Patent Publication Number: US-2018053105-A1

Title: Model Training for Multiple Data Spaces for Pattern Classification and Detection

Description:
BACKGROUND 
     Embodiments disclosed herein are related to systems and methods for detecting and classifying patterns associated with requests. 
     A system of processing requests may provide different processing options. The processing options can depend on one or more patterns that are incorporated into or associated with the request. The system of processing requests may detect the patterns incorporated into or associated with the requests and process the request based on the detection. 
     Additionally, the system of processing requests may need to detect the patterns, classify the detected patterns, and then select the processing option based on the classification of the patterns. Detection and classification of the patterns require a training of the system with known patterns. The training of the system of processing requests with known patterns can cause the system to detect and classify the known patterns with an acceptable accuracy. However, the pattern detection systems perform poorly when they encounter new, e.g., unknown, patterns. 
     There is therefore a need for a device, system, and method for updating the pattern detection systems and incorporating new patterns into the pattern detection systems. 
    
    
     
       BRIEF DESCRIPTION OF THE FIGURES 
         FIG. 1  is a block diagram of an exemplary system for detecting request patterns, according to some embodiments. 
         FIG. 2  is a block diagram of an exemplary system for detecting request patterns, according to some embodiments. 
         FIG. 3  is a block diagram of an exemplary networked system of processing requests based on request patterns, according to some embodiments. 
         FIG. 4  is a block diagram of an exemplary system having modules for updating features, according to some embodiments. 
         FIG. 5  is a block diagram of an exemplary system for incrementally updating the pattern detection model, according to some embodiments. 
         FIG. 6  illustrates an exemplary method of updating a pattern detection model, according to some embodiments. 
         FIG. 7  illustrates an exemplary method of processing requests based on request patterns, according to some embodiments. 
         FIG. 8  is a block diagram of an exemplary network system, according to some embodiments. 
     
    
    
     Embodiments of the present disclosure and their advantages may be understood by referring to the detailed description provided herein. It should be appreciated that reference numerals may be used to illustrate various elements and/or features provided in the figures. Further, the figures may illustrate various examples for purposes of illustration and explanation related to the embodiments of the present disclosure and not for purposes of any limitation. 
     DETAILED DESCRIPTION 
     In the following description specific details are set forth describing certain embodiments. It will be apparent, however, to one skilled in the art that the disclosed embodiments may be practiced without some or all of these specific details. The specific embodiments presented are meant to be illustrative, but not limiting. One skilled in the art may realize other material that, although not specifically described herein, is within the scope and spirit of this disclosure. 
     In some embodiments, a system receives and processes requests. The received requests are processed based on patterns incorporated into or associated with the requests to determine a classification for the request and/or to recognize how the request should be processed. In some examples, the request includes data related to how the request is generated, who generated the request, when/where the request is generated, which resources/devices the request has accessed, etc. This data can be a historic log that includes actions performed or resources accessed and may be viewed as a pattern, e.g., pattern of actions associated with the request that can be incorporated into the request. In summary, the patterns associated with the requests can correspond to how the request is generated including the performed steps/actions leading to the generation of the request. In some examples, the pattern of how a request is generated is an indication that the request is authentic. Also, the patterns can include data related to where or when the request is generated or on which device the request is generated or transmitted from. Alternatively, an artificial pattern can intentionally be added to the request. In some examples, a secure pattern, such as a drawing, e.g., a facial image/drawing, can be added to the request. Example embodiments herein describe related technologies to generate accurate pattern detection scores that can accurately classify the request based on the request pattern and consequently process the request based on the classification. In some examples, based on the performed steps/actions leading to the generation of the request, the request can be classified into two groups of authentic requests and inauthentic, e.g., forged or fake requests such that an authentic request is processed by the system and a fake request is ignored by the system. 
     Consistent with some embodiments, there is provided a system having a non-transitory memory for storing at least a first and a second database. The system includes one or more hardware processors that are configured to execute instructions. The instructions when executed as one or modules by the one or more hardware processors may cause the system to perform operations described herein. 
     In some embodiments, the system retrieves a first pattern detection model from the first data base. The first pattern detection model may detect a number of first patterns that may be associated with a request. Also, the first pattern detection model may include a number of first features such that the first features are used for detecting the first patterns. In some examples, features are attributes of patterns and the patterns are recognized, e.g., detected based on the features. 
     In some examples, the patterns are the data related to user activities related to a system like the generation of financial transaction requests, e.g., payment requests, by the user and the features are one or more of the 1) merchant address, 2) the device the request was originated on, 3) address of the requester, and 4) the IP address the request was first transmitted from, etc. The features may be used for recognizing the pattern of providing the request and then authenticating the request based on the recognition. 
     In some other examples, the patterns might be alphabetic characters incorporated into the request, and the feature is one or more of the 1) area enclosing the character, 2) number of sharp edges of the character, and 3) drawing length of the character. The feature may be used for recognizing the incorporated characters and then authenticating the request based on the recognition. 
     In some embodiments, a number of second patterns are retrieved from a second database. In some examples, the first database and the second database are combined into a single database. In some examples, the first patterns are generated in a first time span and the second patterns are generated in a second time span distinct from the first time span and may optionally correspond to a time span later than the first time span. In some examples, the first and second time spans have temporal overlap. 
     In some embodiments, a number of second features are selected based at least on the second patterns and the second features may be used for detecting the second patterns. In some examples, the features are some parameters corresponding to the patterns and the patterns are detected based on the features. In some examples, a feature is selected such that when a pattern exists the feature has a first range of values, and when the pattern does not exist the feature has a second range of value distinct from the first range of value such that the value of the feature may be an indication of the presence or non-presence of the pattern. 
     In some embodiments, a second pattern detection model is generated based on the first pattern detection model. The generation of the second pattern detection model includes two steps. First, one or more of the second features are incorporated into the first pattern detection model to create a partially trained interim pattern detection model such that the partially trained interim pattern detection model includes features that do not exist in the first pattern detection model. Second, after adding the one or more second features, the partially trained interim pattern detection model is trained, e.g., re-trained using the second patterns. In some examples, the interim pattern detection model is a small modification, e.g., small perturbation, of the original first pattern detection model and thus still holds part of the training information of the first pattern detection model and thus may be called as partially trained interim pattern detection model. 
