Payment Network Threat Detection Using IP Traffic Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to identify the source of cyber threats and fraudulent activities in payment networks, particularly in detecting anomalies and attributing them to specific bad actors, due to limitations in accessing and analyzing IP traffic data across multiple transaction layers.
Innovation Solution
A security system on the payment network utilizes payment network behavior as a sensor node, combining payment network activity data with IP network traffic data to detect anomalies, retrieve merchant information, and evaluate IP network traffic patterns to identify the source of suspect activity, employing machine learning and AI for pattern recognition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If payment network activity data is combined with IP network traffic data to detect anomalies and identify bad actors, then detection accuracy and source identification capability are improved, but system complexity and data processing requirements increase
Solution Approach 1:
The patent combines payment network activity data with IP network traffic data to create a unified detection system. The security system aggregates data from multiple sources (payment transactions and IP traffic) to improve anomaly detection accuracy and enable source identification of bad actors, directly resolving the technical contradiction by merging data layers to enhance measurement precision.
Solution Approach 2:
The security system performs multiple functions: detecting anomalies in payment activity, retrieving merchant information, evaluating IP traffic patterns, and identifying bad actor sources. This multi-functional approach allows a single system to handle various security tasks, improving detection capabilities while managing complexity through consolidation of functions.
2Difficulty of detecting and measuring
If IP network traffic data is retrieved and evaluated for patterns, then source identification capability is improved, but data processing time and computational resources increase
Solution Approach 1:
The system retrieves and stores IP network traffic data in advance, organizing it by merchant web address and time information. This preliminary preparation allows for faster pattern evaluation when anomalies are detected, reducing real-time processing time while maintaining source identification capability.
Solution Approach 2:
The patent segments IP network traffic data by merchant web address and time information, allowing the security system to evaluate only relevant portions of data corresponding to specific anomalies. This segmentation reduces processing time by focusing computational resources on targeted data segments rather than analyzing all traffic data comprehensively.
3Reliability
If security system accesses IP network traffic data across multiple transaction layers, then detection thoroughness is improved, but access complexity and infrastructure requirements increase
Solution Approach 1:
The security system acts as an intermediary that retrieves IP network traffic data from network traffic monitors without requiring direct access to merchant infrastructure. This intermediary role allows thorough detection across multiple transaction layers while managing access complexity through standardized data retrieval mechanisms.
Data Source
AI summary
In some aspects, the techniques described herein relate to a method, including: detecting, by a security system on a payment network, an anomaly associated with potential suspect activity in payment network activity associated with a particular merchant; retrieving, by the security system, a merchant identifier corresponding to the particular merchant, a merchant web address associated with the particular merchant, and time information of the anomaly; identifying a source for the potential suspect activity on the payment network by: obtaining IP network traffic data associated with the merchant web address and the time information of the anomaly; evaluating, by the security system, the IP network traffic data for patterns in the IP network traffic data that correspond to the anomaly; and determining, by the security system, a source IP address from the patterns in the IP network traffic data that correspond to the anomaly.