FIELD

Embodiments described herein relate to the use of attributes associated with a device to identify the device.

BACKGROUND

Device identification is conventionally achieved based on individual cookies, html storage, and other client-side data or client-side attributes. Client-side data and client-side attributes of client devices are provided to servers by client devices via JavaScript, native mobile SDKs, etc.

SUMMARY

Embodiments described herein relate to the use of attributes associated with a device to identify the device. Specifically, the attributes associated with the device are used to achieve a persistent device identification (“PDI”) for fraud prevention systems. For example, PDI can be a server-side fraud prevention technique that can be used to prevent user account take over (e.g., relating to merchant accounts, accounts associated with financial institutions, etc.) by an unwanted third party. PDI improves fraud prevention systems' ability to identify and track user devices. By increasing the unique characteristics or attributes that can be associated with a particular user device (as accumulated over time via a number of transactions), PDI improves the efficiency of device identification and the prevention of fraudulent account takeover. This aggregation of unique characteristics and attributes also makes device identification and fraud prevention more robust by making device identification and fraud prevention more resilient to attribute changes or intentional obfuscation. For example, some fraud prevention and identification systems bind reliable and different attributes together (e.g., via hashing), which can result in an entire identifier being changed as the result of natural or artificial changes to its underlying attributes. PDI, however, is resilient to such changes. As a result, PDI provides device identification and fraud prevention with significantly greater longevity than conventional device identification and fraud prevention schemes. One advantageous byproduct of this longevity is the ability to use PDI to track attacker devices across otherwise dissimilar and well-obfuscated attacks.

PDI can utilize any number of different types of attributes such as device identification tokens (e.g., cookies), device fingerprints (e.g., device hardware fingerprints), location service technologies, network specific attributes, and historical activity associated with device identification to manage, identify, and verify a specific device and prevent fraudulent account takeover. PDI can also use PDI tokens and associated PDI records to uniquely identify devices across, for example, different locations and different accounts.

PDI tokens and PDI records permit, for example, a server to identify a device even if cookies or other data stores on the device are refreshed or drift over time, which is often the case when end users periodically update software applications on the device. Additionally, if a double-break event occurs in which both a device identification token (e.g., a cookie) and a device fingerprint (e.g., device hardware fingerprint) are lost, the server can still evaluate other user activity and server-side attributes of a device to identify the device. User activity and server-side attributes include, for example, user agent, operating system attributes, browser attributes, network attributes, account identifier (“ID”), geospatial data, Internet protocol (“IP”) address, hardware sensor information, onboard sensor information, etc.

PDI also enables the identification of a device based solely on the server-side attributes (e.g., IP address, IP network information, HTTP headers such as user agent, etc.) when no data is received from a client-side device. As a result, PDI improves a fraud prevention system's ability to identify and segment non-JavaScript browsers or other scenarios where HTTP traffic is directed to a client application web server (e.g., automated web traffic, site aggregators, etc.).

Embodiments described herein provide a fraud prevention system that includes a server. The server is operable to identify a client device based on one or more attributes associated with the client device. The server includes a processor and a memory. The server is configured to receive a first attribute of the client device from the client device and associated with a first transaction, receive a second attribute of the client device from the client device and associated with the first transaction, receive a third attribute related to the client device and associated with the first transaction, and generate, using the processor, a persistent device identification (“PDI”) record including the first attribute of the client device, the second attribute of the client device, and the third attribute related to the client device. The first attribute has a first value, the second attribute has a second value, and the third attribute has a third value. The server is also configured to store the PDI record in the memory and receive the third attribute related to the client device and associated with a second transaction. The third attribute has the third value. The server is also configured to identify the client device using the PDI record based on the third attribute related to the client device and associated with the second transaction without receiving, in association with the second transaction, the first attribute of the client device having the first value and the second attribute of the client device having the second value.

Embodiments described herein provide a fraud prevention system that includes a server operable to identify a client device based on one or more attributes associated with the client device. The server includes a processor and a memory. The server is configured to receive a first attribute of the client device and associated with a first transaction and receive a second attribute related to the client device and associated with the first transaction. The first attribute has a first value, and the second attribute has a second value. The server is further configured to generate, using the processor, a persistent device identification (“PDI”) record including the first attribute of the client device and the second attribute related to the client device, store the PDI record in the memory, and receive the second attribute related to the client device and associated with a second transaction. The second attribute has the second value. The server is further configured to identify the PDI record based on the second attribute related to the client device and associated with the second transaction without receiving, in association with the second transaction, the first attribute of the client device having the first value.