     In some embodiments, a request is received by the system, where the request may include a request pattern. In some examples, the second pattern detection model that is trained by the second patterns is applied by a pattern processing engine executed on the one or more processers of the system. In some examples, the second pattern detection model is applied to the request pattern and a pattern detection score for the request pattern is generated. 
     In some embodiments, the request is processed based on the pattern detection score. In some examples, two or more processing options are provided based on the pattern detection score. In some examples, the options may include ignoring, e.g., denying, the request. 
     In various circumstances, the example embodiments described herein may resolve various challenges with regards to processing the received requests by the system. The processing is based on request patterns associated with the request. The requests can be received through a network. The request pattern may be the steps performed through the network and by the network including accessing network resources. As such, the example embodiments described herein may resolve problems that did not exist before the availability of the computer networks, particularly generating detection scores related to requests and processing requests based on the pattern detection scores. Notably, the modules may be implemented with hardware, software, or possibly with aspects of both hardware and software. 
       FIG. 1  is a simplified block diagram of an exemplary system  100  for detecting request patterns, according to some embodiments. The system  100  may also be used for processing requests  119 . As shown, the system  100  includes one or more processors  102  and memory  104  consistent with a non-transitory memory. The memory  104  includes at least two databases, a first database  108  and a second database  109 . The one or more processors  102  are coupled to memory  104  through connection, e.g., bus  114 , and may access the memory  104 . In some examples, the one or more processors  102  may execute a pattern processing engine  120 . In some examples, the pattern processing engine  120  is stored in the memory  104  and includes the instructions that cause the system to perform the operations. In some other examples, the pattern processing engine  120  is included in the instructions, e.g., as part of the instructions that are stored in the memory  104 . In some examples, the system  100  includes two or more memories including two or more non-transitory memories such that the instructions and the databases are stored in separate memories. 
     In some examples, the pattern processing engine  120  may be implemented using hardware components, such as a processor, an application specific integrated circuit (ASIC), a programmable system-on-chip (SOC), a field-programmable gate array (FPGA), and/or programmable logic devices (PLDs), among other possibilities. 
     In some embodiments, one or more patterns are associated with the requests  119 . Alternatively, one or more patterns are incorporated into the requests  119 . In some examples, the one or more patterns of the request  119  are retrieved by the pattern processing engine  120  from the memory  104 . 
     In some embodiments, a first pattern detection model  132  is retrieved from the database  108  of the memory  104 . The first pattern detection model may detect a plurality of first patterns  134 . In an example, the plurality of first patterns  134  are stored in the database  108  of the memory  104 . The first pattern detection model  132  includes a plurality of first features  136  where the first features  136  are used by the first pattern detection model  132  for detecting the first patterns  134 . In some examples, the pattern processing engine  120 , executing on the one or more processors  102 , applies the first pattern detection model  132  to detect the first patterns  134  based on the first features  136 . 
     In some examples, a plurality of second patterns  144  are retrieved from database  109  of the memory  104 . Based at least on the plurality of second patterns  144 , a plurality of second features  148  may be selected where the second features  148  may be used for detecting the second patterns  144 . In some examples, the pattern processing engine  120 , executing on the one or more processors  102 , applies a pattern detection model, possibly different from the first pattern detection model  132 , to detect one or more of the second patterns  144  based on one or more of the second features  148 . 
     In some embodiments, the second pattern detection model  142  is generated based on the first pattern detection model  132 . In some examples, the second pattern detection model  142  is stored in database  109  of the memory  104 . The generation of the second pattern detection model  142  includes the incorporation of one or more of the plurality of second features  148  into the first pattern detection model  132  to create an interim pattern detection model. Incorporating one or more of the plurality of second features  148  to the first features  136  creates the updated features  146 . In some examples, the second pattern detection model  142  uses the updated features  146 , which include at least one or more features that are present in the features  136  of the first pattern detection model  132 . The generation of the second pattern detection model  142  also includes training the second pattern detection model  142  using the plurality of second patterns  144 . In some examples, the first patterns  134  are generated in a first time period and the second patterns  144  are generated in a second time period distinct from the first time period that may optionally correspond to a time period after the first time period. In some examples, the second time period may correspond to a time period after the first pattern detection model  132  is created. In some examples, the training of the second pattern detection model  142  is performed by pattern processing engine  120  executing on the one or more processors  102 . The training may be performed iteratively and the iterations can continue until a predetermined level of accuracy in detecting the second patterns  144  is achieved. 
     In some embodiments, a request  119  is received by the system  100 . The request  119  can include a request pattern. In some examples, the request pattern is associated with the request  119  and may include data related to the generation of the request  119 . In some examples, the data may optionally include a location, time, and/or device used for generating the request. In some examples, for security purposes, a pattern such as a unique piece of data such as an image, or a sequence of numbers may be added as the request pattern to the request  119 . 
     In some examples, the pattern processing engine  120  applies the second pattern detection model  142  to the request pattern of the request  119  to generate a pattern detection score for the request pattern of the request  119 . 
     In some embodiments, the pattern processing engine  120  further processes the request  119 . The processing is based on the generated pattern detection score. In some examples, the processing may include ignoring, e.g., denying the request. In some examples, the generated pattern detection score specifies the security level of the request  119  and the request  119  is only executed when it is deemed a secure request. In some examples, the pattern detection score can limit the extent to which the request  119  can be processed. In some examples, if the request is related to accessing a network system, a non-perfect pattern detection score can limit the extent of accessing the network. In some examples, if the request is related to accessing a financial system, a non-perfect pattern detection score can exert a limit, e.g., a limit on the amount the financial transactions. 
       FIG. 2  is a simplified block diagram of an exemplary system  200  for detecting request patterns, according to some embodiments. The system  200  may also be used for processing requests  119 . As shown and similar to  FIG. 1 , the system  200  includes one or more processors  102  and the memory  104  that are consistent with the processor  102  and memory  104  of system  100  of  FIG. 1 . Consistent with system  100 , memory  104  includes at least two databases  108  and  109 . The one or more processors  102  are coupled to memory  104  through connection, e.g., bus  114  and may access the memory  104 . In some examples, the one or more processors  102  may execute a pattern processing engine  120 . The system  200  also includes the network interface  204  that communicates between the one or more processors  102  and a network external to the system  200 . The network interface  204  receives the requests  119  through the connection, e.g., network link  210  and then sends requests  119  through the connection, e.g., bus  202  to the one or processors  102 . 
