Granted Patent B2

US 12,646,068 · App. 18/202,516 · Granted Jun 2, 2026

Inventors: Ryan Drapeau (Seattle, WA); Feiyi Ouyang (Seattle, WA); Tianshi Zhu (San Francisco, CA); David Abrahams (San Francisco, CA); Joshua Rosen (Berkeley, CA)

Assignee: STRIPE, LLC

G06Q20/4016G06N3/08G06N5/01G06N20/00G06N20/20G06Q20/12G06Q20/4014G06Q20/405G06Q30/0185G06N3/0499G06N3/09G06Q20/02G06Q20/34G06Q20/4012G06Q20/407G06Q30/06G06Q50/265

Abstract

Claims (78)

1 . A method for generating and updating identities for machine learning (ML) based fraud detection, the method comprising:

generating, by at least one computing system of a commerce platform system, a plurality of nodes and edges from prior transaction data, the plurality of nodes being transaction attributes, and the edges joining two nodes when there is a concurrence of two attributes in a single transaction,

executing, by the at least one computing system, a graph analysis of the plurality of nodes and edges to generate a first set of user identity graphs, where each generated user identity graph in the first set of user identity graphs is a cluster of nodes and edges formed by joining related nodes and/or edges and forms an identity of a user that has performed one or more transactions with the commerce platform system, and

storing, by the at least one computing system, the first set of user identity graphs in a data store of the commerce platform system;

updating, by the at least one computing system, the first set of user identity graphs with new transaction data generated after generation of the first set of user identity graphs; and

generating, by the at least one computing systems, for each user identity graph in the data store, an identity based machine learning model feature set across one or more transaction attributes of said each user identity graph,

training, by the at least one computing systems, the identity based machine learning model with the feature set;

retraining, by the at least one computing systems, the identity based machine learning model by employing a combination of serial processing techniques during identity generation, parallel processing techniques during identity updating, and identity based ML feature generation to improve the model;

receiving, by the at least one computing system, a current transaction from a user having initial transaction attributes and transaction data;

determining, by the at least one computing system, an identity graph associated with the user;

accessing, by the at least one computing system, an identity based machine learning model feature set corresponding to the user selected based on the identity graph associated with the user;

executing, by the at least one computing system, the retrained improved machine learning model to determine a likelihood of fraud based on transaction data for a current transaction, wherein the machine learning model uses the identity based machine learning model feature set; and

executing, by the at least one computing system, the current transaction when the likelihood of fraud does not satisfy a transaction fraud threshold.

2 . The method of claim 1 , wherein executing the analysis of the plurality of nodes and edges to generate the first set of user identity graphs comprises:

performing, by the at least one computing system to form the first set of user identity graphs, a serial connected components analysis on a sequential stream of nodes and edges to join nodes and edges with said each user identity graph having a concurrence of at least one node or edge.

3 . The method of claim 2 , wherein the updating further comprises:

periodically generating a second plurality of nodes and edges from the new transaction data; and

performing a distributed label propagation analysis of new identity subgraphs to augment the first set of user identity graphs by joining transaction attributes from the new identity subgraphs with associated user identity graphs from the first set of user identity graphs, and wherein generating the new identity subgraphs comprises:

distributing, to the plurality of computing system, nodes and edges from the second plurality of nodes and edges to

(i) propagate the plurality of nodes and edges to existing user identity graphs having a concurrence of at least one node or edge, or

(ii) generate a new user identity graph that is added to the first set of user identity graphs when there is no concurrence between a node and edge and nodes and edges of an existing identity graph.

4 . The method of claim 1 , wherein prior to the updating, the method further comprises:

removing, by the at least one computing system, user identity graphs from the first set of user identity graphs that have a cluster size above a maximum cluster size threshold to generate a second set of user identity graphs;

storing, by the at least one computing system, the second set of user identity graphs in the data store of the commerce platform system; and

performing the updating using the second set of user identity graphs.

