FIELD OF THE INVENTION

The present invention relates generally to the field of automated risk assessment, and more particularly to automated systems and methods for security risk assessment.

BACKGROUND OF THE INVENTION

Security in automated teller machines (ATMs) is currently either proactive or reactive. In either case, an ATM does not have the resources to protect itself, must depend on a set of static rules, and is devoid of any means to confuse or combat the thinking of an individual who attacks the ATM. There is currently no way for such an ATM to understand that it has a security issue. Nor is there currently a way to enable an ATM to learn from its security-related mistakes and assure that those same mistakes are not repeated. Software applications currently offered, as solutions in terms of ATM security generally require a substantial amount of memory and/or other resources to be available to an ATM. Thus, such legacy offerings are not feasible for ATM security solutions involving self-learning.

There is a present need for systems and methods that employ machine learning to enable the ATM itself to decide whether its security is under threat and to learn to fight such threat in real time using means made available to the ATM when the threat arises. The problem solved by embodiments of the invention is rooted in technical limitations of the legacy approaches, and improved technology is needed to address these problems. More specifically, the aforementioned legacy approaches fail to achieve the sought-after capabilities of the herein disclosed automated security risk assessment systems and methods.

SUMMARY OF THE INVENTION

Embodiments of the invention advance technical fields for addressing problems associated with the above-described legacy manual processes for automated security risk assessment as well as advancing peripheral technical fields. Such embodiments of the invention employ computer hardware and software, including, without limitation, one or more processors coupled to memory and non-transitory computer-readable storage media with one or more executable programs stored thereon which instruct the processors to perform the automated fraud risk assessment described herein.

Embodiments of the invention are directed to technological solutions that may involve automated systems that may employ, for example, a rules database function of an automated teller machine (ATM) processor storing a rules database record for only a single instance of a positive transition flow from a current state to an ensuing state for each of a plurality of ATM hardware or software activities initiated by the ATM processor; a security agent function of the ATM processor that extracts data points from a transition flow from a current state to an ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor; and an algorithm function of the ATM processor that generates a rules database record for the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on said extracted data points, and discards said generated rules database record when said generated rules database record is identical to a rules database record already stored on the rules database function of the ATM processor.

In other aspects of embodiments of the invention, the rules database function of the ATM processor may be, for example, a document database function of the ATM processor. In still other aspects, the rules database function of the ATM processor stores the rules database record for only the single instance of positive transition flow from the current state to the ensuing state as a state transition rule record for each of the plurality of ATM hardware or software activities initiated by the ATM processor. In additional aspects, for example, the rules database function of the ATM processor may store the database record as a state transition rule record in a whitelist of safe ATM transition states for each of the plurality of ATM hardware or software activities initiated by the ATM processor.

In further embodiments of the invention, for example, the security agent function of the ATM processor may extract data points from the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on a data points template. In still further aspects, for example, the security agent function of the ATM processor may output the extracted data points as an input to the algorithm function of the ATM processor. In additional aspects, for example, the algorithm function of the ATM processor may receive the extracted data points from the security agent function of the ATM and format and analyze the extracted data points for data integrity. In other aspects, for example, the algorithm function of the ATM processor may receive the extracted data points from the security agent function of the ATM and format and analyze the extracted data points for data integrity based on a model template for logical correctness of the extracted data.

In still further aspects of embodiments of the invention, the algorithm function of the ATM processor may be, for example, a discovery phase algorithm function of the ATM processor that generates the database record for the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on said extracted data points, and outputs said generated database record as a new rules database record when said generated database record is not identical to a rules database record already stored by the rules database function of the ATM processor. In other aspects, for example, the discovery phase algorithm function of the ATM processor may generate the rules database record for the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on said extracted data points, and store the generated rules database record as a new rules database record on the rules database function of the ATM processor when the generated rules database record is not identical to a rules database record already stored by the database function of the ATM processor.