     In some embodiments, consistent with system  100  of  FIG. 1 , the system  200  includes the first pattern detection model  132 , a plurality of first patterns  134 , and the first features  136  that are used by the first pattern detection model  132  for detecting the first patterns  134 . In some examples, the features  136  are attributes of the patterns  134  and are selected such that when an attribute exists a first range of values are assigned to the feature, and when the attribute does not exist, a second range of values distinct from the first range of values are assigned. In some examples, analyzing a pattern to find a feature and to assign a value associated with the pattern to the feature may be called “feature extraction”. In some examples, the value assigned to the feature indicates if an attribute exists in a pattern or does not exist. 
     In some embodiments, existence of a feature in a pattern may cause the recognition, e.g., detection of the pattern. In some examples, non-existence of a feature in a pattern may cause the recognition, e.g., detection of the pattern. In some examples, the existence of one or more first key features and non-existence of one or more second key features in a pattern may cause the recognition, e.g., detection of the pattern. In some examples, the pattern processing engine  120  may use the values assigned to the features and based on a predefined function calculate a pattern detection score and based on the calculated score the pattern processing engine  120  may detect the pattern, e.g., detects if the pattern exists or does not exist. 
     In some examples, the values assigned to the features are numbers, real or integer. In some examples, the values assigned to the features are logical values, e.g., yes/no, or true/false. In some examples, the values assigned to the features are fuzzy values, e.g., definitely exists, probably exists, probably does not exist, and definitely does not exist. 
     In some embodiments, consistent with system  100  of  FIG. 1 , the system  200  includes a second pattern detection model  142  that is generated based on the first pattern detection model  132 . The generation of the second pattern detection model  142  includes the incorporation of one or more of the plurality of second features  148  into the first pattern detection model  132  to add to the first features  136  and create the updated features  146 . In some examples, the second pattern detection model  142  comprises the updated features  146  that at least one of them does not exist in the features  136  of the first pattern detection model  132 . 
     In some examples, the plurality of second patterns  144  are retrieved from the second database  109  of the memory  104 . Based at least on the plurality of second patterns  144 , a plurality of second features  148  may be selected where the second features  148  may be used for detecting the second patterns  144 . In some examples, the pattern processing engine  120  applies a pattern detection model possibly different from the first pattern detection model  132  for detecting the second patterns  144  based on the second features  148 . In some examples, the plurality of second patterns  144  include new patterns that did not exist and thus their features were not included when the first pattern detection model  132  was generated. In some examples, the plurality of second patterns  144 , although are captured after the first pattern detection model  132  was generated may include one or more patterns similar to or the same as the first patterns  134 . 
     In some examples, the number of features in the first pattern detection model  132  is between 200 and 800 features, e.g., 400 features. In some examples, the second pattern detection model  142  is created by incrementally updating the first pattern detection model  132  such that each time a predetermined and limited number of new features, e.g., 5 percent, 10 percent, and/or 15 percent is added to the already existing features to update the features of the pattern detection model. In some examples, the second pattern detection model  142  is created by incrementally updating the first pattern detection model  132 , such as each time a predetermined and limited number of new features, e.g., 25, 50, and/or 100 features, is added to the already existing features to update the features of the pattern detection model. The generation of the second pattern detection model  142  also includes training the second pattern detection model  142  using the plurality of second patterns  144 . In some examples, the first patterns  134  are generated in a first time period and the second patterns  144  are generated in a second time period distinct from the first time period that may optionally correspond to a time period after the first time period. In some examples, the second time period may correspond to a time period after the first pattern detection model  132  is created. In some examples, the training of the second pattern detection model  142  is performed by pattern processing engine  120  executing on the one or more processors  102 . The training may be performed iteratively and the iterations can continue until a predetermined level of accuracy in detecting the patterns are achieved. 
     In some embodiments, one or more requests  119  is received through the network interface  204  and connection, e.g., network link  210  by the system  200 . Each of the requests  119  can be associated with or may include a request pattern. In some examples, the request pattern is associated with the request  119  and may include data related the generation of the request  119 . In some examples, the data may optionally include a location, time, and/or device used for generating the request. In some examples, for security purposes, a pattern such as a unique piece of data such as an image, a sequence of numbers, or a combination of an image and a sequence of numbers may be added as the pattern to the request  119 . 
     In some examples, the pattern processing engine  120 , executing on the one or more processors  102 , implements the second pattern detection model  142  for detecting the request pattern of the request  119  received through the network interface  204  and to generate a pattern detection score for request pattern of the request  119 . 
     In some embodiments, the pattern processing engine  120  processes the request  119  received through the network interface  204 . The processing is based on the generated pattern detection score. In some example, the processing may include ignoring the request. In some examples, the generated pattern detection score specifies the security level of the request  119  received via the network interface  204  and the request  119  is only executed when it is deemed a secure request. In some examples, the pattern detection score can limit the extent of the request, e.g., the level the request can access resources or a limited time window for processing the request. In some examples, if the request is related to accessing a network system, a non-perfect pattern detection score can limit the extent of accessing the network, e.g., resources of the network. In some examples, if the request is related to accessing a financial system, a non-perfect pattern detection score can exert a limit on an amount of the financial transactions or can set a limited window of time the request can be processed. 
     As described, training the second pattern detection model  142  based on the first pattern detection model  132  may be done as an incremental training using the second patterns  144  such that the second patterns  144  used for the training did not exist at the time the first pattern detection model  132  was created. The training process in the incremental training is essentially faster than training using the whole data set of the first patterns  134  and second patterns  144 . Specifically, the incremental training can occur in relatively short time spans, e.g., every month, every two months, and/or at any other suitable interval. 
     In some embodiments, in addition to selecting features, training second pattern detection model  142  includes defining structural rules or statistical rules of the patterns. The statistical rules include specifying a range of values for the features. The structural rules, besides specifying a range of values for the features, may optionally specify a logical value for the value and/or may include a grammar for how the features are positioned physically or temporally. 
