SYSTEMS AND METHODS FOR COMPROMISED CARD DETECTION DURING SERVICE REQUEST PROCESSING BY A DISTRIBUTED SERVICE SYSTEM

1 . A method for detecting compromised cards during service requests transmitted to a distributed services system, the method comprising:

receiving, by a server computer system from a client system, a new service request associated with a card during a second time period that is after a first time period, wherein the card authorizes the new service request, and the new service request is processed within a processing path executed by the server computer system;

during processing of the new service request, accessing, by the server computer system, an output generated by a machine learning model outside of the processing path and prior to the second time period, wherein the output is indicative of whether the card is compromised based on analysis of historical data from a prior service request processed by the server computer system during the first time period;

applying, by the server computer system within the processing path, the output to the new service request to indicate whether the card is compromised; and

in response to inferring, by the server computer system within the processing path, that the card is compromised during processing of the new service request initiating, by the server computer system, one or more remedial actions to execute prior to completion of the processing of the new service request.

2 . The method of claim 1 , wherein prior to receiving the new service request, the method further comprises:

generating, by the server computer system outside of the processing path, features for each set of completed service requests processed during the first time period; and

storing, by the server computer system in a data store, a set of outputs generated by the machine learning model from the features, wherein the set of outputs correspond to the set of completed service requests and are indicative of whether the card is compromised for each of the set of completed service requests.

3 . The method of claim 2 , wherein one of the set of outputs applied by the server computer system within the processing path and stored in the data store is a recent output from a recently completed service request, and the method further comprises:

generating, by the server computer system within the processing path, the inference that the card is compromised during processing of the new service request based on the output generated by the machine learning model.

4 . The method of claim 2 , wherein the features comprise one or more text-based features, one or more categorical features, and one or more numerical features.

5 . The method of claim 4 , wherein one or more of the one or more numerical features correspond to a count generated from a plurality of past service requests over a third time period.

6 . The method of claim 1 , wherein the output is a numerical value generated by the machine learning model as a prediction of whether the card is compromised for the prior service request, and the card is inferred as compromised during the new service request when the numerical value satisfies a first threshold.

7 . The method of claim 1 , wherein the output generated by the machine learning model comprises a numerical value that represents a prediction of whether the card is determined to be compromised for the prior service request, and inferring, by the server computer system within the processing path, that the card is compromised further comprises:

combining the numerical value with a second numerical value generated for the new service request by a second machine learning model to generate a multidimensional score;

comparing the multidimensional score to a second threshold value; and

determining that the card is compromised based on whether the multidimensional score satisfies the second threshold value.

8 . The method of claim 1 , further comprising:

initiating training of the machine learning model;

accessing a data store that stores data indicative of service requests processed for the client system using the card to authorize the service requests;

generating a training data set that includes a set of features generated for each of a set of the service requests, wherein the set of features comprise one or more text-based features, one or more categorical features, and one or more numerical features;

generating, for a service request of the set of service requests, a label indicative of whether the card was compromised during the processing of the service request; and

iteratively training the machine learning model using the set of service requests, the set of features, and the label generated for each of the set of service requests, to detect when a compromised card is used to authorize future service requests.

9 . The method of claim 8 , wherein the label is generated for the service request based on at least one of (i) a third machine learning model that analyzes the service request during the processing of the service request, and (ii) a code received from an issuer of the card for the service request.

10 . The method of claim 8 , wherein the machine learning model is a neural network based machine learning model.

11 . A non-transitory computer readable storage medium storing instructions, which when executed by a server computer system, causes the server computer system to perform operations for detecting compromised cards during service requests transmitted to a distributed services system, the operations comprising:

receiving, by a server computer system from a client system, a new service request associated with a card during a second time period that is after a first time period, wherein the card authorizes the new service request, and the new service request is processed within a processing path executed by the server computer system;

during processing of the new service request, accessing, by the server computer system, an output generated by a machine learning model outside of the processing path and prior to the second time period, wherein the output is indicative of whether the card is compromised based on analysis of historical data from a prior service request processed by the server computer system during the first time period;

applying, by the server computer system within the processing path, the output to the new service request to indicate whether the card is compromised; and

in response to inferring, by the server computer system within the processing path, that the card is compromised during processing of the new service request initiating, by the server computer system, one or more remedial actions to execute prior to completion of the processing of the new service request.