In additional aspects of embodiments of the invention, the algorithm function of the ATM processor may be, for example, a protection phase algorithm function of the ATM processor that generates the rules database record for the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on said extracted data points, and sends a negative transition response to the security agent function of the ATM processor when the generated rules database record is not identical to a rules database record already stored by the rules database function of the ATM processor. In other aspects, the protection phase algorithm function of the ATM processor may generate the rules database record for the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on the extracted data points, and select a security risk mitigation protocol when the generated rules database record is not identical to a rules database record already stored by the rules database function of the ATM processor.

Embodiments of the invention may also provide methods involving, for example, storing, by a rules database function of an automated teller machine (ATM) processor, a rules database record for only a single instance of a positive transition flow from a current state to an ensuing state for each of a plurality of ATM hardware or software activities initiated by the ATM processor; extracting, by a security agent function of the ATM processor, data points from a transition flow from a current state to an ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor; and generating, by an algorithm function of the ATM processor, a rules database record for the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on said extracted data points, and discarding, by the algorithm function of the ATM processor, said generated rules database record when said generated rules database record is identical to a rules database record already stored on the rules database function of the ATM processor.

Other aspects of the method for embodiments of the invention may involve, for example, storing the rules database record by a document database function of the ATM processor. In still other aspects, storing the rules database record by the database function of the ATM processor may involve, for example, storing the rules database record for only the single instance of positive transition flow from the current state to the ensuing state as a state transition rule record for each of the plurality of ATM hardware or software activities initiated by the ATM processor. In additional aspects, storing the rules database record by the database function of the ATM processor may involve, for example, storing the database record as the state transition rule record in a whitelist of safe ATM transition states for each of the plurality of ATM hardware or software activities initiated by the ATM processor.

In further aspects of embodiments of the invention, extracting data points from the transition flow by the security agent function of the ATM processor may involve, for example, extracting the data points from the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on a data points template. In still further aspects, extracting data points from the transition flow by the security agent function of the ATM processor may involve, for example, outputting the extracted data points as an input to the algorithm function of the ATM processor.

In additional aspects of embodiments of the invention, generating the rules database record by the algorithm function of the ATM processor may involve, for example, receiving the extracted data points from the security agent function of the ATM, and formatting and analyzing the extracted data points for data integrity. In other aspects, formatting and analyzing the extracted data points may involve, for example, formatting and analyzing the extracted data points for data integrity based on a model template for logical correctness of the extracted data.

In still further aspects of embodiments of the invention, generating the rules database record by the algorithm function of the ATM processor may involve, for example, generating, by a discovery phase algorithm function of the ATM processor, the rules database record for the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on said extracted data points, and outputting, by the discovery phase algorithm function of the ATM processor, the generated rules database record as a new rules database record when the generated database record is not identical to a rules database record already stored by the rules database function of the ATM processor. In other aspects, outputting the generated rules database record as a new rules database record by the discovery phase algorithm function of the ATM processor may involve, for example, storing the new rules database record on the rules database function of the ATM processor when the generated rules database record is not identical to a rules database record already stored by the database function of the ATM processor.

In still other aspects of embodiments of the invention, generating the rules database record by the algorithm function of the ATM processor may involve, for example, generating, by a protection phase algorithm function of the ATM processor, the rules database record for the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on said extracted data points, and sending, by the protection phase algorithm function of the ATM processor, a negative transition response to the security agent function of the ATM processor when the generated rules database record is not identical to a rules database record already stored by the rules database function of the ATM processor. In additional aspects, generating the rules database record by the protection phase algorithm function of the ATM processor may involve, for example, generating the rules database record for the transition flow from the current state to the ensuing state for every succeeding ATM hardware or software activity initiated by the ATM processor based on the extracted data points, and selecting a security risk mitigation protocol when the generated rules database record is not identical to a rules database record already stored by the rules database function of the ATM processor.

These and other aspects of the invention will be set forth in part in the description which follows and in part will become more apparent to those skilled in the art upon examination of the following or may be learned from practice of the invention. It is intended that all such aspects are to be included within this description, are to be within the scope of the present invention, and are to be protected by the accompanying claims.