     In some embodiments, the first pattern detection model  132  and the second pattern detection model  142  are models for detecting transaction fraud patterns. Also, the plurality of first patterns  134  and the plurality of second patterns  144  are transaction patterns that include fraud patterns. In some examples, the transaction requests include transaction patterns, and based at least on the detection score, the received transaction request is classified into a fraudulent transaction request group and the transaction request is not processed. 
     In some embodiments, the systems  100  and  200  of  FIGS. 1 and 2 , are systems that may receive a user request to allow the user to enter a gate, either physically by entering a secure door, or virtually by entering into a system such as a network. The user request may be validated by recognizing a pattern associated with the user request. In some examples, the pattern may include an image associated with the requester, e.g., a facial image, a fingerprint, an iris image, and/or the like. 
     In some embodiments, the plurality of first patterns and the plurality of second patterns are patterns of user activities interacting with a network-based system. In some examples, the first pattern detection model and the second pattern detection model are models for detecting patterns of activities of users when interacting with network-based systems. The plurality of first patterns and the plurality of second patterns are the patterns of activities of users when interacting with the network-based systems. 
     In some examples, the first pattern detection model and the second pattern detection model are models for detecting patterns of activities occurring inside a system. The plurality of first patterns and the plurality of second patterns are the patterns of activities associated with one or more subsystems of the system. 
       FIG. 3  is a block diagram  300  of an exemplary networked system of processing requests based on request patterns, according to some embodiments. The block diagram  300  includes a system  320  that is consistent with the system  200  of  FIG. 2 . The system  320  is connected through the connection, e.g., network link  302  to the network  310 . The connection  302  is consistent with the connection  210  in  FIG. 2  such that the system  320  can communicate through a network interface, e.g., network interface  204  with the network  310 . the network  310  is LAN, WAN, wireless, Internet, and/or any network system. 
     In some embodiment, users can use client devices  312  and  314  to communicate through the network  310  to the system  320 . The client devices  312  and  314  can send requests  119  through the connections, e.g., network links  306  and  308  to the network  310  and the network can send the requests  119  through the connection  302  to the system  320 . 
     In some embodiments, the request  119  is received through a network interface consistent with network interface  204  of  FIG. 2 . The request  119  is received through the network  310  and from a client device  312  or  314  of a user. One or more features of one or more patterns associated with or incorporated into the received request  119  are extracted. The extracted features are consistent with the features  146  of  FIGS. 1 and 2 . A detection score corresponding to the received request  119  and based on the extracted features is generated. Consistent with the system  200  of  FIG. 2 , the detection score can be generated by the pattern processing engine  120  executing on the one or more processors  102  and applying the extracted features to a detection model that is consistent with the second pattern detection model  142  of  FIGS. 1 and 2 . The received request  119  is classified based on the detection score into one or more groups. The classification can be performed by the pattern processing engine  120  executing on the one or more processors  102 . Then, the received request  119  is processed based on the detection score, classification, or both. 
     In some embodiments, the client device  312  or  314  is a mobile device communicating with the system  320  through the network  310 , e.g., a wireless network or a cloud network. 
       FIG. 4  is a block diagram  400  of an exemplary system having modules for updating the features, according to some embodiments. The block diagram  400  includes the existing features  410  that are consistent with the plurality of first features  136  of  FIGS. 1 and 2 . The block diagram  400  also includes the new features  420  that are consistent with the plurality of second features  148  of  FIGS. 1 and 2 . The block diagram  400  additionally includes the feature updating module  430  that receives the existing features  410  and new features  420  and combines one or more of the new features  420  into the existing features  410  and generates the updated features  440 . The updated features  440  are consistent with the updated features  146  and the new features  420  are consistent with the second features  148  of  FIGS. 1 and 2 . In some examples, the feature updating module  430  is included in the pattern processing engine  120  of  FIGS. 1 and 2 . 
     In some embodiments, the existing features  410  that are consistent with feature  136  of the first pattern detection model  132  in  FIGS. 1 and 2  are received from the first database  108  of the memory  104 . In some examples, the new features  420  that are consistent with the plurality of second features  148  of  FIGS. 1 and 2  and are generated by the feature selection module  424  that may be a module of the pattern processing engine  120  of  FIGS. 1 and 2 . The feature selection module  424  receives the second patterns  422  that are consistent with the second patterns  144  of  FIGS. 1 and 2 . 
     In some embodiments, the second patterns  422  include new patterns  428  that did not exist when the first pattern detection model  132  was generated and thus their features were not included when the first pattern detection model  132  was trained. In some examples, the second patterns  422 , despite being captured after the first pattern detection model  132  was generated, may optionally include one or more falsely classified patterns  426 . The falsely classified patterns are similar to or the same as the first patterns that are incorrectly recognized by the first pattern detection model  132 , i.e., they are request patterns that are missed when they should have been recognized or are request patterns that are wrongly recognized by the first pattern detection model  132 . 
     In some embodiments, when combining the existing features  410  and new features  420 , some of the existing features  410  are removed such that the number of features in  410  and  440  are essentially equal and are within less than 5 percent, e.g., one percent, or other percentage of each other. As described, in the incremental training, the number of features selected from the new features  420  to be combined with the existing features  410  may be limited, e.g., to 10 percent of the number of features in  410 . Also, in the incremental training, the updated pattern detection model is trained, e.g., re-trained with the second patterns  144  and thus the incremental training is a much faster process compared to generating a pattern detection model from scratch by training all features with all possible patterns. 
       FIG. 5  is a block diagram  500  of an exemplary system having modules for incrementally updating the pattern detection model, according to some embodiments. In some examples, the second patterns  516  that are consistent with the second patterns  144  of the  FIGS. 1 and 2  are captured after the first pattern detection model  502  is created. The first pattern detection model  502  is consistent with the first pattern detection model  132  of  FIGS. 1 and 2 . Additionally, the second patterns  516  are used by the feature selection module  514  to generate the second features  512  and the feature updating module  504  receives the first pattern detection model  502  as well as the second features  512  and incorporates one or more of the second features  512  into the features of the first pattern detection model  502 . The second patterns  516  is consistent with the second patterns  422 , the feature selection module  514  is consistent with the feature selection module  424 , and the feature updating module  504  is consistent with feature updating module  430  of  FIG. 4 . 
