Granted Patent B2

US 12,411,921 · App. 18/140,934 · Granted Sep 9, 2025

Inventors: Kumar Rao Krishnagi (Powell, OH); Rupa Shah (Morristown, NJ); Gaurav Chawla (Hoboken, NJ); Vaibhav Vaibhav (Bernardsville, NJ)

Assignee: JPMORGAN CHASE BANK, N.A.

G06F21/32G06F21/316

Abstract

Claims (78)

1. A method for detecting login fraud based on a machine learning model by utilizing one or more processors along with allocated memory, the method comprising:

accessing a database that stores user biometrics data and a pattern of activity logs data of the user utilized for past authentication purposes for logging into a plurality of systems;

creating a machine learning model configured to be trained to generate a score based on the user biometrics data and the pattern of activity logs data;

training the machine learning model with the user biometrics data and the pattern of activity logs data in real-time;

receiving user credentials data from the user for login attempt into a system among the plurality of systems;

comparing the received user credentials data with the biometrics data and the pattern of activity logs data of the user stored on the database and the machine learning model;

generating the score, in response to comparing, by utilizing the trained machine learning model, wherein the score is a value that is compared with a predetermined threshold value to determine in real-time whether the login attempt is fraudulent or not fraudulent;

transmitting, in response to detecting that the user's login attempt is fraudulent, an electronic notification to a user's computing device associated with the user's previous successful login indicating that a location or a computing device the user is currently utilizing to attempt login does not match with the prestored pattern of actively logs data of the user;

receiving user's input data from the user's computing device associated with the user's previous successful login indicating that the location or the computing device the user is currently utilizing to attempt login is actually correct;

allowing the user to access the system based on receiving the user's input data; and

retraining the machine learning model with data associated with allowing the user to access the system.

2. The method according to claim 1 , wherein the pattern of activity logs data includes one or more of the following data: data corresponding to the user's frequent use of an automated teller machine, data corresponding to the user's historical online purchase, data corresponding to the user's dining at a specific restaurant, data corresponding to the user's frequent login from a specific geo location outside the user's normal location, and data corresponding to the user's logins on particular dates, weeks, or months, at regular times.

3. The method according to claim 1 , wherein biometrics data includes one or more of the following data: data corresponding to the user's fingerprints, data corresponding to the user's facial identification, and data corresponding to the user's retinal prints.

4. The method according to claim 1 , in detecting that the user's login attempt is fraudulent, the method further comprising:

determining, in response to comparing the user credentials data with the biometrics data and the pattern of activity logs data of the user, that the generated score is below the predetermined threshold value.

5. The method according to claim 1 , further comprising:

determining, in response to comparing the user credentials data with the biometrics data and the pattern of activity logs data of the user, that the generated score is equal to or above the predetermined threshold value; and

detecting that the user's login attempt is not fraudulent;

allowing the user to access the system; and

retraining the machine learning model with data associated with allowing the user to access the system.

6. The method according to claim 4 , wherein the score is a weighted value related to a degree of confidence data that indicates readiness for authorizing login authentication of the user.

7. A system for implementing for detecting login fraud based on a machine learning model, the system comprising:

a processor; and

a memory operatively connected to the processor via a communication interface, the memory storing computer readable instructions, when executed, causes the processor to:

access a database that stores user biometrics data and a pattern of activity logs data of the user utilized for past authentication purposes for logging into a plurality of systems;

create a machine learning model configured to be trained to generate a score based on the user biometrics data and the pattern of activity logs data;

train the machine learning model with the user biometrics data and the pattern of activity logs data in real-time;

receive user credentials data from the user for login attempt into a system among the plurality of systems;

compare the received user credentials data with the biometrics data and the pattern of activity logs data of the user stored on the database and the machine learning model; and

generate the score, in response to comparing, by utilizing the trained machine learning model, wherein the score is a value that is compared with a predetermined threshold value to determine in real-time whether the login attempt is fraudulent or not fraudulent;

transmit, in response to detecting that the user's login attempt is fraudulent, an electronic notification to a user's computing device associated with the user's previous successful login indicating that a location or a computing device the user is currently utilizing to attempt login does not match with the prestored pattern of actively logs data of the user;

receive user's input data from the user's computing device associated with the user's previous successful login indicating that the location or the computing device the user is currently utilizing to attempt login is actually correct;

allow the user to access the system based on receiving the user's input data; and

retrain the machine learning model with data associated with allowing the user to access the system.

8. The system according to claim 7 , wherein the pattern of activity logs data includes one or more of the following data: data corresponding to the user's frequent use of an automated teller machine, data corresponding to the user's historical online purchase, data corresponding to the user's dining at a specific restaurant, data corresponding to the user's frequent login from a specific geo location outside the user's normal location, and data corresponding to the user's logins on particular dates, weeks, or months, at regular times.

9. The system according to claim 7 , wherein biometrics data includes one or more of the following data: data corresponding to the user's fingerprints, data corresponding to the user's facial identification, and data corresponding to the user's retinal prints.

