Wells Fargo Bank, N.a.

Bryan D Hall

Nicola A Maiorana

Richard Joseph Schroeder

Andrew J Garner, Iv

Upul D Hanwella

Douglas C Rambo

Steven M Trudeau

Mark David Castonguay

Joseph R Kaluzny

Aimee Joan Hewitt

David Lerner

Darrell Lee Suen

H Brock Kolls

Traci H Nguyen

Julio Jiron

Jeffrey A Cornman

Michael H Chang

John Andrew Chuprevich

Christopher Phillip Clausen

Kevin R Cieslak

Bryan Kroll

Priyamvada Singh

Samuel B Martin

Kenneth L Wright

Shailesh Hedaoo

Samantha Grosby

Ximing Zhao

James C Hudson

Chemere Davis

William Norton Hebert

Christian Tobias Sorensen

Shawna K Murphy Butterworth

Samuel Downing

Virginia Randle

Michael E Toth

Chris Mathes

Systems and methods may generally be used to automatically curate a blocklist of internet protocol (IP) addresses. An example method may include using risk factor scores for a particular IP address that was blocked by a traffic control component to determine whether to add the particular IP address to a blocklist. The example method may include, in response to a determination to add the particular IP address to the blocklist, generating an IP address entry in the blocklist for the particular IP address, the IP address entry optionally including a corresponding time-based expiration. The example method may include outputting the blocklist or the IP address entry, such as in response to a request from a firewall.

Internet protocol (IP) curator

Systems, methods, and apparatuses for authenticating requests to access one or more accounts over a network using authenticity evaluations of two or more automated decision engines are discussed. A login request for access to a user account may be submitted to multiple decision engines that each apply different rulesets for authenticating the login request, and output an evaluation of the authenticity of the login request. Based on evaluations from multiple automated decision engines, the login request may be allowed to proceed to validation of user identity and, if user identity is validated, access to the user account may be authorized. Based on the evaluations, the login attempt may also be rejected. One or more additional challenge question may be returned to the computing device used to request account access, and the login request allowed to proceed to validation of identity if the response to the challenge question is deemed acceptable.

Login and authentication methods and systems

Disclosed herein are systems and methods for using machine learning for geographic analysis of access attempts. In an embodiment, a trained machine-learning model classifies source IP addresses of login attempts to a system as either blacklisted or allowed based on a set of aggregated features that correspond to login attempts to the system from the source IP addresses. The set of aggregated features includes, in association with each respective source IP address, a geographical login-attempt failure rate of login attempts to the system from each of one or more geographical areas that each correspond to the respective source IP address. Source IP addresses that are classified by the machine-learning model as blacklisted are added to a system blacklist, such that the system will disallow login attempts from such source IP addresses.

Systems and methods for using machine learning for geographic analysis of access attempts

In an example aspect, a method includes receiving a plurality of login attempts from a network address over a length of time, querying log data to determine, for the network address, an average number of login failures of the plurality of login attempts over the length of time, calculating a failure rate metric based on the average number of login failures, determining that, the failure rate metric exceeds a reference number of login failures for the length of time, the reference number of login failures based on a historical average number of login failures for the length of time, and based in part on the determining, adding the network address to a system deny list.

Cumulative sum model for IP deny lists

A method may include receiving a first classification of a network address associated with a login attempt as an AVA, and in response, generating a first random number, selecting a first blocking length of time from a plurality of blocking lengths of time, calculating a first deny list duration based on summing the first random number and the first blocking length of time, and adding the network address to a deny list for the first deny list duration, and adding the network address to a parole list for a parole duration, receiving a second classification of the address as an AVA during the duration; and in response selecting a second blocking length of time from a plurality of blocking lengths, calculating a second deny list duration based on summing the second random number and the second blocking length and adding the address to the deny list for the second duration.

System and method for graduated deny list

Systems, methods, and computer-readable storage media utilized for event-based authentication. One method includes recognizing an event and receiving, from a device, a withdrawal request of a user, wherein the withdrawal request includes a captured feature by the device. The method further includes determining that the user is associated with the recognized event using at least a geographic proximity between the event and the withdrawal request, wherein the geographic proximity is a given radius around a location of the event, and wherein the device is within the given radius and adjusting authentication rules based on the determination that the user is associated with the recognized event, wherein the adjustment of the authentication rules includes adjusting a matching threshold between the captured feature and a reference feature. The method further includes processing the withdrawal request for the user based on the adjusted authentication rules.

Event-based authentication

In an example aspect, a method includes receiving a plurality of login attempts from a network address over a length of time, querying log data to determine, for the network address, an average number of login failures of the plurality of login attempts over the length of time, calculating a failure rate metric based on the average number of login failures, determining that the failure rate metric exceeds a reference number of login failures for the length of time, the reference number of login failures based on a historical average number of login failures for the length of time, and based in part on the determining, adding the network address to a system deny list.

In an example aspect, a method includes receiving, using a hardware processing device, a first classification of a network address associated with a login attempt as an account validator actor. The method also includes based on the first classification, updating, using the hardware processing device, a system deny list to include the network address for a first length of time. The method also includes after expiration of the first length of time removing the network address from the system deny list, receiving a second of classification of the network address as an account validator actor, and updating the system deny list to include the network address for a second length of time.

System and method for graduated deny lists

The innovation disclosed and claimed herein, in one aspect thereof, comprises a management system and method of handling unpatched users. When a user requests to access their user account or a network, the user is checked for type of browser the user is being used and which version of the browser is being used. If the user is using an unsecured or unpatched browser, the system offers to update the browser software or provide a virtual machine through the browser so that malware cannot transfer from the user computer to the network. The virtual machine can provide a virtual keyboard to protect the user's login credentials from a key logger. The user logs into the user account within the virtual machine.

Managing unpatched user devices

A computing system includes a network circuit enabling the computing system to exchange information over a network, a customer database storing information pertaining to various user accounts pertaining to a plurality of users, and a risk assessment circuit. The risk assessment circuit is configured search at least one data source to identify a user attribute, determine that the user attribute bears a relationship to a first security credential that is either associated with or potentially associated with a user account, generate a security prompt responsive to the determination, and transmit the security prompt to a user computing device associated with the user.

Systems and methods for enhanced security based on user vulnerability

Methods and systems of authenticating a user based on an event, such as a natural disaster, a gathering of people, and mass activities of people. The method comprises recognizing, by a financial institution computing system, an event; receiving, by the financial institution computing system, a transaction request of a user; determining, by the financial institution computing system, that the user is associated with the recognized event; adjusting, by the financial institution computing system, authentication rules for the user; and processing, by the financial institution computing system, the transaction request for the user based on the adjusted authentication rules.

Event based authentication

Growing community of inventors

Charlotte, NC, United States of America

Bryan D Hall