Device Fingerprint Chain Analysis for Fraud Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing systems for identifying fraudulent activity in online banking face challenges such as device fingerprint collisions, inability to compare fingerprints in real-time due to large databases, and distinguishing between legitimate and duplicate device usage.

Innovation Solution

The method involves calculating a digital fingerprint of a user's device, determining a group of similar fingerprints, calculating feature vectors for changed features, estimating the probability of fingerprints belonging to the same chain, identifying candidate fingerprints exceeding a threshold, and comparing the calculated fingerprint with candidates to determine fraudulent activity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If device fingerprints are compared against all known fingerprints in the database, then identification accuracy is improved, but processing time increases significantly

Engineering Contradiction:
Improvefingerprint identification accuracyVSAvoidprocessing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent divides the large fingerprint database into multiple clusters or groups based on similarity metrics. Instead of comparing a query fingerprint against all fingerprints in the database, the system first identifies relevant clusters and performs detailed comparison only within those segments. This segmentation reduces the search space from millions of fingerprints to a manageable subset, maintaining identification accuracy while dramatically reducing processing time.

Inventive Principle:
Principle #1Segmentation

2Reliability

If device fingerprints are compared against all known fingerprints, then fraudulent activity detection is improved, but system complexity increases

Engineering Contradiction:
Improvefraud detection capabilityVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent performs preliminary actions by pre-processing fingerprints during enrollment to extract key features and organize them into structured representations. Fingerprints are pre-clustered and indexed based on their feature vectors, creating a prepared data structure that enables efficient querying. This preliminary organization reduces the complexity of real-time fraud detection, as the system only needs to perform targeted comparisons rather than brute-force searches through all fingerprints.

Inventive Principle:
Principle #10Preliminary action

3Productivity

If device fingerprints are grouped by similarity, then processing efficiency is improved, but risk of false positives increases

Engineering Contradiction:
Improveprocessing efficiencyVSAvoidfalse positive rate
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The patent incorporates feedback mechanisms where the results of fingerprint comparisons are used to refine and adjust the clustering parameters. When false positives are detected, the system learns from these errors by adjusting similarity thresholds and re-evaluating cluster boundaries. This feedback loop continuously optimizes the balance between processing efficiency and accuracy, reducing false positives while maintaining the benefits of grouped processing.

Inventive Principle:
Principle #23Feedback

Data Source

PatentEP3674942B1System and method of identifying fraudulent activity from a user device using a chain of device fingerprints
Publication Date: 2025.01.22 AO KASPERSKY LAB
  • EP3674942B1 patent drawingFigure 1
  • EP3674942B1 patent drawingFigure 2
  • EP3674942B1 patent drawingFigure 3

AI summary

The present disclosure provides systems and methods of selecting candidates for comparison of fingerprints of devices. An exemplary method comprises calculating a digital fingerprint of a device, determining a group of digital fingerprints where the digital fingerprint occurs, calculating vectors of changed features of each digital fingerprint, calculating a probability that the digital fingerprint and each digital fingerprint within the group belong to the same chain, identifying a set of candidates from the group whose probability of belonging to the same chain of fingerprints crosses a value, comparing the calculated digital fingerprint of the device with the fingerprints in the set of candidates, determine that the device correspond to a device in the set of candidates when the comparison results in a match higher than a specified threshold and permitting the user actions, otherwise tracking the user actions with the online service as fraudulent activity.