IP Library Granted Patent US 12712901
Granted Patent B2
US 12712901 · App. 18/758,989 · Granted Aug 18, 2026

Systems and methods for controlling computing systems associated with network operations

Inventors: Michael Gottlieb (South San Francisco, CA); Alisa Noll (South San Francisco, CA); Jonathan Konrad Pedde (South San Francisco, CA); Panayiotis Thomakos (South San Francisco, CA); David Brace (South San Francisco, CA); Travis Rahe (South San Francisco, CA); Daniel Williams (South San Francisco, CA)
Assignee: Stripe, LLC
H04L63/1425H04L63/1416
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12712901
App. No.
18/758,989
Granted
Aug 18, 2026
Kind
B2
Abstract

Presented herein are systems and methods of evaluating network operations associated with computing systems. A server may receive, from a computing system, an electronic request to execute a first network operation using a plurality of attributes provided by an end user device to the computing system. The first network operation may be initiated via the end user device. The server may retrieve (i) a digital fingerprint associated with an identity of the computing system and (ii) a plurality of network operation metrics associated with the computing system. The server may execute, using the digital fingerprint and the plurality of network operation metrics, a machine learning (ML) model to generate a likelihood of fraud caused by the computing system. The server may, in response to the likelihood of fraud satisfying a threshold, execute a second network operation using the plurality of attributes, instead of executing the first network operation.

Claims (65)

1 . A method of evaluating network operations associated with computing systems, the method comprising:

receiving, by a server from a computing system of a plurality of computing systems, an electronic request to execute a first network operation using a plurality of attributes provided by an end user device of a plurality of end user devices to the computing system, the first network operation initiated via the end user device;

retrieving, by the server, (i) a digital fingerprint associated with an identity of the computing system and (ii) a plurality of network operation metrics for one or more network operations that are associated with the computing system and initiated by one or more of the plurality of end user devices;

executing, by the server, using the digital fingerprint and the plurality of network operation metrics, a machine learning (ML) model to generate a score corresponding to a likelihood of fraud associated with the computing system; and

based on the score satisfying a threshold:

selecting, by the server, from a plurality of candidate network operations, a second network operation for the electronic request in accordance with the score;

executing, by the server, the second network operation, using at least a portion of the plurality of attributes provided by the end user device, instead of executing the first network operation initiated by the end user device; and

generating, by the server, a data record to add to a subsequent electronic request from the computing system to indicate a requisition for inspection.

2 . The method of claim 1 , further comprising determining, by the server, from a plurality of classifications, a classification of the computing system in accordance with the score corresponding to the likelihood of fraud, and

wherein executing the second network operation further comprises selecting, from a plurality of network operations, the second network operation based on the classification of the computing system.

3 . The method of claim 2 , wherein the plurality of network operations further comprises at least one of: (i) a rejection of the subsequent electronic request, (ii) a routing of the subsequent electronic request for inspection, or (iii) a generation of an alert to indicate the computing system as cause of fraudulence.

4 . The method of claim 1 , further comprising:

generating, by the server, an output, using an association between the computing system and at least one of: (i) the digital fingerprint, (ii) the plurality of network operation metrics, or (iii) the score corresponding to the likelihood of fraud associated with the computing system; and

transmitting, by the server, the output for presentation via a user interface having a plurality of user interface elements.

5 . The method of claim 4 , further comprising selecting, by the server, a template from a plurality of templates based on the score corresponding to the likelihood of fraud, each of the plurality of templates defining generation of codes to characterize the computing system; and

wherein generating the output further comprises generating the output in accordance with the template.

6 . The method of claim 1 , further comprising executing, by the server, using a second digital fingerprint and a second plurality of network operation metrics associated with a second computing system of the plurality of computing systems, the ML model to generate a second score corresponding to a second likelihood of fraud associated with the second computing system; and

based on the second score not satisfying a threshold, executing, by the server, a third network operation using a second plurality of attributes in accordance with a second electronic request from the second computing system.

7 . The method of claim 1 , wherein executing the machine learning model to generate the score corresponding to the likelihood of fraud further comprises generating a plurality of constituent scores corresponding to a plurality of fraud indicators for the computing system.