     In some embodiments, the second pattern detection model  520  is consistent with the second pattern detection model  142  and the second features  512  are consistent with the second features  148  of  FIGS. 1 and 2 . Additionally, consistent with  FIGS. 1 and 2 , the feature updating module  504 , the training module  510 , and the feature selection module  514  may be modules of the pattern processing engine  120 . 
     In some examples, the feature updating module  504  receives the first pattern detection model  502  and incorporates one or more of the second features  512  associated with the second patterns that are captured after the first pattern detection model  502  is created into the features of the first pattern detection model  502  to update the first pattern detection model  502 . The training module  510  then receives the updated model and re-trains it using the second patterns  516  and creates the second pattern detection model  520 . 
     In some examples, the re-training includes one or all of: updating pattern recognition rules, defining new pattern recognition rules, removing existing pattern recognition rules, updating pattern recognition parameters, removing existing pattern recognition parameters, and/or defining new pattern recognition parameters. 
     In some embodiments, the first pattern detection model  502  is directly fed into and training module  510  and the feature updating module  504  is skipped. In some examples, the second features  512  are not selected and the features of the first pattern detection model  502  are not updated. In some examples, the first pattern detection model  502  is re-trained by the second patterns  516  without first updating the first pattern detection model  502  such that the features of the first pattern detection model  502  are kept the same and the features of the second pattern detection model  520  and the model is merely re-trained by the new patterns, e.g., second patters  516 . Thus, the second pattern detection model  520  has exactly the same features of the first pattern detection model  502 . 
     In some examples, the training module  510  performs an iterative training of the updated model using the second patterns  516 . In the iterative training, after applying one or more of the second patterns  516  to the updated model, based on the outcome of the updated model, the parameters of the updated model are further updated until a predefined level of accuracy in detecting the patterns is achieved. In some examples, the predefined level of accuracy includes correctly recognizing patterns having the desired attributes by a predefined percentage of accuracy, e.g., more than 90 percent and correctly rejecting patterns not having the desired attributes by a predefined percentage of accuracy, e.g., 98 percent. In some examples, the training includes modifying the pattern recognition rules and/or parameters such that in the patterns having the desired attributes are grouped with each other and patterns not having the desired attributes are also separately grouped with each other with a safe distance between the two groups. In some examples, the safe distance between the two groups is defined by the inaccuracy and noise that inherently exists in capturing the patterns. The distance between the two groups is safe and there is a low probability of inaccurate recognition when the distance is much larger than the inaccuracy of measurements and noise of data gathering associated with capturing the patterns. 
     In some embodiments, the first pattern detection model  502  and the second pattern detection model  520  are implemented as neural networks that include an input layer, a hidden layer, and an output layer. In some examples, the input layer of the neural network includes two or more nodes, where the number of nodes is equal to the number of features of the pattern detection model. In some examples, the input layer has between 200 and 800 nodes. In some examples, the neural network includes a hidden layer with between 10 and 20 nodes. In some examples, the output layer of a neural network may include a single node and the single node provides a pattern detection score. 
     In some embodiments, by adding one or more new nodes to the input layer of the neural network, one or more of the second features are incorporated into the neural network. In some examples, by removing one or more nodes of the input layer of the neural network, one or more of the existing first features are deleted from the neural network. 
     In some embodiments, the neural network is trained using the first patterns to generate the first pattern detection model  502 . In some examples, possibly after adding one or more new input nodes and removing one or more existing input nodes, the neural network is re-trained using the second patterns to generate the second pattern detection model  520 . In some examples, one or more methods including the simulated annealing or gradient descent are used for training the first pattern detection model  502  or for re-training second pattern detection model  520 . 
     In some examples, the first pattern detection model  502  is generated using all patterns that were known and useful at the time of creation of the first pattern detection model  502 . In some examples, the number of features in the first pattern detection model  502  is between 200 and 800 features. Thus, although the first pattern detection model  502  is stable, the creation of the first pattern detection model  502  may take a long time. In some other examples, updating the first pattern detection model  502  to create the second pattern detection model  520  is faster because the second pattern detection model  520  involves an incremental and limited change and a small and separate set of data, e.g., the second patterns  516 , are used for its re-training. Keeping the changes between the first pattern detection model  502  and the second pattern detection model  520  to a limited, e.g., less than ten, percent of features may cause the second pattern detection model  520  to enjoy the stability of the first pattern detection model  502 . In some examples, after a few, e.g., less than ten, incremental changes a pattern detection model using the complete set of patterns may be generated. 
     In some examples, the first patterns and the second patterns are financial transaction patterns that include fraudulent patterns. In some examples, the fraudulent patterns change at a much greater rate than a rate at which a pattern detection model using a full set of patterns can be created, tested, and implemented, and thus the incremental updating of the pattern detection model may be used to keep up with the rate that the fraudulent patterns change. Thus, the proposed incremental updating may solve a problem related to network or Internet based financial transactions in the area of security. 
       FIG. 6  illustrates an exemplary method  600  of updating a pattern detection model, according to some embodiments. Notably, one or more steps of the method  600  described herein may be omitted, performed in a different sequence, and/or combined with other methods for various types of applications contemplated herein. The method  600  may be performed by any of the systems  100 ,  200 , and/or  320  of  FIGS. 1-3 . The method  600  can be used as a method of processing a request. In some embodiments, one or more the processes of the method  600  may be implemented by instructions (e.g., software instructions) stored on the non-transitory memory, e.g., non-transitory memory  104  of  FIGS. 1 and 2  that is executed by one or more processors, e.g., the one or more processors  102  of  FIGS. 1 and 2 . 
     As shown in  FIG. 6 , at step  602 , the method  600  may include retrieving the first pattern detection model. The first detection model may include the first features for detecting the first patterns and may optionally be retrieved from a first database, e.g., database  108  of  FIGS. 1 and 2 . In some examples, the first pattern detection model includes parameters and/or rules that are designed for distinguishing the first patterns  134  from each other. The first features are attributes of the first patterns and are selected such that the patterns including the attributes and the patterns not including the attribute are distinguishable from each other. In some examples, the features are selected such that the patterns including the attributes and the patterns not including the attributes are clustered and separate from each other in the space defined by the features. In some examples, the first patterns are normalized and redundant features are removed. In some examples, the removed features are related to patterns that belong to the past and do not occur anymore. 