5 . The method of claim 1 , wherein the identity based machine learning model feature set generated for said each user identity graph in the data store comprises, for each identity, a total transaction count across all transactions associated with said each identity, a total transaction fraud count across with said each identity, a count of a total number of different cards associated with said each identity, and a count of a total number of countries from which cards are issued to said each identity.

6 . The method of claim 1 , further comprising:

training, by the at least one computing system of the commerce platform system, one or more fraud detection machine learning models, at least in part, using a set of the identity based machine learning model feature sets and corresponding past transaction data for which a fraud detection has been made.

7 . The method of claim 6 , wherein at least one of the set of the identity based machine learning model feature sets comprises one or more transaction features derived from two or more different payment types associated with a single user, and wherein the past transaction data comprises a fraud detection result and transaction data associated with at least one of the two or more different payment types for a past transaction involving the single user from which the fraud detection result was generated.

8 . The method of claim 6 , wherein the one or more fraud detection machine learning models comprise a neural network machine learning model and a tree-based machine learning model each trained, at least in part, using identity based features, wherein each of the neural network machine learning model and the tree-based machine learning model make an independent fraud risk determination based on the machine learning model feature sets and the transaction data, and wherein the likelihood that the current transaction is fraudulent is an ensemble decision that combines the independent fraud risk determinations made by the neural network machine learning model and the tree-based machine learning model.

9 . The method of claim 1 , wherein each edge comprises an undirected and unweighted connection between corresponding nodes.

10 . The method of claim 1 , wherein the transaction attributes comprise one or more of a card number used in the transaction, a personal identification number associated with the card used in the transaction, an email address of the user participating in the transaction, a commerce platform identifier for the user, and a cookie identifier collected from a computing device used in the transaction.

11 . The method of claim 1 , wherein the current transaction comprises a commercial transaction performed using a card number associated with a payment card tendered for the current transaction by the user, and the transaction data for the current transaction comprises at least a transaction location, a transaction amount, and a merchant associated with the current transaction.

12 . A non-transitory computer readable storage medium including instructions that, when executed by at least one processor of a commerce platform system a cause the at least one processor to perform operations for generating and updating identities for machine learning (ML) based fraud detection, the operations comprising:

generating a plurality of nodes and edges from prior transaction data, the plurality of nodes being transaction attributes, and the edges joining two nodes when there is a concurrence of two attributes in a single transaction;

executing a graph analysis of the plurality of nodes and edges to generate a first set of user identity graphs, where each generated user identity graph in the first set of user identity graphs is a cluster of nodes and edges formed by joining related nodes and/or edges and forms an identity of a user that has performed one or more transactions with the commerce platform system;

storing the first set of user identity graphs in a data store of the commerce platform system;

updating the first set of user identity graphs with new transaction data generated after generation of the first set of user identity graphs;

generating for each user identity graph in the data store, an identity based machine learning model feature set across one or more transaction attributes of said each user identity graph; and

training the identity based machine learning model with the feature set;

retraining the identity based machine learning model by employing a combination of serial processing techniques during identity generation, parallel processing techniques during identity updating, and identity based ML feature generation to improve the identity based machine learning model;

receiving a current transaction from a user having initial transaction attributes and transaction data;

determining an identity graph associated with the user;

accessing an identity based machine learning model feature set corresponding to the user selected based on the identity graph associated with the user;

executing the retrained improved identity based machine learning model to determine a likelihood of fraud based on transaction data for the current transaction, wherein the identity based machine learning model uses the identity based machine learning model feature set; and

executing the current transaction when the likelihood of fraud does not satisfy a transaction fraud threshold.

13 . The non-transitory computer readable storage medium of claim 12 , wherein executing the analysis of the plurality of nodes and edges to generate the first set of user identity graphs comprises:

performing to form the first set of user identity graphs, a serial connected components analysis on a sequential stream of nodes and edges to join nodes and edges with said each user identity graph having a concurrence of at least one node or edge.

