Location N-gram Generation for Risk-Based Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing risk-based authentication technologies fail to detect anomalous user behavior based on user movements between locations preceding a current activity, due to increased system complexity and sparse historical behavior data as the number of locations increases, referred to as the 'curse of dimensionality'.
Innovation Solution
The use of location N-grams, which represent both a user's current and previous transaction locations, to generate a risk score indicating anomalous behavior, with techniques such as bi-grams and tri-grams to efficiently count location combinations and reduce data sparseness, allowing for accurate risk estimation and fraud detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If user location series are used to detect anomalous behavior, then detection accuracy is improved, but system complexity increases exponentially
Solution Approach 1:
The patent segments the user location series into fixed-size windows (e.g., W=3 locations) and extracts N-gram features (unigrams, bigrams, trigrams) from each window. This segmentation approach transforms the complex problem of analyzing entire location histories into manageable local patterns, reducing system complexity while preserving detection accuracy.
Solution Approach 2:
The patent extracts specific N-gram features (location sequences like 'NYC-LAX-NYC') from the user location series and uses these extracted features for anomaly detection. By focusing on specific recurring patterns rather than the entire location history, the system achieves accurate detection with reduced complexity.
2Measurement precision
If longer user location series are used, then detection accuracy is improved, but historical behavior data becomes more sparsely distributed
Solution Approach 1:
The patent divides long user location series into overlapping windows of fixed size (e.g., 3 consecutive locations). Each window generates N-gram features independently, ensuring sufficient data density in each local segment while capturing patterns from the overall long-term behavior through the accumulation of multiple windows.
Solution Approach 2:
The patent uses multiple overlapping windows rather than a single comprehensive analysis. By analyzing multiple partial segments (windows) that overlap, the system accumulates sufficient statistical data for accurate detection without requiring the entire long history to be densely populated with data points.
3Measurement precision
If more locations are considered in the series, then detection accuracy is improved, but the curse of dimensionality increases
Solution Approach 1:
The patent extracts N-gram features (unigrams, bigrams, trigrams of location sequences) from the user location series. By transforming the raw location data into a fixed set of N-gram features, the system reduces dimensionality while preserving the essential patterns needed for accurate anomaly detection.
Solution Approach 2:
The patent transforms the location series data into N-gram frequency parameters and uses these transformed parameters for detection. By changing the representation from raw location coordinates to N-gram frequency distributions, the system manages dimensionality effectively while maintaining detection accuracy.
Data Source
AI summary
Technology for providing risk-based authentication, in which a location N-gram is generated for each historical transaction, the location N-gram indicating both a location from which the historical transaction originated and at least one location from which at least one previous transaction performed by the user that performed the historical transaction originated. A counter corresponding to the location N-gram is identified and incremented in a behavior profile for the user. An anomalousness risk score for a current user transaction having the same location N-gram may be calculated based on a value of the counter. If the risk score exceeds a threshold, an alert may be issued or other action taken with regard to the current transaction. Techniques are provided that limit complexity resulting from using a series of locations to detect anomalous user behavior, and that reduce the sparseness of the generated historical behavior data.