Monitored Data Segmentation for Real-Time Fraud Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing systems fail to effectively detect and mitigate identity theft fraud attacks by monitoring overall account volume spikes, leading to operational expenses, reputational risks, and business disruptions.

Innovation Solution

A computer-based system that dynamically calculates hash keys and anomaly scores for multi-dimensional data streams, using counting structures and chi-squared goodness of fit statistics to identify and label devices with anomalous activity exceeding a predetermined threshold.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If overall account volume monitoring is used to detect identity theft fraud attacks, then the monitoring scope is broad, but the detection precision is insufficient leading to false positives and missed detections

Engineering Contradiction:
Improvedetection precisionVSAvoidmonitoring system complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the monitoring system into multiple specialized components: hash key generation modules for different segmentation types (geographic, temporal, device characteristics), counting structures (current and total), and anomaly detection modules. Each segmentation focuses on specific fraud patterns, improving detection precision while distributing system complexity across modular components rather than a monolithic system.

Inventive Principle:
Principle #1Segmentation

2Reliability

If multiple monitored segmentations are dynamically calculated and monitored, then the detection precision improves, but the computational complexity and processing time increase

Engineering Contradiction:
Improvefraud detection reliabilityVSAvoidprocessing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by pre-generating hash keys for multiple segmentation types and maintaining pre-configured counting structures before fraud events occur. When data arrives, the system immediately increments counters using pre-computed hash values rather than calculating segmentations in real-time, significantly reducing processing time while maintaining high detection reliability through multi-dimensional analysis.

Inventive Principle:
Principle #10Preliminary action

3Adaptability or versatility

If dynamic anomaly score calculation is performed for multiple segmentations, then the adaptability to changing fraud patterns improves, but the computational resources required increase

Engineering Contradiction:
Improveadaptability to fraud patternsVSAvoidcomputational energy consumption
Core Design Contradiction:
Adaptability or versatilityVSUse of energy by moving object

Solution Approach 1:

The system adapts to changing fraud patterns by dynamically adjusting parameters such as anomaly thresholds, segmentation weights, and hash key generation strategies based on observed data distributions. The anomaly score calculation incorporates time-varying parameters that adapt to new fraud patterns without requiring complete system reconfiguration, maintaining versatility while controlling computational energy consumption through parameter optimization rather than structural changes.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentUS20250219810A1Computer-based systems configured to select a monitored data segmentation and methods of use thereof
Publication Date: 2025.07.03 CAPITAL ONE SERVICES LLC
  • US20250219810A1 patent drawing
  • US20250219810A1 patent drawing
  • US20250219810A1 patent drawing

AI summary

In some embodiments, the present disclosure provides an exemplary system and method that may include steps of identifying a device capable of processing a data stream; calculating a plurality of hash keys for a plurality of monitored segmentations associated with the device capable of the data stream; generating an increment data counter that corresponds to each hash key in a plurality of counting structures; calculating an anomaly score associated for the plurality of monitored segmentations; selecting a monitored segmentation based on the anomaly score; determining that a selected monitored segmentation meets a predetermined threshold associated with the anomaly score; and automatically marking the device capable of the data stream with a pre-generated label.