Auto-generated synthetic identities for simulating population dynamics to detect fraudulent activity

• US 10,270,808 B1
• Filed: 03/12/2018
• Issued: 04/23/2019
• Est. Priority Date: 03/12/2018
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Sherif, Timur, Jouhikainen, Hannes, Blanchet, Steve
• Primary Examiner(s): Simitoski, Michael
• Application Number:
  US15/918,785
• Time in Patent Office: 407 Days
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud

Abstract

Embodiments disclosed herein generally relate to a system and method for detecting fraudulent computer activity. A computing system generates a plurality of synthetic identities. Each of the plurality of synthetic identities mimics information associated with a verified identity. The computing system receives, from a user, an input attempt. The input attempt includes a synthetic identity of the plurality of synthetic identities. The computing system compares input information in the input attempt to the plurality of synthetic identities. The computing system determines that the input information in the input attempt includes information from the plurality of synthetic identities, if it does, the computing system rejects the input attempt.

Claims

1. A method, comprising:

generating a plurality of synthetic identities by applying a machine learning model utilizing sources of verified information, such that the plurality of synthetic identities mimics information associated with a verified identity, the generating comprising;

referencing a generated candidate synthetic identity against one or more credit reporting agencies to verify that the candidate synthetic identity does not correspond to a verified identity;

determining that the candidate synthetic identity does not correspond to a verified identity; and

converting the candidate synthetic identity to a synthetic identity of the plurality of synthetic identities;

uploading the plurality of synthetic identities to a darkweb accessible web page;

receiving, from a user, an input attempt comprising input information associated with a synthetic identity of the plurality of synthetic identities;

comparing the input information in the input attempt to the plurality of synthetic identities;

determining that the input information in the input attempt comprises information from the plurality of synthetic identities; and

rejecting the input attempt.

2. The method of claim 1, further comprising:

identifying an Internet protocol (IP) address of the user attempting to use information from the plurality of synthetic identities;

identifying a further input attempt originating from the IP address; and

blocking the further input attempt.

3. The method of claim 2, wherein the further input attempt comprises further input information that corresponds to a verified identity.

4. The method of claim 2, wherein the further input attempt comprises further input information that contains information from the plurality of synthetic identities.

5. The method of claim 1, wherein generating the plurality of synthetic identities comprises:

generating a set of synthetic identification information that comprises at least one of a name, date of birth, social security number, bank account number, address, and telephone number.

6. The method of claim 1, wherein uploading the plurality of synthetic identities to a darkweb accessible web page comprises:

injecting the plurality of synthetic identities in the darkweb accessible webpage such that the plurality of synthetic identities is comingled with a plurality of verified identities on the darkweb accessible web page.

7. The method of claim 1, further comprising:

monitoring a computing system from which the input attempt originates, by tracking its IP address.

8. The method of claim 1, further comprising:

identifying a footprint of the input attempt; and

referencing the footprint in analysis of further input attempts.

9. A system, comprising:

a processor; and

a memory having programming instructions stored thereon, which, when executed by the processor, performs an operation comprising;

generating a plurality of synthetic identities by applying a machine learning model utilizing sources of verified information, such that the plurality of synthetic identities mimics information associated with a verified identity, the generating comprising;

referencing a generated candidate synthetic identity against one or more credit reporting agencies to verify that the candidate synthetic identity does not correspond to a verified identity;

determining that the candidate synthetic identity does not correspond to a verified identity; and

converting the candidate synthetic identity to a synthetic identity of the plurality of synthetic identities;

comparing a set of personal information of a first transaction attempt, wherein the first transaction attempt comprises an attempt to open an account using the set of personal information, to the plurality of synthetic identities;

determining that the set of personal information comprises information from the plurality of synthetic identities; and

rejecting the transaction attempt.

10. The system of claim 9, wherein the plurality of synthetic identities are hosted on a darkweb accessible web page.

11. The system of claim 9, wherein the operation further comprises:

identifying an Internet protocol (IP) address of a computing system attempting to use the information from the plurality of synthetic identities;

identifying a further transaction attempt originating from the IP address; and

blocking the further transaction attempt.

12. The system of claim 11, wherein the further transaction attempt comprises a further set of personal information that corresponds to a pre-existing account of the application.

13. The system of claim 11, wherein the further transaction attempt comprises a further set of personal information that comprises information from the plurality of synthetic identities.

14. The system of claim 9, wherein each of the plurality of synthetic identities comprises:

a set of synthetic identification information that comprises at least one of a name, date of birth, social security number, bank account number, address, and telephone number.

15. The system of claim 9, wherein comparing the set of personal information of the transaction attempt to the plurality of synthetic identities comprises:

comparing the set of personal information of the transaction attempt on a text field by text field basis.

16. The system of claim 9, the operation further comprising:

monitoring a computing system from which the input attempt originates, by tracking its IP address.

17. The system of claim 9, the operation further comprising:

identifying a footprint of the input attempt; and

referencing the footprint in analysis of further input attempts.

18. A non-transitory computer readable medium including one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform operations, comprising:

generating a plurality of synthetic identities by applying a machine learning model utilizing sources of verified information, such that the plurality of synthetic identities mimics information associated with a verified identity, the generating comprising;

referencing a generated candidate synthetic identity against one or more credit reporting agencies to verify that the candidate synthetic identity does not correspond to a verified identity;

determining that the candidate synthetic identity does not correspond to a verified identity; and

converting the candidate synthetic identity to a synthetic identity of the plurality of synthetic identities;

uploading the plurality of synthetic identities to a darkweb accessible web page;

receiving, from a user, an input attempt comprising input information associated with a synthetic identity of the plurality of synthetic identities;

comparing the input information in the input attempt to the plurality of synthetic identities;

determining that the input information in the input attempt comprises information from the plurality of synthetic identities; and

rejecting the input attempt.

19. The non-transitory computer readable medium of claim 18, wherein the operations further comprise:

identifying an Internet protocol (IP) address of the user attempting to use information from the plurality of synthetic identities;

identifying a further input attempt originating from the IP address; and

blocking the further input attempt.