     In some examples, the requests are financial transaction requests. In some examples, a specific version of an IOS or Android software may have a security bug. The software version may be selected as one of the features extracted from the request patterns of a financial transaction request. By recognizing that a financial transaction request is originated from a mobile device having the problematic software version, the system may impose a limit on the amount of the financial transaction request. Later on, when the software is updated and the security bug is removed, there may not be any need to have the software version as a feature and this feature may be retired, e.g., removed. 
     At step  604 , the method  600  may include retrieving second patterns and selecting second features for detecting the second patterns. The second patterns  144  may optionally be retrieved from the second database, e.g., database  109  of  FIGS. 1 and 2 . The second features are attributes of the second patterns and are selected such that the patterns including the attributes and the patterns not including the attribute are distinguishable from each other. In some examples, the features are selected such that the patterns including the attributes and the patterns not including the attribute are clustered and separate from each other in the space defined by the features. In some examples, the second patterns  144  are normalized and redundant features are removed. In some examples, the second patterns  144  are produced after the first pattern detection model was generated. 
     At step  606 , the method  600  may include generating a second pattern detection model based at least on the first pattern detection model. In some examples the first pattern detection model and the second pattern detection model are consistent with the pattern detection models  132  and  142  in  FIGS. 1 and 2 . The generation of the second pattern detection model may include the incorporation of the second features into the first pattern detection model to create an interim pattern detection mode. In some examples and consistent with  FIGS. 1 and 2 , one or more from the second features are incorporated into the first pattern detection model such that the first pattern detection model is updated by adding one or more features from the second features to the already existing features of the first pattern detection model. As noted, in some examples, the first pattern detection model is updated by adding one or more features from the second features and deleting one or more of the already existing features of the first pattern detection model. In some examples, the one or more deleted features, e.g., retired features, are associated with patterns that are not expected to occur. The generation of the second pattern detection model may also include training, e.g., re-training, the interim pattern detection model by the second patterns  144  to generate the second pattern detection model. The training can be performed by the pattern processing engine  120  executing on the one or more processors  102  of  FIGS. 1 and 2 . 
     In some examples, the first pattern detection model is generated by analyzing the complete set of patterns, e.g., the first patterns  134 , and selecting a set of first features/attributes  136  from detecting the first patterns  134 . In some examples, the feature selection may include designating the first patterns  134  into a number of groups of associated patterns and then selecting separate features for each group of associated patterns. In some examples, the feature selection may include normalizing the patterns associated with each other. In some embodiments, the first pattern detection model is trained with the complete set of first patterns  134 . In some examples, another feature selection may be performed after the training that include analyzing all the features with respect to detecting all the patterns and reducing the feature space dimensions by 1) removing the features that are not effective in distinguishing the patterns and 2) removing the features that can distinguish rarely occurring patterns. In some embodiments, the second pattern detection model is generated using the second patterns  144 . The second patterns  144  are the patterns that occurred after the first pattern detection model was created, and thus the second pattern detection model  142  is incrementally generated based on the first pattern detection model  132 . 
     The processes of method  600  are now described in the context of a representative example related to how a pattern detection model for classifying a transaction request, e.g., a financial transaction request, is updated. In some examples, at step  602 , a first pattern detection model for detecting request patterns of financial transaction requests is retrieved. The first pattern detection model can determine whether a financial transaction request is valid, e.g., legitimate. The validity is determined based on the request pattern associated with the financial transaction request and by applying the pattern detection model to the request pattern. In some examples, the request pattern is the information related to location, time, and/or steps of the request. In some examples, the request pattern includes the IP address and/or location of the device making the request, a credit card and/or account number associated with the request, the last time the account associated with the request was accessed, the number of accounts having access to the credit card, the individual making the request, and/or the like. At step  604 , second request patterns are retrieved. The second request patterns are associated with financial transaction requests that have occurred after the first pattern detection model was generated. At step  606 , the second pattern detection model is generated by updating the first pattern detection model such that features related to second request patterns are incorporated and to create an interim, e.g., updated, pattern detection model. The updated model is re-trained by the second request patterns associated with financial transaction requests that have occurred after the first pattern detection model was generated. 
       FIG. 7  illustrates an exemplary method  700  of processing requests based on request patterns, according to some embodiments. Notably, one or more steps of the method  700  described herein may be omitted, performed in a different sequence, and/or combined with other methods for various types of applications contemplated herein. The method  700  may be performed by any of the systems  100 ,  200 , and/or  320  of  FIGS. 1-3 . The method  700  can be used as a method of processing a request. In some embodiments, one or more of the processes of the method  700 , may be implemented by instructions (e.g., software instructions) stored on the non-transitory memory, e.g., non-transitory memory  104  of  FIGS. 1 and 2 , that is executed by one or more processors, e.g., the one or more processors  102  of  FIGS. 1 and 2 . 
     As shown in  FIG. 7 , at step  702 , the method  700  may include receiving a request that includes a request pattern from a client device of a user. The request can be received over a network. Consistent with  FIG. 3 , the request  119  can be received from a client device  312  or  314  of a user over the network  310  and the received request may include a request pattern. In some examples, the request pattern is the actions performed by the user leading to the request. The request patterns are consistent with request patterns of  FIG. 2 . 
     At step  704 , the method  700  may include extracting one or more features of the request pattern. In some examples, the features are already selected and the feature extraction assigns a value, e.g., a logical value, to the feature. In some examples, the request is a financial transaction request and the feature is the location of the user, e.g., requester. Feature extraction is finding the location of the user and assigning it to the feature. 
     At step  706 , the method  700  may include applying the second pattern detection model to the request pattern to generate a pattern detection score. Thus, a pattern detection score is generated based on the application of the second pattern detection model for the received request. In some examples, the second pattern detection model  142  is applied to the request pattern of the received request to generate a pattern detection score. Consistent with  FIGS. 1 and 2 , the pattern processing engine  120  may apply the second pattern detection model on the request pattern of the request to generate the pattern detection score. Consistent with  FIG. 2 , the request  119  can be received through the network interface  204 . In some examples, a request pattern is associated with/included in the request and is received by the pattern processing engine. The pattern processing engine then applies the second pattern detection model  142  to the request pattern of the request, and generates a pattern detection score. In some examples, the pattern detection score determines how legitimate the request is, such as by comparing the score with a threshold value. 