12 . The non-transitory computer readable storage medium of claim 11 , wherein prior to receiving the new service request, the operations further comprise:

generating, by the server computer system outside of the processing path, features for each set of completed service requests processed during the first time period; and

storing, by the server computer system in a data store, a set of outputs generated by the machine learning model from the features, wherein the set of outputs correspond to the set of completed service requests and are indicative of whether the card is compromised for each of the set of completed service requests.

13 . The non-transitory computer readable storage medium of claim 12 , wherein one of the set of outputs applied by the server computer system within the processing path and stored in the data store is a recent output from a recently completed service request, and the operations further comprise:

generating, by the server computer system within the processing path, the inference that the card is compromised during processing of the new service request based on the output generated by the machine learning model.

14 . The non-transitory computer readable storage medium of claim 11 , wherein the output generated by the machine learning model comprises a numerical value that represents a prediction of whether the card is determined to be compromised for the prior service request, and the operations for inferring, by the server computer system within the processing path, that the card is compromised further comprise:

combining the numerical value with a second numerical value generated for the new service request by a second machine learning model to generate a multidimensional score;

comparing the multidimensional score to a second threshold value; and

determining that the card is compromised based on whether the multidimensional score satisfies the second threshold value.

15 . The non-transitory computer readable storage medium of claim 11 , the operations further comprising:

initiating training of the machine learning model;

accessing a data store that stores data indicative of service requests processed for the client system using the card to authorize the service requests;

generating a training data set that includes a set of features generated for each of a set of the service requests, wherein the set of features comprise one or more text-based features, one or more categorical features, and one or more numerical features;

generating, for a service request of the set of service requests, a label indicative of whether the card was compromised during the processing of the service request; and

iteratively training the machine learning model using the set of service requests, the set of features, and the label generated for each of the set of service requests, to detect when a compromised card is used to authorize future service requests.

16 . A server computer system for detecting compromised cards during service requests transmitted to a distributed services system, the server computer system comprising:

a memory; and

one or more processors coupled with the memory configured to perform operations, comprising:

receiving, by a server computer system from a client system, a new service request associated with a card during a second time period that is after a first time period, wherein the card authorizes the new service request, and the new service request is processed within a processing path executed by the server computer system;

during processing of the new service request, accessing, by the server computer system, an output generated by a machine learning model outside of the processing path and prior to the second time period, wherein the output is indicative of whether the card is compromised based on analysis of historical data from a prior service request processed by the server computer system during the first time period;

applying, by the server computer system within the processing path, the output to the new service request to indicate whether the card is compromised; and

in response to inferring, by the server computer system within the processing path, that the card is compromised during processing of the new service request initiating, by the server computer system, one or more remedial actions to execute prior to completion of the processing of the new service request.

17 . The server computer system of claim 16 , wherein prior to receiving the new service request, the one or more processors are further configured to perform operations comprising:

generating, by the server computer system outside of the processing path, features for each set of completed service requests processed during the first time period; and

storing, by the server computer system in a data store, a set of outputs generated by the machine learning model from the features, wherein the set of outputs correspond to the set of completed service requests and are indicative of whether the card is compromised for each of the set of completed service requests.

18 . The non-transitory computer readable storage medium of claim 17 , wherein one of the set of outputs applied by the server computer system within the processing path and stored in the data store is a recent output from a recently completed service request, and the one or more processors are further configured to perform operations comprising:

generating, by the server computer system within the processing path, the inference that the card is compromised during processing of the new service request based on the output generated by the machine learning model.

19 . The non-transitory computer readable storage medium of claim 16 , wherein the output generated by the machine learning model comprises a numerical value that represents a prediction of whether the card is determined to be compromised for the prior service request, and the one or more processors configured to perform operations for inferring, by the server computer system within the processing path, that the card is compromised further comprise the one or more processors configured to perform operations comprising:

combining the numerical value with a second numerical value generated for the new service request by a second machine learning model to generate a multidimensional score;

comparing the multidimensional score to a second threshold value; and

determining that the card is compromised based on whether the multidimensional score satisfies the second threshold value.

20 . The non-transitory computer readable storage medium of claim 16 , wherein the one or more processors are further configured to perform operations comprising:

initiating training of the machine learning model;

accessing a data store that stores data indicative of service requests processed for the client system using the card to authorize the service requests;

generating a training data set that includes a set of features generated for each of a set of the service requests, wherein the set of features comprise one or more text-based features, one or more categorical features, and one or more numerical features;

generating, for a service request of the set of service requests, a label indicative of whether the card was compromised during the processing of the service request; and

iteratively training the machine learning model using the set of service requests, the set of features, and the label generated for each of the set of service requests, to detect when a compromised card is used to authorize future service requests.