Bank of America Corporation

Motorola Corporation

Peter George Kurrasch

Joel Richard Townsend

Nathan Alexander Dalpini

Martin Andrew Sutton

Tomas Mata Castrejon, Iii

Richard Scot

Kevin P Thomsen

John Raymond Omernik

Embodiments of the invention are directed to systems, methods, and computer program products for providing intelligent proactive identification of, and protection against, malfeasant data collection, user device control, or user account access. The invention utilizes a continuous data analysis technique in order to recognize patterns in device data and network communications indicative of remote device control requests, and responds to these identified data points by implemented an automated solution to protect users against unauthorized access of their devices or accounts.

System and methods for proactive protection against malfeasant data collection

A system for detecting phishing websites accesses a website that comprises a plurality of images. The system extracts the plurality of images from the website. The system generates a hash value for each image from the plurality of images. Each hash value uniquely identifies its corresponding image. The system generates a first overall hash value for the website by hashing the generated hash values. The first overall hash value represents a signature of the website. The system compares the first overall hash value with a second overall hash value that is associated with a phishing website. The system determines whether the first overall hash value corresponds to the second overall hash value. If it is determined that the first overall hash value corresponds to the second overall hash value, the system determines that the website is associated with the phishing website.

Information security system and method for phishing website identification based on image hashing

Aspects of the disclosure relate to a payment device to detect real-time suspicious payment cards. Prior to a transaction, a payment device detects suspicious payment cards based on captured images and determined indicia of the payment card. An alert may be generated upon detection of any suspicious or fraudulent payment card. In some arrangements, the payment device may utilize machine learning models or machine learning capabilities to detect suspicious payment cards. A characterization score may be generated and used to determine if a payment card is suspicious. The characterization scores may be updated based on different card issuer criteria and transaction use of each payment card.

Detecting cloned payment cards

Aspects of the disclosure relate to a payment device to detect real-time suspicious payment cards. Prior to a transaction, a payment device detects suspicious payment cards based on captured images of the payment card. An alert may be generated upon detection of any suspicious or fraudulent payment card. In some arrangements, institutions may share information regarding suspicious payment cards to prevent fraud. The payment device may utilize machine learning models or machine learning capabilities to detect suspicious payment cards. A characterization score may be generated and used to determine if a payment card is suspicious. The characterization scores may be updated based on different card issuer criteria and transaction use of each payment card.

Aspects of the disclosure relate to a payment device to detect real-time suspicious payment cards. Prior to a transaction, a payment device detects suspicious payment cards based on captured images of the payment card. An alert may be generated upon detection of any suspicious or fraudulent payment card. In some arrangements, the payment device may utilize machine learning models or machine learning capabilities to detect suspicious payment cards. A characterization score may be generated and used to determine if a payment card is suspicious. The characterization scores may be updated based on different card issuer criteria and transaction use of each payment card.

A system for phishing website classification accesses a first website that is known to be a phishing website. The system extracts images from the first website, and generates a hash value for each image. The system generates a first overall hash value for the website by hashing the hash values. The system accesses a list of plurality of phishing websites, each is associated with a different overall hash value from among a plurality of overall hash values. The system compares the first overall hash value with a second overall hash value associated with a particular phishing website. The system determines whether the first overall hash value corresponds to the second overall hash value. If it is determined that the first overall hash value corresponds to the second overall hash value, the system classifies the first website to a phishing website class that the particular phishing website belongs.

Information security system and method for phishing website classification based on image hashing

An apparatus for security management of a plurality of interactions comprises a processor operable to receive a plurality of interactions, where each interaction comprises interaction information associated with at least one of a plurality of users and a first entity. The processor is operable to determine a threshold value of the plurality of interactions and a threshold volume of the plurality of interactions, determine that a value of each of the plurality of interactions has not exceeded the threshold value of the plurality of interactions, and determine that the plurality of interactions has not exceeded the threshold volume of the plurality of interactions. The processor is operable to determine a number of instances of the plurality of interactions that were invalid, determine that the number of instances of the plurality of interactions that were invalid exceeds a threshold, and determine that the first entity is associated with suspicious indicators.

System and method for security management of a plurality of invalid interactions

An apparatus for security management of application information comprises a processor operable to receive the application information associated with a first entity and to receive entity device information for a first entity device associated with the first entity. The processor is operable to determine that a portion of data fields of the application information associated with the first entity corresponds to a portion of data fields of entity account data associated with a second entity and to determine that a portion of the entity device information associated with the first entity device corresponds to a portion of the entity device information associated with a second entity device that is associated with the second entity. The processor is further operable to determine that the first entity is associated with suspicious indicators, wherein suspicious indicators signal that there is suspicious activity associated with the first entity.

System and method for security management of application information

A system for detecting phishing websites accesses a website that comprises a plurality of images. The system extracts the plurality of images from the website. The system generates a hash value for each image from the plurality of images. Each hash value uniquely identifies its corresponding image. The system generates a first overall hash value for the website by hashing the generated hash values. The first overall hash value represents a signature of the website. the system compares the first overall hash value with a second overall hash value that is associated with a phishing website. The system determines whether the first overall hash value corresponds to the second overall hash value. If it is determined that the first overall hash value corresponds to the second overall hash value, the system determines that the website is associated with the phishing website.

An apparatus for security management of a plurality of interactions comprises a processor operable to receive a plurality of interactions, where each interaction comprises interaction information associated with one of one or more users and a first entity. The processor is operable to determine a threshold value of the plurality of interactions and a threshold volume of the plurality of interactions, determine that a value of each of the plurality of interactions has not exceeded the threshold value of the plurality of interactions, and determine that the plurality of interactions has not exceeded the threshold volume of the plurality of interactions. The processor is operable to determine a number of instances of the plurality of interactions that were invalid, determine that the number of instances of the plurality of interactions that were invalid exceeds a threshold, and determine that the first entity is associated with suspicious indicators.

An event monitor includes an event counter for counting one or more preselected events detected by an event counter. The events are counted for successive time periods and an indication of system stability is calculated to detect possible error conditions. The indication of system stability is calculated by taking a nonweighted or weighted sum of the total number of events counted in the current time period, the total number of events counted in all time periods monitored, and the difference between the total number of events counted in the current time period and the total number of events counted in the preceding time period. In this manner, the event monitor is able to identify possible error conditions more quickly than systems using rate thresholding so that remedial action may be initiated sooner. In a further aspect, system stability is further assessed by counting the number of time periods in which there is an indicium of stability, and is thus able to quickly identify a potential error condition that has stabilized and for which remedial action is not necessary. In further aspects, methods for event monitoring and error detection are provided.

Growing community of inventors

Palatine, IL, United States of America

Peter George Kurrasch