     At step  708 , the method  700  may include classifying the received request based on the pattern detection score. The received request may be classified into one of a plurality of groups. Consistent with  FIGS. 1 and 2 , the pattern processing engine  120  may perform the classification. In some examples, the request is a financial transaction request and based on the pattern detection score the financial transaction request can be classified as one of: executing the request, executing the request after imposing a transaction limit, executing the request after imposing a time limit, and denying the request. 
     At step  710 , the method  700  may include processing the request based on the pattern detection score, the classification, or both. As noted, in some examples, the pattern detection score indicates how legitimate the request is, and based on this determination the request is processed without limitation, the request gets extra limitations in time or amount, or the request is ignored, e.g., denied. 
     The processes of method  700  are now described in the context of a representative example related to determining how a transaction request, e.g., a financial transaction request, is processed. In some examples, at step  702 , a financial transaction request and its associated request pattern is received from a client device of a user and over a network. At step  704 , one or more features of the request pattern of the financial transaction request are extracted. At step  706 , the second pattern detection model is applied to the request pattern of the received financial transaction request and a pattern detection score is generated. The pattern detection score is an indication of the validity of the financial transaction request. At step  708 , the received financial transaction request is classified based on the detection score into one of a plurality of groups. At step  710 , the financial transaction request is processed based on the pattern detection score, the classification, or both. If the pattern detection score indicates that it is a valid request, then the financial transaction request is executed, and if the pattern detection score indicates that it is a fraudulent financial transaction request, then it is denied. 
       FIG. 8  is a block diagram of an exemplary network system  800 , according to some embodiments. The network system  800 , possibly referred to as the network system for processing requests, is consistent with the network  310  of  FIG. 3  and may be configured to transfer data over one or more communication networks  808 . The communication network  808  is consistent with network  310  of  FIG. 3 . In particular, the network system  800  may include the system/server  801 . In some examples, system/server  801  may be consistent with system  200  of  FIG. 2 . The system/server  801  may be configured to perform operations of a service provider, such as PayPal, Inc. of San Jose, Calif., USA. Further, the network system  800  may also include a client device, e.g., a user device  805  and/or a client device, e.g., a user device  806  operated by their respective users. The user device  805  and/or the user device  806  are consistent with the client devices  312  and  314  of  FIG. 3 . In practice, the system/server  801  and the user devices  805  and/or  806  may be configured to communicate over the one or more communication networks  808 . 
     In some embodiments, the network system  800  may include the server  801 . The server  801  includes the non-transitory memory  804  that is consistent with the memory  104  of the  FIGS. 1 and 2 . The server  801  of the network system  800  has one or more hardware processors  802 , consistent with the processors  102  of  FIGS. 1 and 2 , coupled to the non-transitory memory  804  and configured to read the instructions from the non-transitory memory  804  to cause the network system  800  to perform the operations as described further below. 
     The network system  800  may operate with more or less than the computing devices shown in  FIG. 8 , where each device may be configured to communicate over one or more communication networks  808 , possibly to transfer data accordingly. The one or more communication networks  808  may also include a packet-switched network configured to provide digital networking communications, possibly to exchange data of various forms, content, type, and/or structure. The one or more communication networks  808  may include a data network such as a private network, a local area network, a wide area network, and/or the like. In some examples, the one or more communication networks  808  may include a communications network such as a telecommunications network and/or a cellular network with one or more base stations, among other possible networks. 
     The data/data packets  822  and/or  824  may be transferrable using communication protocols such as packet layer protocols, packet ensemble protocols, and/or network layer protocols. In some examples, the data/data packets  822  and/or  824  may be transferrable using transmission control protocols and/or internet protocols (TCP/IP). In various embodiments, each of the data/data packets  822  and  824  may be assembled or disassembled into larger or smaller packets of varying sizes. As such, data/data packets  822  and/or  824  may be transferrable over the one or more networks  808  and to various locations in the network system  800 . In some examples, the data packets  822  and  824  are consistent with requests  119  of  FIGS. 1 and 2 . 
     In some embodiments, the server  801  may take a variety of forms. The server  801  may be an enterprise server, possibly configured with one or more operating systems to facilitate the scalability of the network system  800 . In some examples, the server  801  may configured with a Unix-based operating system to integrate with a growing number of other servers, user devices  805  and/or  806 , and one or more networks  808  over the network system  800 . 
     In some embodiments, the system/server  801  may include multiple components, such as a hardware processor  802 , a non-transitory memory  804 , a non-transitory data storage  816 , and/or a communication interface component  810 , among other possible components, any of which may be communicatively linked via a system bus, network, or other connection mechanism  820 . The hardware processor  802  may be implemented using a multi-purpose processor, a microprocessor, a special purpose processor, a digital signal processor (DSP) and/or other types of processing components. In some examples, the processor  802  may include an application specific integrated circuit (ASIC), a programmable system-on-chip (SOC), and/or a field-programmable gate array (FPGA) to process, read, and/or write data for providing services to numerous entities. In particular, the processor  802  may include a variable-bit (e.g., 64-bit) processor architecture specifically configured to facilitate the scalability of the increasing number of entities. As such, the one or more processors  802  may execute varying instructions sets (e.g., simplified and complex instructions sets) with fewer cycles per instruction than other conventional general-purpose processors to improve the performance of the server  801  for purposes of mass scalability and/or accommodation of growth. 
     The non-transitory memory component  804  and/or the data storage  816  may include one or more volatile, non-volatile, and/or replaceable data storage components, such as a magnetic, optical, and/or flash storage that may be integrated in whole or in part with the hardware processor  802 . Further, the memory component  804  may include a number of instructions and/or instruction sets. The processor  802  may be coupled to the memory component  804  and configured to read the instructions to cause the server  801  to perform operations, such as those described in this disclosure, illustrated by the accompanying figures, and/or otherwise contemplated herein. Notably, the data storage  816  or memory  804  may be configured to store numerous user data, possibly including data that may be accessed often by the user devices  805  and/or  806 . In some examples, the user data may include user ID and access codes or authentication tokens of a user. 