Embodiments described herein provide a fraud prevention method for identifying a client device based on one or more attributes associated with the client device. The method includes receiving, at a server, a first attribute of the client device and associated with a first transaction, and receiving, at the server, a second attribute related to the client device and associated with the first transaction. The first attribute has a first value, and the second attribute has a second value. The method further includes generating, using a processor of the server, a persistent device identification (“PDI”) record including the first attribute of the client device and the second attribute related to the client device, storing the PDI record in a memory or the server, and receiving, at the server, the second attribute related to the client device and associated with a second transaction. The second attribute has the second value. The method further includes identifying the PDI record based on the second attribute related to the client device and associated with the second transaction without receiving, in association with the second transaction, the first attribute of the client device having the first value.

Embodiments described herein provide a non-transitory computer readable medium including computer executable instructions stored in the computer readable medium for controlling a device to receive a request including one or more attributes related to a client device, identify a server-side persistent device identification (“PDI”) record for the client device based on the one or more attributes of the client device, identify a plurality of candidate accounts based on the server-side PDI record, determine confidence scores for each of the plurality candidate accounts, identify a candidate account of the plurality of candidate accounts having a highest value for a confidence score, generate a recommendation signal for a user account associated with the client device based on the candidate account of the plurality of candidate accounts having the highest value for the confidence score, and transmit the recommendation signal to a merchant server.

Embodiments described herein provide an account recommendation system that includes a server. The server is operable to identify a user account based on a server-side persistent device identification. The server includes a processor and a memory. The server is configured to receive a request including one or more attributes related to a client device, identify the server-side persistent device identification (“PDI”) record for the client device based on the one or more attributes of the client device, identify one or more candidate accounts based on the server-side persistent device identification, determine confidence scores for each of the one or more candidate accounts, generate a recommendation signal for the user account associated with the client device based on the confidence scores, and transmit the recommendation signal to a merchant server.

Embodiments described herein provide an account recommendation method. The method includes receiving, at a server, a request including one or more attributes related to a client device, identifying a server-side persistent device identification (“PDI”) record for the client device based on the one or more attributes of the client device, identifying one or more candidate accounts based on the server-side PDI record, determining confidence scores for the one or more candidate accounts, generating a recommendation signal for a user account associated with the client device based on the confidence scores, and transmitting the recommendation signal to a merchant server.

Before any embodiments are explained in detail, it is to be understood that the embodiments are not limited in its application to the details of the configuration and arrangement of components set forth in the following description or illustrated in the accompanying drawings. The embodiments are capable of being practiced or of being carried out in various ways. Also, it is to be understood that the phraseology and terminology used herein are for the purpose of description and should not be regarded as limiting. The use of “including,” “comprising,” or “having” and variations thereof are meant to encompass the items listed thereafter and equivalents thereof as well as additional items. Unless specified or limited otherwise, the terms “mounted,” “connected,” “supported,” and “coupled” and variations thereof are used broadly and encompass both direct and indirect mountings, connections, supports, and couplings.

In addition, it should be understood that embodiments may include hardware, software, and electronic components or modules that, for purposes of discussion, may be illustrated and described as if the majority of the components were implemented solely in hardware. However, one of ordinary skill in the art, and based on a reading of this detailed description, would recognize that, in at least one embodiment, the electronic-based aspects may be implemented in software (e.g., stored on non-transitory computer-readable medium) executable by one or more processing units, such as a microprocessor and/or application specific integrated circuits (“ASICs”). As such, it should be noted that a plurality of hardware and software based devices, as well as a plurality of different structural components, may be utilized to implement the embodiments. For example, “servers” and “computing devices” described in the specification can include one or more processing units, one or more computer-readable medium modules, one or more input/output interfaces, and various connections (e.g., a system bus) connecting the components.

Other aspects of the embodiments will become apparent by consideration of the detailed description and accompanying drawings.

