: determining that the fourth probability is greater than the third probability and the fifth probability; and The at least one data packet is forwarded to a risk scoring platform.

11. The system of claim 7, wherein the at least one processor is further programmed or configured to: determining a score associated with the at least one data packet based on at least one of the third probability, the fourth probability, or the fifth probability; and The score is added to the header of the at least one data packet.

12. A computer program product comprising at least one non-transitory computer-readable medium, the at least one non-transitory computer-readable medium comprising at least one instruction that, when executed by at least one processor, causes the at least one processor to: receiving transaction data, the transaction data comprising at least one data packet associated with a payment transaction; extracting at least one of network layer data or transport layer data from a header of the at least one data packet; determining, using a classifier, a first probability indicating that the at least one data packet belongs to a first category based on the at least one of the network layer data or the transport layer data; determining, using the classifier, a second probability indicating that the at least one data packet belongs to a second category based on the at least one of the network layer data or the transport layer data; and determining whether the first probability indicating that the at least one data packet belongs to the first category is greater than the second probability indicating that the at least one data packet belongs to the second category; extracting at least one of session layer data, presentation layer data, or application layer data from the at least one data packet based on determining that the first probability indicating that the at least one data packet belongs to the first category is less than the second probability indicating that the at least one data packet belongs to the second category; determining, using the classifier, a third probability indicating that the at least one packet belongs to the first category based on the at least one of the session layer data, the presentation layer data, or the application layer data and at least one of the network layer data or the transport layer data; determining, using the classifier, a fourth probability indicating that the at least one packet belongs to the second category based on the at least one of the session layer data, the presentation layer data, or the application layer data and the at least one of the network layer data or the transport layer data; and determining, using the classifier, a fifth probability indicating that the at least one packet belongs to a third category based on the at least one of the session layer data, the presentation layer data, or the application layer data and the at least one of the network layer data or the transport layer data; blocking the at least one data packet based on determining that the third probability is greater than the fourth probability and the fifth probability; wherein, in response to determining that the first probability indicating that the at least one packet belongs to the first category is greater than the second probability indicating that the at least one packet belongs to the second category, the at least one instruction causes the at least one processor to block the at least one packet.

13. The computer program product of claim 12, wherein the at least one instruction further causes the at least one processor to: determining that the fifth probability is greater than the third probability and the fourth probability; and The at least one data packet is forwarded to a separate computing device based on a determination that the fifth probability is greater than the third probability and the fourth probability.

14. The computer program product of claim 12, wherein the at least one instruction further causes the at least one processor to: determining that the fourth probability is greater than the third probability and the fifth probability; and The at least one data packet is forwarded to a risk scoring platform.

15. The computer program product of claim 12, wherein the at least one instruction further causes the at least one processor to: determining a score associated with the at least one data packet based on at least one of the third probability, the fourth probability, or the fifth probability; and The score is added to the header of the at least one data packet.

Images