8 . A system for evaluating network operations associated with computing systems, the system comprising:

a server having one or more processors coupled with memory, wherein the server is configured to:

receive, from a computing system of a plurality of computing systems, an electronic request to execute a first network operation using a plurality of attributes provided by an end user device of a plurality of end user devices to the computing system, the first network operation initiated via the end user device;

retrieve (i) a digital fingerprint associated with an identity of the computing system and (ii) a plurality of network operation metrics for one or more network operations that are associated with the computing system and initiated by one or more of the plurality of end user devices;

execute, using the digital fingerprint and the plurality of network operation metrics, a machine learning (ML) model to generate a score corresponding to a likelihood of fraud associated with the computing system;

based on the score in response to satisfying a threshold:

select, from a plurality of candidate network operations, a second network operation for the electronic request in accordance with the score;

execute the second network operation using at least a portion of the plurality of attributes provided by the end user device, instead of executing the first network operation initiated by the end user device; and

generate a data record to add to a subsequent electronic request from the computing system to indicate a requisition for inspection.

9 . The system of claim 8 , wherein the server is further configured to

determine, from a plurality of classifications, a classification of the computing system in accordance with the score, and

select, from a plurality of network operations, the second network operation based on the classification of the computing system.

10 . The system of claim 9 , wherein the plurality of network operations further comprises at least one of: (i) a rejection of the subsequent electronic request, (ii) a routing of the subsequent electronic request for inspection, or (iii) a generation of an alert to indicate the computing system as cause of fraudulence.

11 . The system of claim 8 , wherein the server is further configured to:

generate an output, using an association between the computing system and at least one of: (i) the digital fingerprint, (ii) the plurality of network operation metrics, or (iii) the score corresponding to the likelihood of fraud associated with the computing system; and

transmit the output for presentation via a user interface having a plurality of user interface elements.

12 . The system of claim 11 , wherein the server is further configured to:

select a template from a plurality of templates based on the score corresponding to the likelihood of fraud, each of the plurality of templates defining generation of codes to characterize the computing system; and

generate the output in accordance with the template.

13 . The system of claim 8 , wherein the server is further configured to:

receive a plurality of risk factors associated with the computing system from an instrumentation service, and

execute the ML model using the plurality of risk factors from the instrumentation service.

14 . The system of claim 8 , wherein the server is further configured to:

execute, using a second digital fingerprint and a second plurality of network operation metrics associated with a second computing system of the plurality of computing systems, the ML model to generate a second score corresponding to a second likelihood of fraud associated with the second computing system; and

based on the second score not satisfying a threshold, execute a third network operation using a second plurality of attributes in accordance with a second electronic request from the second computing system.

15 . The system of claim 8 , wherein the server is further configured to generate a plurality of constituent scores corresponding to a plurality of fraud indicators for the computing system.

16 . A non-transitory computer readable medium storing instructions, which when executed by at least one processor, cause the at least one processor to:

receive, from a computing system of a plurality of computing systems, an electronic request to execute a first network operation using a plurality of attributes provided by an end user device of a plurality of end user devices to the computing system, the first network operation initiated via the end user device;

retrieve (i) a digital fingerprint associated with an identity of the computing system and (ii) a plurality of network operation metrics for one or more network operations that are associated with the computing system and initiated by one or more of the plurality of end user devices;

execute, using the digital fingerprint and the plurality of network operation metrics, a machine learning (ML) model to generate a score corresponding to a likelihood of fraud associated with the computing system;

based on the score satisfying a threshold:

select, from a plurality of candidate network operations, a second network operation for the electronic request in accordance with the score;

execute the second network operation using at least a portion of the plurality of attributes provided by the end user device, instead of executing the first network operation initiated by the end user device; and

generate a data record to add to a subsequent electronic request from the computing system to indicate a requisition for inspection.

17 . The non-transitory computer readable medium of claim 16 , wherein the instructions further cause the at least one processor to:

determine, from a plurality of classifications, a classification of the computing system in accordance with the score corresponding to the likelihood of fraud, and

select, from a plurality of network operations, the second network operation based on the classification of the computing system.

18 . The non-transitory computer readable medium of claim 16 , wherein the instructions further cause the at least one processor to:

generate an output, using an association between the computing system and at least one of: (i) the digital fingerprint, (ii) the plurality of network operation metrics, or (iii) the score corresponding to the likelihood of fraud associated with the computing system; and

transmit the output for presentation via a user interface having a plurality of user interface elements.

19 . The non-transitory computer readable medium of claim 18 , wherein the instructions further cause the at least one processor to:

select a template from a plurality of templates based on the score corresponding to the likelihood of fraud, each of the plurality of templates defining generation of codes to characterize the computing system; and

generate the output in accordance with the template.

20 . The non-transitory computer readable medium of claim 16 , wherein the instructions further cause the at least one processor to:

receive a plurality of risk factors associated with the computing system from an instrumentation service, and

execute the ML model using the plurality of risk factors from the instrumentation service.