Suspicious Transaction Destination Detection Using Referrer Risk Ratings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to accurately identify suspicious transaction destinations in online financial transactions due to obfuscation and modification of identifying information, making it difficult to detect potentially illegal or risky financial activities.
Innovation Solution
A computer-implemented method that identifies requests for a financial institution's login page, determines referring websites, classifies them based on risk ratings, associates user logins and transactions with these websites, and assigns risk ratings to transaction destinations using HTTP referrer header data and machine learning techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If obfuscation techniques are used to protect identifying information, then security is improved, but the ability to identify suspicious transaction destinations deteriorates
Solution Approach 1:
The patent introduces referring websites as intermediary entities that connect users to financial institutions. By analyzing these intermediary websites and their risk ratings, the system can identify suspicious transaction destinations without requiring direct access to obfuscated identifying information. The referring website acts as a mediator that provides additional context for risk assessment.
Solution Approach 2:
The patent shifts the analysis from the traditional dimension of directly examining transaction destination identifiers to a new dimension of analyzing referring websites and user behavior patterns. By adding temporal dimension (time period analysis) and contextual dimension (referring website classification), the system can identify suspicious activities even when traditional identifiers are obfuscated.
2Measurement precision
If comprehensive analysis of referring websites and user behavior is performed, then identification accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex identification process into distinct modular components: (1) identifying login requests and referring websites, (2) classifying referring websites into risk categories, (3) associating users with specific referring websites, (4) identifying transactions within time periods, and (5) assigning risk ratings to destinations. Each module performs a specific function, making the overall complex system manageable and maintainable.
Solution Approach 2:
The patent performs preliminary classification of referring websites into risk-rated categories before analyzing user transactions. This preliminary action creates a structured framework that simplifies subsequent analysis. By pre-establishing risk categories and relationships between users and referring websites, the system reduces the complexity of real-time transaction analysis.
3Reliability
If risk ratings are assigned based on referring website classes, then transaction monitoring effectiveness is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary classification of referring websites into risk-rated categories and pre-establishes associations between users and referring websites before transaction analysis. This allows the system to quickly assign risk ratings to transactions by referencing pre-computed data rather than performing comprehensive analysis for each transaction in real-time.
Solution Approach 2:
The patent applies different levels of analysis depth to different transactions based on their context. By using pre-established risk ratings of referring websites and user-behavior patterns, the system can quickly assess low-risk transactions with minimal processing while focusing more detailed analysis on high-risk cases, thereby reducing overall processing time while maintaining monitoring effectiveness.
Data Source
AI summary
Transaction destinations are identified by identifying requests for a login page of a web server for a financial institution and determining a referring website for each of the requests; classifying the referring websites into classes, each of the classes having a risk rating; identifying logins to access the web server and determining a user associated with each login; associating each of the logins with one of the requests and the referring website for that request; for each of the users, identifying transactions occurring within a time period from when the login was initiated; for each of the transactions occurring within the time period, associating a transaction destination of that transaction with the referring website for that login; and assigning a risk rating to each of the transaction destinations based at least in part on a risk rating of the class of the associated referring website.