14 . The non-transitory computer readable storage medium of claim 13 , wherein the updating further comprises:

periodically generating a second plurality of nodes and edges from the new transaction data; and

performing a distributed label propagation analysis of new identity subgraphs to augment the first set of user identity graphs by joining transaction attributes from the new identity subgraphs with associated user identity graphs from the first set of user identity graphs, and wherein generating the new identity subgraphs comprises:

distributing nodes and edges from the second plurality of nodes and edges to

(i) propagate the plurality of nodes and edges to existing user identity graphs having a concurrence of at least one node or edge, or

(ii) generate a new user identity graph that is added to the first set of user identity graphs when there is no concurrence between a node and edge and nodes and edges of an existing identity graph.

15 . The non-transitory computer readable storage medium of claim 12 , wherein prior to the updating, the operations further comprises:

removing user identity graphs from the first set of user identity graphs that have a cluster size above a maximum cluster size threshold to generate a second set of user identity graphs;

storing the second set of user identity graphs in the data store of the commerce platform system; and

performing the updating using the second set of user identity graphs.

16 . The non-transitory computer readable storage medium of claim 12 , further comprising:

training one or more fraud detection machine learning models, at least in part, using a set of the identity based machine learning model feature set and corresponding past transaction data for which a fraud detection has been made.

17 . The non-transitory computer readable storage medium of claim 16 , wherein at least one of the set of the identity based machine learning model feature sets comprises one or more transaction features derived from two or more different payment types associated with a single user, and wherein the past transaction data comprises a fraud detection result and transaction data associated with at least one of the two or more different payment types for a past transaction involving the single user from which the fraud detection result was generated.

18 . The non-transitory computer readable storage medium of claim 16 , wherein the one or more fraud detection machine learning models comprise a neural network machine learning model and a tree-based machine learning model each trained, at least in part, using identity based features, wherein each of the neural network machine learning model and the tree-based machine learning model make an independent fraud risk determination based on the machine learning model feature sets and the transaction data, and wherein the likelihood that the current transaction is fraudulent is an ensemble decision that combines the independent fraud risk determinations made by the neural network machine learning model and the tree-based machine learning model.

19 . The non-transitory computer readable storage medium of claim 12 , wherein the transaction attributes comprise one or more of a card number used in the transaction, a personal identification number associated with the card used in the transaction, an email address of the user participating in the transaction, a commerce platform identifier for the user, and a cookie identifier collected from a computing device used in the transaction.

20 . A commerce platform system for generating and updating identities for machine learning (ML) based fraud detection, comprising:

a memory; and

at least one computing system configured to:

generate a plurality of nodes and edges from prior transaction data, the plurality of nodes being transaction attributes, and the edges joining two nodes when there is a concurrence of two attributes in a single transaction,

execute a graph analysis of the plurality of nodes and edges to generate a first set of user identity graphs, where each generated user identity graph in the first set of user identity graphs is a cluster of nodes and edges formed by joining related nodes and/or edges and forms an identity of a user that has performed one or more transactions with the commerce platform system, and

store the first set of user identity graphs in a data store of the commerce platform system;

update the first set of user identity graphs with new transaction data generated after generation of the first set of user identity graphs; and

generate, for each user identity graph in the data store, an identity based machine learning model feature set across one or more transaction attributes of said each user identity graph, and

training the identity based machine learning model with the feature set;

retraining the identity based machine learning model by employing a combination of serial processing techniques during identity generation, parallel processing techniques during identity updating, and identity based ML feature generation to improve the identity based machine learning model;

receive a current transaction from a user having initial transaction attributes and transaction data;

determine an identity graph associated with the user;

access an identity based machine learning model feature set corresponding to the user selected based on the identity graph associated with the user;

execute the retrained improved identity based machine learning model to determine a likelihood of fraud based on transaction data for the current transaction, wherein the identity based machine learning model uses the identity based machine learning model feature set; and

execute the current transaction when the likelihood of fraud does not satisfy a transaction fraud threshold.

Assignments (2)

Continuity (2)

References Cited (34)