Breached Merchant Detection Using Card Data Divergence Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying breached merchants from stolen credit card records on the dark web is inaccurate, resource-intensive, and costly due to the lack of complete information, with thousands of records potentially matching a single data pair, and hacker behaviors continually changing.
Innovation Solution
A computerized method using statistical divergence measures, such as Bhattacharyya and Kullback-Liebler divergences, to compare dark web card data distributions with merchant transaction data, identifying predicted breached merchants by calculating divergence values between matching BINs and expiration dates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional matching methods are used to identify breached merchants from stolen credit card records, then the identification process can be performed, but the accuracy is poor and resource consumption is high due to the lack of complete information
Solution Approach 1:
The patent transforms the identification problem from direct record matching to statistical distribution comparison. By changing the parameter from individual record attributes to probability distribution characteristics (using divergence measures like Bhattacharyya or Kullback-Leibler divergence), the system achieves accurate merchant identification even with incomplete dark web data, resolving the contradiction between identification accuracy and resource consumption
Solution Approach 2:
The patent introduces probability distribution vectors as an intermediary between the dark web records and merchant identification. Instead of directly matching stolen card records to merchants, the system creates statistical representations (distribution vectors) that serve as intermediaries, enabling accurate identification while reducing computational complexity and resource requirements
2Reliability
If all potentially matching records are analyzed to identify breached merchants, then comprehensive coverage is achieved, but the process becomes resource-intensive and cost-prohibitive
Solution Approach 1:
The patent extracts only the essential statistical characteristics (probability distribution vectors) from large sets of records, rather than analyzing every individual record. By taking out and comparing only the distributional features using divergence measures, the system achieves reliable merchant identification with significantly reduced computational resource usage
Solution Approach 2:
The patent applies partial action by using divergence comparison on probability distributions rather than exhaustive record-by-record analysis. This partial approach (comparing distributions instead of all individual records) maintains identification reliability while dramatically reducing computational resources required
3Productivity
If dark web source files are used as the sole data source, then the identification process can begin, but the lack of complete information (zip codes, names, addresses) makes identification inaccurate
Solution Approach 1:
The patent changes the analytical parameter from requiring complete record details (names, addresses, zip codes) to using statistical distribution patterns of available data (BINs and expiration dates). By transforming the identification basis to probability distributions, the system achieves both fast detection and accurate merchant identification despite using only partial information from dark web sources
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosure herein describes a system and method for predictive identification of breached entities. Identification number and expiration date pairs associated with compromised records in a source file are analyzed to identify a set of candidate entities having records at least partially matching the source file data pairs having events occurring during a selected time period. Probability vectors are calculated for records associated with each identified entity. A divergence value is calculated which represents a distance between probability distribution vectors for each entity and probability distribution vectors for the source file. A predicted breached entity is identified based on the divergence values. The predicted breached entity is notified of the predicted breach. The notification can include an identification of the breached entity, identification of breached records, predicted time of breach, and/or a recommendation to take action to mitigate the predicted breach.