Phishing Detection via Transaction Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of online transactions and sophisticated phishing attempts make manual detection and handling of phishing attempts unfeasible, as malicious entities use variations in vendor names and amounts to evade detection by traditional security measures.
Innovation Solution
A computer-implemented method and system that processes electronic transactions using a language model to generate numerical representations, clusters similar vendor names, and generates aggregates to identify valid transactions, employing clustering algorithms and machine learning models to determine the validity of requests and prevent suspicious transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security measures are used to detect phishing attempts, then the detection process is simple and fast, but the detection accuracy is low and phishing attempts can evade detection
Solution Approach 1:
The patent introduces an intermediary processing system that sits between the transaction request and the validation logic. This intermediary layer performs language model analysis, numerical representation generation, and clustering operations on vendor names and transaction amounts. By inserting this intermediary processing layer, the system achieves higher detection accuracy without requiring complete redesign of the core transaction system, thus resolving the contradiction between accuracy and complexity.
Solution Approach 2:
The patent replaces traditional rule-based mechanical detection systems with machine learning-based semantic analysis. Instead of using fixed rules to match vendor names, the system uses language models to generate numerical representations and perform clustering, enabling the system to detect sophisticated phishing attempts that mimic legitimate vendor names. This substitution dramatically improves detection accuracy while the modular architecture manages the increased computational complexity.
2Productivity
If manual detection methods are used for phishing attempts, then the false positive rate is low, but the processing speed is slow and cannot handle exponential growth in transactions
Solution Approach 1:
The patent implements a self-service detection system where the machine learning models automatically analyze transaction patterns, cluster vendor names, and identify phishing attempts without human intervention. The system continuously learns from new data and automatically updates its detection capabilities. This automation maintains high reliability by using sophisticated algorithms while achieving the processing speed necessary to handle exponential transaction growth, resolving the contradiction between productivity and reliability.
3Measurement precision
If sophisticated phishing detection methods are implemented, then the detection accuracy improves, but the computational resources and time required increase
Solution Approach 1:
The patent performs preliminary clustering of vendor names and pre-computation of numerical representations during off-peak hours or in batch mode. By pre-processing and organizing vendor name data into clusters before they are needed for transaction validation, the system reduces the computational burden during real-time transaction processing. This preliminary action maintains high detection accuracy while significantly reducing the time penalty during actual transaction validation, resolving the contradiction between accuracy and processing time.
4Adaptability or versatility
If traditional rule-based systems are used to filter transactions, then the system complexity is low, but the ability to detect variations in vendor names and amounts is insufficient
Solution Approach 1:
The patent transforms vendor names from text strings into numerical representations using language models, enabling mathematical operations and clustering analysis. By changing the parameter representation from categorical text to numerical vectors, the system gains the ability to detect semantic similarities and variations in vendor names that rule-based systems cannot identify. This parameter transformation increases detection flexibility while the efficient algorithms keep the added complexity manageable, resolving the contradiction between adaptability and system complexity.
Data Source
AI summary
Described herein are example implementations for handling of phishing attempts. A system receives a request to perform an electronic transaction, with the request including information regarding a user account. The system generates one or more probabilities of the request being valid based on the request and processing of a plurality of electronic transactions associated with one or more user accounts, identifies whether the request is valid based on the one or more probabilities, and in response to identifying that the request is not valid, provides an indication that the request is not valid. Processing the plurality of electronic transactions includes, for a plurality of electronic transactions including information regarding user accounts, generating a numerical representation associated with each electronic transaction, clustering the plurality of electronic transactions into one or more clusters based on the numerical representations, and, for each cluster, generating one or more aggregates of user account information.