10. The system according to claim 7 , wherein, in detecting that the user's login attempt is fraudulent, the processor is further configured to:

determine, in response to comparing the user credentials data with the biometrics data and the pattern of activity logs data of the user, that the generated score is below the predetermined threshold value.

11. The system according to claim 7 , wherein the processor is further configured to:

determine, in response to comparing the user credentials data with the biometrics data and the pattern of activity logs data of the user, that the generated score is equal to or above the predetermined threshold value; and

detect that the user's login attempt is not fraudulent;

allow the user to access the system; and

retrain the machine learning model with data associated with allowing the user to access the system.

12. The system according to claim 10 , wherein the score is a weighted value related to a degree of confidence data that indicates readiness for authorizing login authentication of the user.

13. A non-transitory computer readable medium configured to store instructions for detecting login fraud based on a machine learning model, the instructions, when executed, cause a processor to perform the following:

accessing a database that stores user biometrics data and a pattern of activity logs data of the user utilized for past authentication purposes for logging into a plurality of systems;

creating a machine learning model configured to be trained to generate a score based on the user biometrics data and the pattern of activity logs data;

training the machine learning model with the user biometrics data and the pattern of activity logs data in real-time;

receiving user credentials data from the user for login attempt into a system among the plurality of systems;

comparing the received user credentials data with the biometrics data and the pattern of activity logs data of the user stored on the database and the machine learning model; and

generating the score, in response to comparing, by utilizing the trained machine learning model, wherein the score is a value that is compared with a predetermined threshold value to determine in real-time whether the login attempt is fraudulent or not fraudulent;

transmitting, in response to detecting that the user's login attempt is fraudulent, an electronic notification to a user's computing device associated with the user's previous successful login indicating that a location or a computing device the user is currently utilizing to attempt login does not match with the prestored pattern of actively logs data of the user;

receiving user's input data from the user's computing device associated with the user's previous successful login indicating that the location or the computing device the user is currently utilizing to attempt login is actually correct;

allowing the user to access the system based on receiving the user's input data; and

retraining the machine learning model with data associated with allowing the user to access the system.

14. The non-transitory computer readable medium according to claim 13 , wherein, in detecting that the user's login attempt is fraudulent, the instructions, when executed, cause the processor to further perform the following:

determining, in response to comparing the user credentials data with the biometrics data and the pattern of activity logs data of the user, that the generated score is below the predetermined threshold value.

15. The system according to claim 14 , wherein the score is a weighted value related to a degree of confidence data that indicates readiness for authorizing login authentication of the user.

16. The non-transitory computer readable medium according to claim 13 , wherein the pattern of activity logs data includes one or more of the following data: data corresponding to the user's frequent use of an automated teller machine, data corresponding to the user's historical online purchase, data corresponding to the user's dining at a specific restaurant, data corresponding to the user's frequent login from a specific geo location outside the user's normal location, and data corresponding to the user's logins on particular dates, weeks, or months, at regular times.

17. The non-transitory computer readable medium according to claim 13 , wherein the biometrics data includes one or more of the following data: data corresponding to the user's fingerprints, data corresponding to the user's facial identification, and data corresponding to the user's retinal prints.

18. The non-transitory computer readable medium according to claim 13 , wherein the instructions, when executed, cause the processor to further perform the following:

determining, in response to comparing the user credentials data with the biometrics data and the pattern of activity logs data of the user, that the generated score is equal to or above the predetermined threshold value; and

detecting that the user's login attempt is not fraudulent;

allowing the user to access the system; and

retraining the machine learning model with data associated with allowing the user to access the system.

19. A method for detecting login fraud based on a machine learning model by utilizing one or more processors along with allocated memory, the method comprising:

accessing a database that stores user biometrics data and a pattern of activity logs data of the user utilized for past authentication purposes for logging into a plurality of systems;

creating a machine learning model configured to be trained to generate a score based on the user biometrics data and the pattern of activity logs data;

training the machine learning model with the user biometrics data and the pattern of activity logs data in real-time;

receiving user credentials data from the user for login attempt into a system among the plurality of systems;

comparing the received user credentials data with the biometrics data and the pattern of activity logs data of the user stored on the database and the machine learning model;

generating the score, in response to comparing, by utilizing the trained machine learning model, wherein the score is a value that is compared with a predetermined threshold value to determine in real-time whether the login attempt is fraudulent;

determining, in response to comparing the user credentials data with the biometrics data and the pattern of activity logs data of the user, that the generated score is below the predetermined threshold value;

detecting that the user's login attempt is fraudulent;

transmitting, in response to detecting that the user's login attempt is fraudulent, an electronic notification to a user's computing device associated with the user's previous successful login indicating that a location or a computing device the user is currently utilizing to attempt login does not match with the prestored pattern of actively logs data of the user;

receiving user's input data from the user's computing device associated with the user's previous successful login indicating that the location or the computing device the user who is currently utilizing to attempt login is not correct;

denying the user who is currently utilizing to attempt login to access the system based on receiving the user's input data; and

retraining the machine learning model with data associated with denying the user to access the system.

Assignments (1)

Continuity (2)

References Cited (11)