     The communication interface component  810  may take a variety of forms and may be configured to allow the server  801  to communicate with one or more devices, such as the user devices  805  and/or  806 . The communication interface component  810  is consistent with the network interface  204  of  FIG. 2 . In some examples, the communication interface component  810  may include a transceiver  819  that enables the server  801  to communicate with the user devices  805  and/or  806  via the one or more communication networks  808 . Further, the communication interface component  810  may include a wired interface, such as an Ethernet interface, to communicate with the user devices  805  and/or  806 . Yet further, the communication interface component  810  may include a wireless interface, such as a cellular interface, a Global System for Mobile Communications (GSM) interface, a Code Division Multiple Access (CDMA) interface, and/or a Time Division Multiple Access (TDMA) interface, among other possibilities. In addition, the communication interface  810  may include a wireless local area network interface such as a WI-FI interface configured to communicate with a number of different protocols. As such, the communication interface  810  may include a wireless interface configured to transfer data over short distances utilizing short-wavelength radio waves in approximately the 2.4 to 2.485 GHz range. In some instances, the communication interface  810  may send/receive data or data packets  822  and/or  824  to/from user devices  805  and/or  806 . 
     The user devices  805  and  806  may also be configured to perform a variety of operations such as those described in this disclosure, illustrated by the accompanying figures, and/or otherwise contemplated herein. Notably, the data storage  836 / 846  of the user devices  805  and  806  may be configured to store numerous user data, possibly including data that may be accessed often by the user devices  805  and  806  such as geographic/address data, request data, pattern data including action patterns, movement data including movement patterns, exercise data including exercise patterns, among other types of data associated with the user. In some examples, the user devices  805  and  806  may be configured to authenticate a user of the user devices  805  and  806  based on data stored, e.g., a security token, e.g., a PIN or password, in the user devices. Alternatively, the server  801  may authenticate a user based on receiving the security token from the user devices  805  and  806 . 
     In some embodiments, the user devices  805  and  806  may include or be implemented as a user device system, a personal computer (PC) such as a laptop device, a tablet computer device, a wearable computer device, a head-mountable display (HMD) device, a smart watch device, and/or other types of computing devices configured to transfer data. The user devices  805  and  806  may include various components, including, for example, input/output (I/O) interfaces  830  and  840 , communication interfaces  832  and  842  that may include transceivers  833  and  843 , hardware processors  834  and  844 , and non-transitory data storages  836  and  846 , respectively, all of which may be communicatively linked with each other via a system bus, network, or other connection mechanisms  838  and  848 , respectively. 
     The I/O interfaces  830  and  840  may be configured to receive inputs from and provide outputs to respective users of the user devices  805  and  806 . In some examples, the I/O interfaces  830  and  840  may include a display that provides a graphical user interface (GUI) configured to receive an input from a user. Thus, the I/O interfaces  830  and  840  may include displays configured to receive inputs and/or other input hardware with tangible surfaces, such as touchscreens with touch sensitive sensors and/or proximity sensors. The I/O interfaces  830  and  840  may also include a microphone configured to receive voice commands, a computer mouse, a keyboard, and/or other hardware to facilitate input mechanisms, possibly to authenticate a user. In addition, I/O interfaces  830  and  840  may include output hardware such as one or more sound speakers, other audio output mechanisms, haptic feedback systems, and/or other hardware components. 
     In some embodiments, communication interfaces  832  and  842  may include or take a variety of forms. In some examples, communication interfaces  832  and  842  may be configured to allow user devices  805  and  806 , respectively, to communicate with one or more devices according to a number of protocols described and/or contemplated herein. For instance, communication interfaces  832  and  842  may be configured to allow user devices  805  and  806 , respectively, to communicate with the server  801  via the one or more communication networks  808 . The hardware processors  834  and  844  may include one or more multi-purpose processors, microprocessors, special purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), programmable system-on-chips (SOC), field-programmable gate arrays (FPGA), and/or other types of processing components. 
     The non-transitory data storages  836  and  846  may include one or more volatile or non-volatile data storages, removable or non-removable data storages, and/or a combination of such data storages that may be integrated in whole or in part with the hardware processors  834  and  844 , respectively. Further, data storages  836  and  846  may include non-transitory memories that store instructions and/or instructions sets. Yet further, the hardware processors  834  and  844  may be coupled to the data storages  836  and  846 , respectively, and configured to read the instructions from the non-transitory memories to cause the user devices  805  and  806  to perform operations, respectively, such as those described in this disclosure, illustrated by the accompanying figures, and/or otherwise contemplated herein. 
     In some embodiments, the communication interface  810  is coupled to the one or more processors  802 . In some examples, a security module that can take the form of a module in the pattern processing engine  120  of  FIGS. 1 and 2  receives a request that includes an authentication request from a client device, e.g., client device  805 / 806  of a requester through the network interface  810  and a network  808 . In response to authenticating the requester, a security key is transmitted through the network interface  810  and the network to the client device  805 / 806  of the requester. The request is received through the network interface  810  and the network. The pattern processing engine  120  assigns a pattern recognition score and classifies the request and sends, encrypted, the score and the classification through the network interface  810  and the network  808  to the requester. The client device  805 / 806  of the requester uses the encrypted pattern recognition score and classification to automatically display it. 
     In some embodiments, the classification of the entity includes assigning the request to an acceptable group if the pattern recognition score is greater than a first predetermined threshold, assigning the request to a failure group if the pattern recognition score is less than a second predetermined threshold, and assigning the request to a limited group if the pattern recognition score is between the first and second thresholds. The assignment of the request to a limited group may include adjusting the limits of the request. In some examples, the request is a transaction request and adjusting may include limiting the amount of the transaction. In some examples, when the request is assigned to the failure group, the adjustment may include ignoring the request. 
     The present disclosure, the accompanying figures, and the claims are not intended to limit the present disclosure to the example embodiments disclosed. As such, it is contemplated that various alternate embodiments and/or modifications to the embodiment disclosed, whether explicitly described or implied herein, are possible in light of the disclosure and/or the figures. Having thus described embodiments of the present disclosure, persons of ordinary skill in the art will recognize that changes may be made to the embodiments disclosed without departing from the scope of the present disclosure.